#sony breach

[crazygeeksonline-blog]

Another Blow on Online Security of Sony

Sony confirms another security breach on its online network of PlayStation when 93,000 of its customer accounts were logged in by third parties during this month.  Hackers have used a large set of IDs and Passwords to gain access to around 600,000 user accounts on PlayStation and entertainment Networks and about 33,000 of Online Entertainment Server accounts of Sony.

Sony has informed affected users through email that it is closing hacked accounts on its entertainment and online gaming networks.

This is another issue of security breach, raised this year after the massive illegal hacking attack in April. The prior massive attack affected around 100 million accounts on different networks of Sony including PlayStation Network, Sony Online Entertainment and Qriocity networks. In response to the attack, Company compelled to freeze its PlayStation Network for a month.

Sony has said in a statement that attacks of intrusion occurred for four days from Friday to Monday, attacking around “less than one-tenth of one percent” of PlayStation, Entertainment and Online Server accounts. It added, though intruders become successful to verify IDs and Passwords, but Credit Card Information is safe and not leaked during attacks. Sony has ceased all of the affected accounts after confirmation of unauthorized attempts.  Whether these attacks were attempted by a single person or many different parties from different locations, is still not clear to Sony

Philip Reitinger, CIO of Sony, said on a Blog of PlayStation, “in this case, given that the data tested against our network consisted of sign-in ID-password pairs, and that the overwhelming majority of the pairs failed in matching attempts, it is likely the data came from another source and not from our Networks."

Intruded accounts showed extra ordinary activity before being ceased, but information about those activities has not yet been gained and detailed. According to chief Information Security Officer, security team at Sony is still investigating the magnitude of unauthorized activities on locked accounts. Citing about what could be the extra ordinary activity, he said, "We will work with any users whom we confirm have had unauthorized purchases made to restore amounts in the PSN/SEN or SOE wallet."

Sony is informing, its affective consumers via email, about freezing of their accounts and asking them to reset their Passwords securely.

Sony has a very strong customer base as realized after previous attacking incident, when vast number of online gaming users restored their accounts back when Sony restored its Services of Online Gaming in May. 

Sony’s main objective is to deeply integrate its hardware, services and contents, claiming that despite of all those previous and new attacks of cyber hacking, Sony is still working to provide its customers with integrated services. 

This year has been difficult for Sony in terms of continuous Cyber-attacks as earlier huge attacks resulted in closing of PNS for about a month. Sony issued various apologies in Damage-control Department, promising to strengthen its security network, paying $1 million as Identity theft insurance policy and providing free access of PlayStation Plus to its affected PlayStation members for a month.

This hacking scandal compromised millions of online gamers’ personal information about their names and credit card details. It was a severe blow on the security of Sony, making the public image of Gaming Networks worse.

[omartv-blog]

Let's talk Sony and IMF: Fail

So unless you have been living under a rock (or on vacation!), a barrage of cyber attacks have been going on the past 1-2 months now. The primary treasure taken was the databases and customer information, though it definitely has had an extended impact beyond just data theft.

Sony, the primary slap-dummy in all this, was hit repeatable, with the Play Station Gaming Network Customer Information the target. What's ironic about this is they constantly reported they had no idea how it happened, weren't sure exactly what happened, and didn't seem to be in much of a rush to stop the bleeding. I'll tell you what happened: You got hit, hit again, and again, and again, and then once we were done with you, we went to your cousin's in the other countries (Brazil) and ran the same game on them. Talk about getting kicked when down. And then kicking your family, friends, mechanic, neighbors at the same time. Ouch.

Something like that just stinks of not properly monitoring your external networks, but also really sounds like there is an element of single point of failure. Basically, once they figured out how to get in to the primary domain, they were given access into everything else; or were able to quickly figure it out. Let's not even talk about the IPS/IDS not communicating with the other nodes.

Our friends at the IMF have been getting hammered with sex scandals from their former head, but now they report a cyber attack happened in mid-May. This time the objective was to get an inside presence from the installation of mal/spyware in order to gain access to personal information for fraudulent usage. The IMF also had several employee's laptops compromised and was then used to access critical systems within.

