PSN fiasco

[Neo Kaiser]

http://blog.us.playstation.com/2011/04/ ... /#comments

These are the fucking things that makes my blood boiling to no end. The fact that some shitty idiot could lock me out of my PSN account and delete my downloaded game info...

[sweener2001]

what annoys me is the nonchalant contest in all the comments and threads i've seen about this. i'm not happy in the least, especially since i only recently gave sony any of my CC information. yet the internet is trying to see who is the least mad about potentially having their identities stolen and the utter lack of communication from sony.

[grinvader]

i'm nonchalant coz i genuinely don't give a fuck !



being too lazy to set an account up sure came in handy :3



also lawl trusting anything with your CC info

[kode54]

I trust gaben with credit card info.

[Agozer]

I've changed some of my passwords just in case, and will turn off online transaction support from my debit card. At least for a while.

[sweener2001]

i'm nonchalant coz i genuinely don't give a fuck !



being too lazy to set an account up sure came in handy :3



also lawl trusting anything with your CC info

amazon, ebay, and other online purchasing sites haven't had their databases stolen. luckily i never shopped at etsy's.

[grinvader]

Code: Select all

<LordNUniv> http://arstechnica.com/gaming/news/2011/04/ars-readers-report-credit-card-fraud-blame-sony.ars
<LordNUniv> it begins

Stop ! Card renewal time.

[sweener2001]

ugh.

[Gil_Hamilton]

Code: Select all

<LordNUniv> http://arstechnica.com/gaming/news/2011/04/ars-readers-report-credit-card-fraud-blame-sony.ars
<LordNUniv> it begins

Stop ! Card renewal time.

And they called me paranoid when I refused to give Sony my debit card number and bought a gift card from the store instead...

[sweener2001]

according to gamespot, sony says that they actually bothered to encrypt the cc info, and that it was likely not stolen.

i'm still going to be watching my account like a hawk for the next few weeks.

[grinvader]

You know what happens when an encrypted database gets stoeled ?

the decrypting keys magically find their way to it eventually (if not beforehand)

[Neo Kaiser]

Maybe a Social Engineering attack made by fired employees or something could be a possibility.

[Gil_Hamilton]

Kaiser, just shut up. Please.

You started off by ranting about deleted account information, when no information was deleted, and that was the LEAST damaging possibility in any case(restore from backup, problem solved, god DAMN the internet is full of idiots, why are you bitching about down time, friend lists, trophy collections, and download history when your NAME, ADDRESS, AND CREDIT CARD NUMBER JUST GOT STOLEN?).

Now you're babbling about social engineering, and I don't believe you know what that means.
Particularly as Sony's reaction indicates it was likely NOT a case of someone talking someone else out of their password.

according to gamespot, sony says that they actually bothered to encrypt the cc info, and that it was likely not stolen.

i'm still going to be watching my account like a hawk for the next few weeks.

That's not what Sony is saying. Well, aside from the encryption part.

Q: Was my credit card data taken?

A: While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.

They're taking great pains to NOT leave anyone with the impression their card information is secure. And at least for US customers, e-mailing them the contact information for all 3 major credit reporting agencies, as well as the Federal Trade Commission's identity theft page.


Sony is NOT saying credit card information was likely not stolen. They're stopping just short of saying "yeah, we totally gave your credit card numbers to some dudes in Russia. They looked okay to me. My bad."

[Neo Kaiser]

Kaiser, just shut up. Please.

You started off by ranting about deleted account information, when no information was deleted, and that was the LEAST damaging possibility in any case(restore from backup, problem solved, god DAMN the internet is full of idiots, why are you bitching about down time, friend lists, trophy collections, and download history when your NAME, ADDRESS, AND CREDIT CARD NUMBER JUST GOT STOLEN?).

Now you're babbling about social engineering, and I don't believe you know what that means.
Particularly as Sony's reaction indicates it was likely NOT a case of someone talking someone else out of their password.

