Sony Targeted Yet Again; Thwarts Attackers This Time 68
alphadogg writes with an excerpt from a Network World article: "Sony suspended 93,000 user accounts on several of its gaming and entertainment networks after unauthorized login attempts on those accounts. The attempts occurred on the PlayStation Network, Sony Entertainment Network, and Sony Online Entertainment, and the company says that login information likely acquired from other sources was tested en masse on the networks. Only a 'small number' of the attempts were successful, and no credit card information was leaked. ... Sony Chief Information Security Officer Philip Reitinger said that 'less than one tenth of one percent' of the networks' users may have been affected."
93 million accounts? (Score:2)
"Sony suspended 93,000 user accounts
'less than one tenth of one percent' of the networks' users
Sony has over 93 million accounts? ... ?
As far as I know only about 50 million PS3s have been sold, some to upgraders / replacers / theft or fire insurance claims, so there's probably less than 50 million PS3 user accounts.
The other 50 million or so accounts are
Re: (Score:1)
Re: (Score:3)
(PSN patched the game so people couldn't trade expensive cars any more so that glitch is gone.)
I could easily believe there are lots of fake accounts out there for similar reasons.
Re: (Score:1)
Just to note: Some people may have multiple accounts. I know people with 2+ PSN accounts.
But it is also for two other divisions of their network, not just PSN.
Re: (Score:2)
During the hacking fiasco, the press was reporting that there were 100m PlayStation Network accounts, which covers both the PS3 and the PSP. That gives us a total of around 75m units. While many of the remaining 25m will be dummy accounts used to download items from the regional PSN stores (which was quite popular in the early days), I'm sure that the majority are simply friends, family members etc.
Re: (Score:2)
Re: (Score:1)
Sony has over 93 million accounts?
It is only 265510(oct) or 16B48(hex) accounts
You've tried to be clever, but fucked up by a considerable margin. Try again. Clue: 10^6 not 10^3.
Re: (Score:2)
Right on this page - Related Links - "77 Million Accounts Stolen From Playstation Network [slashdot.org]." And, as the summary says, this is about more than that - "PlayStation Network, Sony Entertainment Network, and Sony Online Entertainment."
So, yes, 93 million accounts is reasonable, based solely on information found on the same page you posted to.
Re: (Score:1)
Ok, 77 million accounts were stolen, and now 93 million accounts are left. Therefore before the theft, there have been 170 million accounts. Right? :-)
Re: (Score:2)
From the Sony Online Entertainment and Sony Entertainment Network?
His blog post breaks them down as - (PSN/SEN: approximately 60,000 accounts; SOE: approximately 33,000)
Re: (Score:2)
Re: (Score:2)
Wow 50 million PS3s? Increase that by another 50% and it's getting close to the number of Blackberry subscribers...
Which is, what, about 1.5% of cell phones?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Sony has over 93 million accounts? As far as I know only about 50 million PS3s have been sold, some to upgraders / replacers / theft or fire insurance claims, so there's probably less than 50 million PS3 user accounts. The other 50 million or so accounts are ... ?
I have 5 accounts myself, iirc 2 europeans, 1 american, 1 japanese, 1 hong kong, I bet others have more than one account too
Re: (Score:1)
I have 8 accounts, and 0 PS3s.
Re: (Score:2)
Current and past SOE customers for games such as Everquest and Star Wars Galaxies.
Re: (Score:2)
As far as I know only about 50 million PS3s have been sold, some to upgraders / replacers / theft or fire insurance claims, so there's probably less than 50 million PS3 user accounts.
As far as I know, PSN accounts are not tied to consoles, so why would upgraders / replacers / fire insurance claims have anything to do with this?
Re: (Score:2)
SOE (EQ, SWG, whatever that star wars adventure kids game is), the PSP, qirosity or however their marketing dipshit spelled it which is a mobile music service. Also, once you create an account it exists forever basically (I'm sure they *can* be deleted, but usually aren't).
The playstation network, and sony's network services in general are a whole lot bigger than just the PS3. There's a lot of overlap between PSP and PS3 owners probably, but the other services not necessarily. How many people played the
Families often have more (Score:2)
One for each parent, one for each kid. That way the trophies and such stay separate.
"Sony Chief Information Security Officer" (Score:1)
Probably a more appropriate title these days... (Score:2)
.. would be Security Officer - Sony.
(For headscratchers - think TLA).
