Sony's Playstation Network is down. Indefinitely.

[complacent]

article.

wow. this is impressively bad. not only has sony's network been shut down, it looks like user information may have been compromised. this is a pretty big deal.

from the article:

The Sony Playstation Network hack that has plagued the video game platform since April 20 has forced the company to shutdown the service indefinitely while it works to rebuild the platform.

The Playstation blog, a space normally used for gaming updates, tips and anecdotes, has been updating the status of the network about once a day since the initial attack brought down the platform last week. It said April 25 that the company does not have a timeframe for when the service will again be available.

"I know you are waiting for additional information on when PlayStation Network and Qriocity services will be online. Unfortunately, I don't have an update or timeframe to share at this point in time," wrote Patrick Seybold, senior director for communications and social media at Playstation.

The company acknowledged the hack April 22 in a post stating that an "external intrusion on our system has affected our PlayStation Network and Qriocity services. In order to conduct a thorough investigation and to verify the smooth and secure operation of our network services going forward, we turned off PlayStation Network & Qriocity services on the evening of Wednesday, April 20th."

Seybold wrote that the Playstation Network is "re-building our system to further strengthen our network infrastructure." That suggest that the intrusion is not a distributed denial of service (DDoS) attack but a more sophisticated hook into the system.

International hacker group Anonymous, which has taken down websites large and small with DDoS attacks according to its political agenda, has denied responsibility for the attack. In a post on its message boards, Anonymous said "for once we didn't do it."

Note: Unedited from the original Anonymous message, typos and all.

Sony's Playstation Network, its online service for Playstation 3 and its Playstation Portable consoles, suffered from a major outage today; which is on going as of this writting. According to Son'ys blog, the interruption in service may last into the long weekend - for at least another "full day or two". Sony released a statement through its EU blog, saying that the network outage may be a result of "targeted behaviour by an outside party", brining in the possibility of cyberattacks. Adding to the confusion is the fact that the message has since been removed.

While it could be the case that other Anons have acted by themselves AnonOps wa not related to this incident and takes no responsiblity for it. A more likely explination is that Sony is taking advantage of Anonymous' previous ill-will towards the company to distract users from the fact the outage is accutally an internal problem with the companies servers.

Sony is incompetent.

Anonymous had originally been upset with Sony over its decision to sue hacker George Hotz after he jailbroke the Playstation 3. Sony and Hotz settled the case earlier this month.

The Playstation Network has upwards of 70 million members and has been around since 2006. It allows users to play multi-player games online, rent videos and games, watch Netflix movies, instant message and chat. Qriocity is the European version of the service.

oof. no bueno.

i found this little ditty over on reddit that "theorizes" as to what actually went down. granted this is just one person's theory, but if the source is real, it's probably a pretty fair guess.

Ok, I've seen a bunch of speculation of why people think PSN is down, and I thought I should just post what the community knows in comparison to what Sony is telling everyone. The truth is, there was a new CFW (custom firmware) released known as Rebug (http://rebug.me). It essentially turns a retail console into a dev console (not fully, but gives you a lot of the same options that usually dev's only have access to). Anyway, this new CFW was quickly figured out by 3rd parties (not Rebug) to give CFW users access to the PSN network again via the dev networks. With a little manipulation of the URL's through a proxy server you could get your hacked console back online. Not that big of a deal, right? Well, it also turns out that some people over at NGU found out that you could provide fake CC# info and the authenticity of the information was never checked as you were on Sony's private developer PSN network (essentially a network that Sony trusted). What happened next was extreme piracy of PSN content. Sony realizing the issue here shut down the network. Now, before you go freaking out about the latest information posted about Kotaku, no ones personal information was accessible via this hack. Not to say they couldn't get it, but no one is admitting to it being available. Anyway, that's the real reason for the PSN downtime. Sony is now rebuilding all of it's PSN servers to be more secure and (hopefully) make sure the CFW users cannot get online anymore.

Edit #1: To those of you saying that this is speculation, you are correct. But, it is speculation based on a lot of facts and the outcome seems to make the most sense.
1. Rebug was released on 3/31/11.
2. First guides of how to use the dev network to get back on COD games on 4/3/11. 3. Word of "shady" sites finding a way to pirate PSN content via the dev networks on 4/7/11 (basing this on posts I had to delete on the website). 4. PSN goes down on 4/20/11

Now, you can believe Sony's PR team which has kept you completely in the dark, or you can see the list of events above and come to your own conclusion. Now, this isn't the first time Sony has fought back against the PS3 modders from getting on PSN. A couple of months ago we had a utility called f*ckPSN that changed the necessary header information that was being sent to Sony to allow modified consoles back online. We were able to use it for about a month. Then came the new TOS, the mass e-mail to PS3 customers, and software update 3.56 and 3.60. So, once again, yes this is all speculation, but it is speculation based on previous actions and known facts.

