SOE: User Data and Credit Card Information Compromised, Services Taken Down

May 2, 2011 -

As promised, Sony Online Entertainment has updated its official site to let customers know why it took down its services earlier today. To say it isn't good news for customers is a major understatement. According to the update, SOE took its game services down because of an intrusion that saw much of the same personal data and credit card info compromised by outside sources - similar to what happened on PlayStation Network. SOE says that personal info related to SOE accounts "may have been stolen" in a cyber attack.

This data includes "name, address (city, state, zip, country), email address, gender, birthdate, phone number, login name and hashed password." In addition, information from an outdated database from 2007 was compromised during the attack. This database contained approximately 12,700 non-US customer credit or debit card numbers and expiration dates (but not credit card security codes) and about 10,700 direct debit records listing bank account numbers of some customers in Germany, Austria, Netherlands and Spain may have also been obtained.

 

SOE says that there is no evidence that its main credit card database - a separate service, they say - was compromised. Some are reporting that this was a second separate attack independent of the original attack on PSN.

"We had previously believed that SOE customer data had not been obtained in the cyber-attacks on the company, but on May 1st we concluded that SOE account information may have been stolen and we are notifying you as soon as possible," the statement read.

To deal with the situation SOE has taken all game services offline, have engaged an outside security firm, and have taken steps to secure all of its games and services.

The usual advice that Sony offered to PlayStation Network users has been recycled for the SOE security breach. The best thing that SOE users can do is contact their bank or credit card company and cancel their cards.

We will have more on this story as it develops.

Source: SOE.com


Comments

Re: SOE: User Data and Credit Card Information Compromised, ...

(EDIT: New post instead of reply, ack.  Would be nice if you guys fixed the backend so that clicking on Reply and then logging in didn't dump you to a new post box...)

Re: SOE: User Data and Credit Card Information Compromised, ...

Holy crap man. I'm having trouble conceiving any way sony could be more screwed. I suppose if Skynet infiltrated folding @ home.

-Austin from Oregon

Feel free to check out my blog.

Re: SOE: User Data and Credit Card Information Compromised, ...

Hashed password...what exactly does that mean? i've heard that before, something about hashed passwords being useless to anyone who steals them? 

Re: SOE: User Data and Credit Card Information Compromised, ...

It's something crypogtaphic I hear, scrambles it enough to make it completely useless. Maybe it replaces it with boxes like it does when text can't be translated.

Re: SOE: User Data and Credit Card Information Compromised, ...

Passwords are stored, typically, in the form of a hash.

Hashing is an algorithmic function which converts an input of a variable length (in this case, your password) to an output of fixed length.

 

For example, "The quick brown fox jumps over the lazy dog" hashes into "2FD4E1C67A2D28FCED849EE1BB76E7391B93EB12". (Note that it would be that length, whether it was a ten-megabyte text file or your name being hashed; that's what "variable length into fixed length" means)

 

The key to a hash function is that it's a "trapdoor" function. It's relatively trivial for a computer to get the hash from the input, but it is insanely difficult to get the input from the hash, which is why passwords are stored that way in the first place. (You enter password, computer hashes password, hash matches stored hash, password accepted) To break a hashed password, the hacker basically has to use a program to guess passwords, then compare them to the hashes.

 

What this means is, anyone using a secure password (something fairly long, not composed of common words, etc; not giving a password security lecture here) is potentially fine but should change that password if they use it for anything else (which they shouldn't be doing anyway, because not reusing passwords is part of having a secure password). If you have a crappy password (something found in a dictionary especially), and you had a PSN or SOE account, and you used that password in anything else, change it now. I mean it. Stop reading and go change it, on everything it's used in. Best to assume it's broken.

 

Statistically, a lot of those passwords are going to be insecure. Breaking a truly secure password is a daunting task that might take days, weeks, or months of constant, dedicated processing by a fairly powerful computer; it has to make a guess, hash that, compare it to the stored hash, and then make another guess. Not feasible. Breaking a really insecure password is actually fairly trivial, because anyone actually trying to harvest passwords is going to have dictionaries of commonly-used words and derivations of words.