Re: (Score:2)
Could be worse. Google hired a former TV psychic as head of their Apps security.
And, no, I'm not joking.
Re: (Score:3)
Well at least he could foresee what hacks were coming and when!
Couldn't he...? Whaddyamean no?
Re: (Score:3)
Numbers, please! (Score:1)
'less than one tenth of one percent'
Which means ... how many accounts?
Are you contacting the compromised account owners for assistance?
Re: (Score:1)
Given that they suspended 93000 accounts (see the first line of the summary), Id expect that to be the number of compromised accounts.
Coincidence? (Score:1)
"login information likely acquired from other sources was tested en masse on the networks."
Acquired from other sources? Maybe from wine hq? [slashdot.org]
Decent Catch (Score:1)
Re: (Score:2)
Didn't they say the same thing last time? (Score:1)
IIRC, Sony denied anything had been compromised *last time* too. It was only days later that they admitted the scale of the attack and how successful it had been.
Re:Didn't they say the same thing last time? (Score:5, Insightful)
No, last time they kept quiet about the scale, nature, and results of the attack, while this time they've announced the scale (90,000+ users), nature (user/password attempts), and results (some accounts are compromised) of the attack. It would appear that they have learned at least a little.
"Sony Flips the Bird at Noggly Hax0rz" (Score:1)
...news at 4:11
"Now back to you, Bob"
Or... (Score:1)
...It could be another PR stunt to make it look like they have the best security and tracking team on the planet.
I'd like to hear from one of the 93,000 people whose accounts were suspended. I'd like to know that these are actual accounts with real people.
Re: (Score:1)
I noticed that I couldn't log in to EQ2 last night, but there was a post in the forums [sony.com] about SOE taking things offline for maintenance at 8PM PST (normally they do it at 7am PST). Then, I got this email in the morning:
Re: (Score:2)
Too bad that was anonymous.
Re: (Score:2)
You don't have to have "the best security and tracking team on the planet" to notice that someone's trying tens of thousands of usernames and passwords and failing. And it doesn't exactly scream competence when it turns out that user details your company failed to protect are now being actively used by fraudsters. It just compounds the original failure.
Re: (Score:2)
You don't have to have "the best security and tracking team on the planet" to notice that someone's trying tens of thousands of usernames and passwords and failing.
I didn't say that they ARE the best team. I said "PR stunt" which is targeted at the unknowing, not the most knowledgeable receiver.
And it doesn't exactly scream competence when it turns out that user details your company failed to protect are now being actively used by fraudsters. It just compounds the original failure.
I also mentioned the possibility that these users don't exist. "PR STUNT" - italicized and capped. I don't know how to make what I said more clear.
If you're one of the users of a company that releases that kind of information, and you aren't one of the "affected" people, it increases your feeling of safety and security. Simple logic, simple stunt. While they're at it, they
93,000 DoS'd accounts (Score:3, Interesting)
Sounds like the attack was successful to me.
Re: (Score:2)
Re: (Score:2)
I don't know. I assume not. Enforcing complex passwords, IMHO, would be better than shutting down thousands of user accounts. Are people connecting to their Sony account and receiving the following message, "We are sorry. Your password sucked. Your account has been disabled. Please go fuck yourself. --Sony"?
Re: (Score:2)
Assuming the compromised database had proper hashing with per-user salts, you are right. In any other case, the vulnerability here was the third-party storage and not the password strength. (On top of password re-use, of course).
Re: (Score:2)
If Sony detects this sort of login behavior (multiple failed login attempts to many differen
Re: (Score:2)
If Sony detects this sort of login behavior (multiple failed login attempts to many different accounts coming from the same IP), the correct response is to lock the account
This is essentially a vector for denial of service. Set up a brute force attack from a throw away ip address with one user:pass. Attack 2 then 3 then 4 then 5... accounts until you hit the sweet spot. Then whenever you wish to DoS Sony user accounts you hit Sony with a brute force attack above the known number of accounts. Or equally
Misleading Summary (Score:3)
The summary states that there 93,000 login attempts and that a small number of the attempts were successful. This is false. There was an undisclosed number of attempts, and 93,000 accounts were successfully compromised. From Sony's own statement:
'Thwarted'? Try 'tripped over'. (Score:1)
- Let's say that the 93,000 accounts only make up 10% of the total scope of the attack. 930,000 accounts hit, or 1% of the account-base (according to Sony).
- Let's say that only 1 attempt was ever made per account (the most difficult scenario to de