What does this all mean? All of this again shows just how real, sophisticated, and powerful a cyberattack can be. One big thing that companies of all sizes have a hard time with is monitoring their systems and taking action on events that look suspicious in nature. Big companies are hit a lot more than a small business or one, two, or three person firm, but the impact is still the same. Loss of revenue, loss of reputation, and loss of data, which can turn into serious legal matters.

The good news is you can shield yourself enough to at least provide some insulation from all of this.

1. Have an active firewall operating and monitor it daily

2. Review and manage all access to sensitive systems and accounts

3. Have your network and systems scanned for vulnerabilities (virus, malware, open ports, attack attempts)

4. Communicate immediately to customers and clients if any sensitive customer data was breached or accessed in anyway

5. Implement some system to manage and classify all data residing in your servers and systems (or cloud service)

I know that's not the most advanced and complex system, but it well let you implement a basic security architecture which you can manage yourself.

Good luck and you know who to ask if you have any questions.

[bossgroup-blog]

Sony Executives Bowed In Apology On Sunday

While resting my brain from an incredibly busy week this morning, I saw this headline scroll across my local news: "Sony executives bowed in apology on Sunday" ... and as I often do, I had to go online and read the actual story.

The story reads that Kazuo Hirai, chief of Sony Corp's PlayStation video game unit said “We deeply apologise for the inconvenience we have caused". He was one of three executives who bowed for several seconds at the company's Tokyo headquarters in the traditional style of a Japanese apology.

On Friday, my past employer, Reuters (IMHO the only honest voice in news reporting), announced that credit card companies would pay more than $300 million of card replacement costs if every customers affected by the Sony data breach decided to replace their credit cards. (Let me add my voice ... Replace Your Card, Change your Passwords ... seriously, now!)

Until CNN is finished talking about Obama's birth certificate, the Royal Wedding, and Donald Trump, the actual impacts of the Sony breach are not going to be well understood. This is an enormous incident. And despite the image of teenagers playing socom fireteambravo 2 or killzone liberation, this breach has impacted every Sony NetFlix customer as well. And who's credit card do you think was so freely shared with Sony anyways?

B.O.S.S., like so many of our contemporaries spend a lot of time dispelling the bad things that the Internet can represent to brands trying to do business online (pornography, hackers, spam, and bad guys trying to steal your private data). This one could be a setback for Internet commerce. If Sony, a corporation that employs nearly 200,000 people and makes $90 Billion USD in revenues can't be trusted to hold and protect your data with all the resources at their disposal; how in the hell can you trust your personal data and credit card information with Barney's Flower Shoppe?

One must also question the validy of the exhaustive work that must be done by Barney's Flower Shoppe to attain PCI-DSS accreditation from the Visa / MasterCard associations. Again, for all the effort necessary to store credit card information on your network, Visa and MasterCard demand 3rd party verification that you're taking every precaution with their cardholder data.

For Sony, storing the credit card data of about 10 million customers must put them at the highest level of scrutiny by Visa and MasterCard. This breach will have serious reprecussions on the likes of Barney's Flower Shoppe -- who undoubtedly will be under a much more powerful microscope than ever before. Will the small-to-medium sized business owner be prevented from doing business online? Between red tape, scrutiny by card associations and public mistrust, I fear that they will.

With the recent Epsilon breach and now the Sony breach, you have to assume that countries that have consumer protection legislation (and fines for failing to protect such data) will soon be enforcing their own laws and assessing fines under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA); the European Directive on Protection of Personal Data; and California's SB1386. You also have to wonder if this is big enough for U.S. legislators to re-open or re-kindle the Personal Data Privacy and Security Act of 2009 -- with enough teeth to effectively protect U.S. citizen's who have had their data breached.

Meanwhile, for those of us fighting the good fight, we have to wonder what will be the effects of this and yet-to-come data breaches on the trust of consumers to conduct business, share their personal data and credit card information with brands, whether a Sony or a Barney's Flower Shoppe?

-Doug