 

Comparing twenty thousand password guesses to a decent password is, statistically, not going to work. You have to go through literally millions or billions of possible guesses. Comparing a handful of really common passwords to a database of twenty thousand random people, however, is probably going to give you a few hits.

Re: SOE: User Data and Credit Card Information Compromised, ...

So morale of the story is if they did use this method, chances are that while everyone SHOULD change their password, the chances of the hackers having it in any usable form (barring shit passwords) are pretty low.

Good to know. 

Re: SOE: User Data and Credit Card Information Compromised, ...

Pretty much.

In general hashed password lists are only good for asking 'is this the password?', but poor for finding out what the password is.  Any (standard) modern system is likely to be difficult enough to break as to be useless to them because it comes down to raw math... as long as they did not try to implement their own algorithm it comes down to brute forcing it.

Re: SOE: User Data and Credit Card Information Compromised, ...

Makes me glad I made absolute sure my PSN account password was unique to that account.

Re: SOE: User Data and Credit Card Information Compromised, ...

Good man.

 

I don't claim, by the way, to understand fully the implementation of hashing methods into a security system. I know the basics via coursework but I haven't studied higher-level implementation concepts yet.

Re: SOE: User Data and Credit Card Information Compromised, ...

You forgot one important fact:

A hash ease of reverse engineering is inversely proportional to the collision risk of said hash algorithm. For example, if you store a hash of 10 characters for passwords that range from 1 to 9 characters, you can have an algorithm that has 0 chance of collision (every possible hash is unique), however, this makes reverse-engineering the hash that much more easy. However, if you have a 10 characters long hash for password ranging in length from 4 to 20 characters, there is no way for you to find an algorithm that will not create collision. Still, it will make it that much harder to reverse-engineer the hashes since each hash has multiple possible source.

The way hashes work is usually they will add a known salt to the password (a key of sort) and then pass it through one of a multiple of algorithm. Btw, the more algorithm, the LESS secure the password hashing ends up (anything passed to the function will end up with the same hash and thus will be verified. On the + side, go try and reverse-engineer that :P ) the same way using a random number to seed the next number of the same random number generator will quickly destroy any randomness in the system.

Anyway, what would be important to know here is which security they were the most worried about: Their network (big hash, low collision, higher risk of reverse engineering if you steal the data, but obviously they didn't think about that) or an average user (smaller hash, higher collision, the reverse engineering is less likely but the user could have false positive with wrong passwords on their network). I'd normally wager the first, but considering how little of an understanding Sony seems to have had of security in general, I'd say it's anybody's guess.

Re: SOE: User Data and Credit Card Information Compromised, ...

Giving this is the second attack on Sony in two weeks, someone has it out for them.

Re: SOE: User Data and Credit Card Information Compromised, ...

It's almost certainly the same people in a second targeted attack, but as for "having it in for them" -- well, it COULD be somebody cheesed off at the Hotz settlement, but really you don't need an ulterior motive to break into a major company's servers and steal its customer data; the credit card/ID theft potential is an end in and of itself.  Every single Fortune 500 company is a potential target for this kind of attack, regardless of company politics or recent PR situation.

Again, it's possible this was done by a group (it IS most likely a group and not an individual) that has a grudge against Sony, but it could just be that they were looking for a major company with a vulnerable network and Sony was the one they found.

Re: SOE: User Data and Credit Card Information Compromised, ...

Or at the least saw whath append with PSN and figured other Sony networks could be broken into using similar methods.

Re: SOE: User Data and Credit Card Information Compromised, ...

Or the two networks are connected, and they are only now discovering that the breech crossed both systems.

Re: SOE: User Data and Credit Card Information Compromised, ...

If so that only adds to how angry I am this morning as I was hoping t odownload any updates and finally be able to be online again.

