f13.net

No multiplayer, no downloads for a day or two. Quite a fail: http://www.pcmag.com/article2/0,2817,2383924,00.asp

 :awesome_for_real: :tinfoil:

Are the US PSN servers hosted by Amazon?

Not related says F-secure http://twitter.com/mikkohypponen/status/61164910230507520

So, this sucks, no netflix as well.

Some rumors and a video (http://www.dailymotion.com/video/xiaubg_anonymous-message-to-sony-update_news) say this is anonymous, but I don't know if thats true.

A semi-inside source tells me it could be to do with Amazon Cloud servers being at capacity. Apparently they handle authentication? That's very 2nd hand info though.

The article linked in the first post says that Anonymous have publicly distanced themselves from this, and I'd have thought if it was them they'd say so.

You get what you pay for.

I was using Netflix last night.  When it tried to sign in and errored out, Netflix still loads in the background.  Hit O to cancel and it worked on my system.

Its not related to amazon.


You do know there is a paid service now right? But I keep forgetting, Xbox has never had this problem. Ever.  :awesome_for_real:



It kept prompting me to sign into the PSnetwork, ill give it a go again I guess.

I autosign into PSN, so when I hit Netflix and the PSN login comes up, it loads and errors out.  Then I hit O at the error screen and Netflix loaded from there.  Can't go more than a day without my Farscape fix right now...   :awesome_for_real:

Also, related?: http://forums.f13.net/index.php?topic=20725.0

I have netflix on the 360 also, but I can't play my online character in Demon's Souls for now.  Maybe I want to start an offline one... hmmm.  But if I forget to disconnect from the network before I boot the game, I will be very unhappy.

Looks like my info was wrong, it is some kind of malicious attack:

People elsewhere are claiming it is Anonymous, but I think at this point anytime anything happens people are going to credit Anonymous.

Considering that Anonymous pats itself on its back all the time for its decentralized nature, it could very well be some of their "people" doing this to get back at "the man". The "organization" saying that it isn't doing it doesn't mean that everyone who is affiliated with them has clean hands.

Anonymous attacked the PSN with a little bit of success but the backlash to fucking over people who just wanted to play online made them apologize and back off PSN/Sony's websites. I doubt it's them.

I cracked and went to Michael's today. Picked up some stuff. Learning how to knit and enjoying myself so far. Still miss BC2.

Rumors I've heard say that geohot's the one responsible for this.

I heard it was Valve.

(http://dl.dropbox.com/u/85916/dropped_disc_steam.jpg)

Oh ho ho. I get it. It's a fat joke.

How long have you been waiting for an opportunity to use that image, yeg?

This worked. You do have to keep letting it fail sign in though. Nextflix loads behind.

No idea.  It wasn't even a good fit, to be honest.  I have a lot of shit in my dropbox.

According to Arstechnica (http://arstechnica.com/gaming/news/2011/04/psn-update-sony-isnt-sure-your-credit-card-data-is-safe.ars)

I almost posted an ancient image macro, but instead I'll just say: "Shit."

PSN is down because of a custom firmware. This one called Rebug (http://rebug.me/) allowed users to turn on a lot of dev features on the console. Using proxies and such, they were able to get banned consoles back onto PSN, as it was a 'trusted console', being a dev console and all.

The more sinister thing is that people were able to add infinity virtual dollars to a fake credit card, since it didn't run financial checks on the 'trusted' devices, and people were downloading every single thing PSN had to offer, including PSP titles on the PSP Go and such. This has also apparently been going on since the 2nd of April, and in a widespread capacity since the 7th.

This is basically what I've gleaned from this reddit thread (http://www.reddit.com/r/gaming/comments/gx6o4/im_a_moderator_over_at_psxscenecom_the_real/) and beyond, but the legitimacy of this seems fairly solid, and that is hilariously fucked.

EDIT: Doesn't appear to have been Rebug responsible for the information leak, at least from the folks at psx-scene (http://psx-scene.com/forums/f6/psn-update-private-information-compromised-85598/) - people WERE still spoofing their way to owning tons of PSN software, though.

I have no words.  That is a spectacular fuck up if true. 

rebloggin' this

Holy shit:

http://blog.us.playstation.com/2011/04/26/update-on-playstation-network-and-qriocity/

Oh yes, and....