Edit #2: Mathieulh just mentioned that he has been in contact with someone that has official access to the SCE devnet servers and it was posted to them today that only 3.60+ debug firmwares will be allowed on the dev network anymore. All earlier versions will be cut. If you want to retain your access you need to contact Sony and upgrade to 3.60 debug firmware.

Edit #3: Ok, it looks like some various news sites have picked up this story and taken it out of context. Once again, this is all speculation and information gathered from various devs in the PS3 scene. It might very well not be the real reason PSN is down, but as the timeline fits, it's a reasonable explanation. Now, as to Rebug directly allowing this to happen, that's not the case at all. Different CFW's have had access to the dev network the whole time. This is not new news for people in the PS3 scene. It's what people have figured out what to do with the said network that has caused all the recent issues. Saying that Rebug is what did this is like saying a gun manufacturer is responsible for every death that happens with a gun.

CN: sony dun fukked up good heer, hide yo wallets, hide yo credit cards.

[Sabre]

Funny how some people thought it was Anonymous and Anonymous responded "Hell no it's not us" Anyway, just like the Amazon cloud outage, Sony is doing a shitty job in the PR department. For a network of this size (both PSN and Amazon), there is NO excuse for this downtime. The second article says they don't think user data was compromised, which I really hope is the case.

[complacent]

well shit.

sony confirms a compromise of personal information.

It's looking like things are just as bad as we feared and that "external intrusion" got a little deeper than we might have liked. In an update on its PlayStation.Blog, Sony just confirmed that the PSN outage was caused by "malicious actions," which we already knew, but continues by indicating that there has also been "a compromise of personal information." Exactly what that means Sony isn't saying, and it stops short of saying that credit card data for PSN and Qrocity users has been exposed, but the company does say "your credit card number (excluding security code) and expiration date may have been obtained." Yes, it may have been obtained -- even Sony isn't sure. There's no further a further ETA for when the PSN may be back up online or when you might be able to finally sample Portal 2's delicious online co-op mode, but at least you can still watch Netflix.

well, shit in a bag and punch it.

[Sabre]

Oh man, this is not what PSN needed... Their stock has been dropping quick and this is sure not going to help.

[chicken n waffles]

what a shitstorm.

sony's PR is laughably pathetic, but funny!

[PGT]

for once, I'm glad I never signed up for PSN. I hav two PS3's but use them both as media servers on my own network and NAS so no need to reach out for anything more than normal system updates. And...I was going to get Netflix over PSN soon...guess it will be awhile.

[Sabre]

Sadly, I bought a game once over PSN, so I'm REALLY hoping that they didn't just keep that stuff (I always choose the option to NOT keep my records for the next transaction). We'll see. I believe I have had my CC replaced at least once since then... but that doesn't protect my username (which is generically linked to my own domain anyway), address, etc.

[sirwilliam]

I never felt it was safe so I didn't put CC info into the system to purchase any games or rent any movies...thank God for that

[Libra Monkee]

Grrr... I bought a few games from PSN but I never kept any money in my Sony wallet (or whatever they called it). Well, this thing is supposed to expire in a few months anyway. Might as well get a new one now.

[complacent]

i had rented moview, bought games and add-ons... this sucks.

[Libra Monkee]

Bank has been called, new card is on its way, and they're alerting the rest of their customers. I like my my bank!

[Sabre]

Which one? BoA? USAA? Capital?

[Libra Monkee]

Which one? BoA? USAA? Capital?

Survey says!
X

[hipster]It's a local bank in Philadelphia. You've probably never heard of it.[/hipster]

[Libra Monkee]

email from Sony

===================================

PlayStation(R)Network

===================================

Valued PlayStation(R)Network/Qriocity Customer:

We have discovered that between April 17 and April 19, 2011,
certain PlayStation Network and Qriocity service user account
information was compromised in connection with an illegal and
unauthorized intrusion into our network. In response to this
intrusion, we have:

1) Temporarily turned off PlayStation Network and Qriocity services;

2) Engaged an outside, recognized security firm to conduct a full
and complete investigation into what happened; and

3) Quickly taken steps to enhance security and strengthen our
network infrastructure by rebuilding our system to provide you
with greater protection of your personal information.

We greatly appreciate your patience, understanding and goodwill
as we do whatever it takes to resolve these issues as quickly and
efficiently as practicable.