 
Forgot your password?
Username :
Password :

Shout box

You're not permitted to post shouts.
MattsworknameWilson: how? Im still waiting for my upgrade notice07/29/2015 - 3:44am
Matthew WilsonI updated to a clean instill of windows 10.07/29/2015 - 2:36am
Mattsworknameargue that it's wrong, but then please admit it's wrong on ALL Fronts07/29/2015 - 2:06am
MattsworknameTechnoGeek: It's actually NOT, but it is a method used all across the specturm. See Rush limbaugh, MSNBC, Shawn hannity, etc etc, how many compagns have been brought up to try and shut them down by going after there advertisers. It's fine if you wanna07/29/2015 - 2:05am
Mattsworknamediscussed, while not what I liked and not the methods I wanted to see used, were , in a sense, the effort of thsoe game consuming masses to hold what they felt was supposed to be there press accountable for what many of them felt was Betrayal07/29/2015 - 2:03am
MattsworknameAs we say, the gamers are dead article set of a firestorm among the game consuming populace, who, ideally, were the intended audiance for sites like Kotaku, Polygon, Et all. As such, the turn about on them and the attacking of them, via the metods07/29/2015 - 2:03am
MattsworknameAndrew: Thats kind fo the issue at hand, Accountable is a matter of context. For a media group, it means accountable to its reader. to a goverment, to it's voters and tax payer, to a company, to it's share holders.07/29/2015 - 2:02am
Andrew EisenAnd again, you keep saying "accountable." What exactly does that mean? How is Gamasutra not accounting for the editorial it published?07/28/2015 - 11:47pm
Andrew EisenMatt - I disagree with your 9:12 and 9:16 comment. There are myriad ways to address content you don't like. And they're far easier to execute in the online space.07/28/2015 - 11:47pm
Andrew EisenMatt - Banning in the legal sense? Not that I'm aware but there have certainly been groups of gamers who have worked towards getting content they don't like removed.07/28/2015 - 11:45pm
DanJAlexander's editorial was and continues to be grossly misrepresented by her opponents. And if you don't like a site, you stop reading it - same as not watching a tv show. They get your first click, but not your second.07/28/2015 - 11:40pm
TechnogeekYes, because actively trying to convince advertisers to influence the editorial content of media is a perfectly acceptable thing to do, especially for a movement that's ostensibly about journalistic ethics.07/28/2015 - 11:02pm
Mattsworknameanother07/28/2015 - 9:16pm
Mattsworknameyou HAVE TO click on it. So they get the click revenue weather you like what it says or not. as such, the targeting of advertisers most likely seemed like a good course of action to those who wanted to hold those media groups accountable for one reason07/28/2015 - 9:16pm
MattsworknameBut, when you look at online media, it's completely different, with far more options, but far few ways to address issues that the consumers may have. In tv, you don't like what they show, you don't watch. But in order to see if you like something online07/28/2015 - 9:12pm
MattsworknameIn tv, and radio, ratings are how it works. your ratings determine how well you do and how much money you an charge.07/28/2015 - 9:02pm
Mattsworknameexpect to do so without someone wanting to hold you to task for it07/28/2015 - 9:00pm
MattsworknameMecha: I don't think anyone was asking for Editoral changes, what they wanted was to show those media groups that if they were gonna bash there own audiance, the audiance was not gonna take it sitting down. you can write what you want, but you can't07/28/2015 - 8:56pm
MattsworknameAndrew, Im asking as a practical question, Have gamers, as a group, ever asked for a game, or other item, to be banned. Im trying to see if theres any cases anyone else remembers cause I cant find or remember any.07/28/2015 - 8:55pm
Andrew EisenAs mentioned, Gamasutra isn't a gaming site, it's a game industry site. I don't feel it's changed its focus at all. Also, I don't get the sense that the majority of the people who took issue with that one opinion piece were regular readers anyway.07/28/2015 - 8:43pm
 

Be Heard - Contact Your Politician