But Gil I'm not stating my speculations as fact. I use PSN prepaid cards only and changed my address months ago to a fictional one just to see what happens by pure coincidence before my PS3 got YLOD but because I couldn't use my PS3, I didn't changed my information when PS3 scene got shady with the Anonymous DOS attacks. I never said that the data got deleted but that I'm worried it would and I'm also worried that they have my e-mail (that I changed the password) and my name but I admit that I forgot servers have hard-drives on RAID... (maybe RAID 5). BTW the Social Engineering definition is on the CompTIA A+ 2009 book and the internet. Most companies don't change the password immediately after a employee is fired but then again I'm speculating because I don't know if those employees have a security camera on their office because I simply don't know then again it's my imagination who speculates because I'm not on their building.

[odditude]

Most companies with datacenter class equipment don't NEED to change passwords every time someone is fired (which is more or less weekly), because access to OAMP and enterprise hardware is only permitted from jump boxes that require multifactor authentication - as soon as their domain and/or TACACS account is locked, they're done.

What I find interesting is the latest rumblings that the equipment is being relocated; I smell lawsuit against a colo/hosting provider.

I can pretty much guarantee that the crew that manages those boxes have been shitting themselves for a week... and are PISSED.

[Neo Kaiser]

Most companies with datacenter class equipment don't NEED to change passwords every time someone is fired (which is more or less weekly), because access to OAMP and enterprise hardware is only permitted from jump boxes that require multifactor authentication - as soon as their domain and/or TACACS account is locked, they're done.

What I find interesting is the latest rumblings that the equipment is being relocated; I smell lawsuit against a colo/hosting provider.

I can pretty much guarantee that the crew that manages those boxes have been shitting themselves for a week... and are PISSED.

Never knew about TACACS , TACACS+ or RADIUS. A very interesting read and yes the guys with the boxes could be in trouble.

[sweener2001]

eh.

my lack of specificity is your field day. by monday, my life will calm enough to get a new card. last week of college.

[kode54]

Also, what is that you said about RAID? RAID is not backup.

[Neo Kaiser]

Also, what is that you said about RAID? RAID is not backup.

It's not backup but it protects the data but I think it will not help here anyway, I don't even knew why I mentioned RAID as we are not talking about mechanical failure but anyway the should have tape or something.

Oh and BTW a senator is aware.

Check HERE in 1up

Also Sony is Moving their server.

[Gil_Hamilton]

Also, what is that you said about RAID? RAID is not backup.

It's not backup but it protects the data but I think it will not help here anyway, I don't even knew why I mentioned RAID as we are not talking about mechanical failure but anyway the should have tape or something.

More importantly... "stealing" data does not destroy the original?
It is data duplication, not literal theft.
I don't even know why this "my frendz list iz ded noooooooo" shit ever started.


Also, they wouldn't have shut the entire network down for over a week if it was someone gaining entry by using a legit user name and password.
Furthermore, you don't change someone's password when you fire them. You disable their account. It takes maybe thirty seconds, and as I understand things, usually happens within minutes of the firing.

[grinvader]

More importantly... "stealing" data does not destroy the original?
It is data duplication, not literal theft.

you obviously forgot the classic

[Gil_Hamilton]

More importantly... "stealing" data does not destroy the original?
It is data duplication, not literal theft.

you obviously forgot the classic

Man, I wish I had saved a copy of the time that dude threatened to hack my computer and steal my media player.
I think that was a decade ago now, and it STILL makes me laugh.

[Neo Kaiser]

http://kotaku.com/#!5797288/playstation ... d-security

WTF?! Now I think this is a exaggeration.

[snkcube]

http://kotaku.com/#!5797412/sony-playst ... -this-week

Hey look, Sony is giving every one a free 30 day trial to PSN Plus.

[Neo Kaiser]

That's good so far... I better take my PS3 to get the reballing this week.