Although we are still investigating the details of this incident,
we believe that an unauthorized person has obtained the following
information that you provided: name, address (city, state, zip), country,
email address, birthdate, PlayStation Network/Qriocity password and login,
and handle/PSN online ID. It is also possible that your profile data,
including purchase history and billing address (city, state, zip),
and your PlayStation Network/Qriocity password security answers may
have been obtained. If you have authorized a sub-account for your
dependent, the same data with respect to your dependent may have
been obtained. While there is no evidence at this time that credit
card data was taken, we cannot rule out the possibility. If you have
provided your credit card data through PlayStation Network or Qriocity,
out of an abundance of caution we are advising you that your credit
card number (excluding security code) and expiration date may have
been obtained.

For your security, we encourage you to be especially aware of email,
telephone and postal mail scams that ask for personal or sensitive
information. Sony will not contact you in any way, including by email,
asking for your credit card number, social security number or other
personally identifiable information. If you are asked for this information,
you can be confident Sony is not the entity asking. When the PlayStation
Network and Qriocity services are fully restored, we strongly recommend that
you log on and change your password. Additionally, if you use your PlayStation
Network or Qriocity user name or password for other unrelated services or
accounts, we strongly recommend that you change them as well.

To protect against possible identity theft or other financial loss, we
encourage you to remain vigilant, to review your account statements and
to monitor your credit reports. We are providing the following information
for those who wish to consider it:
- U.S. residents are entitled under U.S. law to one free credit report annually
from each of the three major credit bureaus. To order your free credit report,
visit http://www.annualcreditreport.com or call toll-free (877) 322-8228.

- We have also provided names and contact information for the three major U.S.
credit bureaus below. At no charge, U.S. residents can have these credit bureaus
place a "fraud alert" on your file that alerts creditors to take additional steps
to verify your identity prior to granting credit in your name. This service can
make it more difficult for someone to get credit in your name. Note, however,
that because it tells creditors to follow certain procedures to protect you,
it also may delay your ability to obtain credit while the agency verifies your
identity. As soon as one credit bureau confirms your fraud alert, the others
are notified to place fraud alerts on your file. Should you wish to place a
fraud alert, or should you have any questions regarding your credit report,
please contact any one of the agencies listed below:

Experian: 888-397-3742; http://www.experian.com; P.O. Box 9532, Allen, TX 75013
Equifax: 800-525-6285; http://www.equifax.com; P.O. Box 740241, Atlanta, GA 30374-0241
TransUnion: 800-680-7289; http://www.transunion.com; Fraud Victim Assistance Division,
P.O. Box 6790, Fullerton, CA 92834-6790

- You may wish to visit the website of the U.S. Federal Trade Commission at
http://www.consumer.gov/idtheft or reach the FTC at 1-877-382-4357 or 600 Pennsylvania
Avenue, NW, Washington, DC 20580 for further information about how to protect
yourself from identity theft. Your state Attorney General may also have advice
on preventing identity theft, and you should report instances of known or
suspected identity theft to law enforcement, your State Attorney General,
and the FTC. For North Carolina residents, the Attorney General can be
contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001; telephone
(877) 566-7226; or http://www.ncdoj.gov. For Maryland residents, the Attorney
General can be contacted at 200 St. Paul Place, 16th Floor, Baltimore, MD 21202;
telephone: (888) 743-0023; or http://www.oag.state.md.us.

We thank you for your patience as we complete our investigation of this
incident, and we regret any inconvenience. Our teams are working around the
clock on this, and services will be restored as soon as possible. Sony takes
information protection very seriously and will continue to work to ensure that
additional measures are taken to protect personally identifiable information.
Providing quality and secure entertainment services to our customers is
our utmost priority. Please contact us at 1-800-345-7669 should you have any
additional questions.

Sincerely,

Sony Computer Entertainment and Sony Network Entertainment

[chicken n waffles]

[Sabre]

^^^^

I'll give them credit for coming clean eventually. I'm guessing they did not want to say anything till they were 100% sure of what happened and what was taken... although their uncertainty about the CC#'s is troubling.

[Mr Kleen]

nice one, B.

I just found this one:

40107.jpg

[Sabre]

^^^ So freaking true...

BTW: PlayStation Network credit cards protected by encryption
Of course, if it was a simple encryption, we could still all be screwed

[avriette]

Of course, if it was a simple encryption, we could still all be screwed

Sony uses quadruple-ROT-52, a supersecure NSA cipher.

[complacent]

and this is why you never trust the client.

sec 101. serios.

[Sabre]

Oh now wonder they think all the CC numbers are safe! Nothing can break that!!!!!

[Libra Monkee]

....and if you haven't called your bank already, you're doing it wrong.

Sony Says 10 Million Credit Card Accounts May Have Been Compromised

It's a good thing Sony warned people to be vigilant about their credit cards, because as part of the company's Tokyo press conference yesterday PlayStation boss Kaz Hirai said that up to ten million customer's account details could have been compromised.

[Sabre]

Updates on all this crap:

Game Politics - Sony Online Entertainment Services Taken Down

Sony Online Entertainment's various services seem to be down and a message on the official site does not give much information on the particulars. According to a short post on the site, the services were taken down after an investigation revealed a deeper "intrusion" than expected at first. This is the first we have heard that Sony's MMORPG arm had some sort of security breach. Below is the message from the official site:

"Dear valued SOE Customers,

We have had to take the SOE service down temporarily. In the course of our investigation into the intrusion into our systems we have discovered an issue that warrants enough concern for us to take the service down effective immediately. We will provide an update later today (Monday)."

This could be part of Sony's plans to beef up security for the PlayStation Network, but this message seems to indicate that something more serious going on.

It could be that PC game p[layers may have something to worry about, but we hope that is not the case. We will have more on this story as it develops.

HotHardware - Sony Details "Welcome Back" Package, Says PSN to Be Up Soon

Sony Corporation's Executive Deputy President Kazuo Hirai held a press conference on Sunday to address the PlayStation Network (PSN) hacking. During the event, Hirai apologized to gamers worldwide, and detailed a "recovery plan" for both the PSN and Qriocity services, which have been offline since hackers attacked them on April 19.

Coming in the same timeframe as the Amazon.com EC2 outage, could make consumers and businesses think twice about putting all their important information in the cloud, where hackers or outages could result in inaccessible or lost data. It comes at a time where consumers are being enticed to store their data in the cloud, with services such as Amazon.com's Cloud Drive and an upcoming Apple iCloud service.

According to Sony, its services will begin being restored later this week. The company will shortly begin a regionally-targeted "phased restoration," beginning with gaming, music and video services. Among the missing pieces will be the PlayStation Store downloadable games shop, which will not come online until later in May. Sony also announced both a series of enhanced security steps, and a customer appreciation program known as the "Welcome Back" program.

Upon coming onstage, Hirai and other Sony executives apologized to users immediately. In addition, they bowed in front of the press present.

Speaking via a translator, Hirai said:
“This criminal act against our network had a significant impact not only on our consumers, but our entire industry,” Hirai said. “These illegal attacks obviously highlight the widespread problem with cyber-security. We take the security of our consumers’ information very seriously and are committed to helping our consumers protect their personal data. In addition, the organization has worked around the clock to bring these services back online, and are doing so only after we had verified increased levels of security across our networks."
Reports of PSN users seeing fraudulent credit card charges have arisen since the hacking, despite Sony's assurances that the CVV codes were not stored in their databases, and that the credit card numbers were encrypted. Addressing this, somewhat, Hirai added, “We advised customers to be vigilant” [about the credit card numbers and checking their credit card statements]. Although reports coming from security firms monitoring hacker forums indicated that a group had boasted of 2.2 million credit card numbers, Hirai said that as many as 10 million credit cards numbers may have been stolen.

Many gamers play on PSN free, eschewing paying for the service, which explains the difference between the number of credit cards and the full number of players for the service. The full number is estimated to be about 77 million people.

Sony's "Welcome Back" program will included the following "central components."

• Each region will be offering selected PlayStation entertainment content for free download, with specific details of the content to be announced in each region "soon."
  All existing PlayStation Network customers will be provided with 30 days free membership in the PlayStation Plus premium service. Current members of PlayStation Plus will receive 30 days of free service.
  Music Unlimited powered by Qriocity subscribers (in countries where the service is available) will receive 30 days of free service.
  Additional “Welcome Back” entertainment and service offerings will be rolled out over the coming weeks as full functionality returns.
  As part of the enhanced security measures, the PS3 will have a forced system software update which must be installed before users can sign into PSN again. In addition, all registered PSN members will have to change their account passwords. Finally, that password can only be changed on the original PS3 in which that account was activated, or through a validated email confirmation.

On closing, Hirai and the other executives apologized and bowed again. Hirai added that he would answer the questions sent to Sony from members of the U.S. Congress and added that he had not received reports of any actual fraudulent charges made related to the credit card numbers stolen. Sony continues to emphasize that the numbers were encrypted and the CVV codes, although requested, were not stored in the accessed database.

This is a PR nightmare. Good time to buy their stock probably, haha.

[Raven]

[Sabre]

As a follow on to the SOE post: Sony Breach Gets Worse: 24.6 Million Compromised Accounts At SOE

An anonymous reader writes with an update to yesterday morning's news that Sony Online Entertainment's game service was taken offline to investigate a potential data breach related to the PSN intrusion. SOE has now said that they too suffered a major theft of user data.
"... personal information from approximately 24.6 million SOE accounts may have been stolen, as well as certain information from an outdated database from 2007. The information from the outdated database that may have been stolen includes approximately 12,700 non-US credit or debit card numbers and expiration dates (but not credit card security codes), and about 10,700 direct debit records of certain customers in Austria, Germany, Netherlands and Spain."