 :uhrr:

Well shit.

MS is simultaneously jizzing all over the place and beefing up their security.

I didn't really give a fuck about the downtime, but sitting on this for a god damn week is fucking inexcusable.

They should just outsource everything to Steam :awesome_for_real: :oh_i_see:

Holy Shit. This must be the biggest datahiest ever.

I wounder what the look on the guys face was in Sony (probably some low level tester) who discovered this. The feeling of Dawning Horror and the cries of CUT THE CABLE. CUT THE CABLE NOW.


Maybe Sony will make a movie about it. Something to cover the losses involved when people start suing them. Everywhere. 75 million times.


Now if you'll excuse me, I need to never buy a Sony Product again. At least an online one.

Wow. I'm so glad I never bought any DLC from them.

edit - just changed my XBL password, since it's possible that my PSN password was the same. Not that I remember for sure, since I just auto-logged-in each time since getting it..

I really haven't used PSN for much.  I think I bought DeathSpank and a few PSP titles off it.  Then again, it's not quite as IN YOUR FACE, BLARRRG MARKETING BLITZ as xbl is.  Chances are I wouldn't have noticed the downtime even if I was using my PS3.

edit: But yah.. I should really check on my cc.

And I'm off to call Visa. Thanks Sony for sitting on this for a week while my credit card info was most certainly taken.

Whelp that's the death knell for my PS3 I wonder the public impact on consoles heading towards download only media.

Edit: On hold for 5mins to cancel. No joke the rep said I'm not the first or last person today and some notice must of went out about the PSN as they are getting quite a few calls about it.

My PSN account has expired CC info cause the last time I tried to update my info and buy something a couple of months ago their system wasn't working :uhrr: :awesome_for_real:

I reported my CC as potentially stolen earlier in the week due to this - I had a feeling that their extended silence on the extent of the data breach was an indicator that this was going to be ugly.

As an aside, AmEx has amazing customer service still - they next-day shipped a new card to me.

5-7 business days here huzza!  :uhrr:

Awesome. The last time I bought something was like 2-3 months ago at the behest of a friend and I can't recall if I still have the same card. I think I did. I also use my debit card for literally everything instead of cash so getting a new one fucks up all my automated billing.

You don't use EFTs for that?

I figured better safe than sorry, so I went ahead and made the call to get a new card.  I'm just glad my last card used wasn't my debit card. 

To have gotten all that info taken is pretty crazy.  I'm pretty unamused.  

My student loans yeah, but about everything else uses my debit card.

Supposedly the custom Rebug firmware isn't responsible for the data leak, according to psx-scene (http://psx-scene.com/forums/f6/psn-update-private-information-compromised-85598/), but there still were tons of people spoofing their way into owning lots of free PSN software.

PSN+ customers getting a free month?  :grin:

Well, that sucks. It makes me wish I had gotten a 360 at this point.

Oh well.  :heartbreak:

bought some DLC maybe 9-12 months ago once?  sigh

never use them again.  Sad to think about all the kids and their Little Big Planet stuff (assuming there was DLC with that).

It should be noted that when PS3 custom firmware began to come out a few months ago it was discovered that Sony's PSN transactions occurred via unencrypted plaintext, which if it still holds true now, then it's almost a certainty that whoever got this data now has these peoples' CC numbers and their CVNs.

This is so terrible.

There are some games that require a PSN connection to be played, even in single-player mode. Then there is the whole CC info stuff, not being able to play online games online, etc.

I've always hated this required connection bullshit, just one more point validating that.

if that's true about the plaintext then Sony will hopefully be in trouble for PCIDSS with the CC consortium.  cf. http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard

edit: threat I always heard that if you fail these criteria, your ability as a merchant to process CC will be taken away.  Let's hope at least Sony gets a review.

 :drill:

Wow. Makes you hope Steam is doing some double checks now, eh?

As someone directly affected, I'm not entirely happy.  We've got too much going on this week for me to kill my card until Sunday, so I'm just going to have to chance it.  I think going forward that I'll be using the prepaid cards from the stores. 

(snort, chortle, wheeze)

...reminds me, I need to watch that again...

Does anyone remember the password requirements for PSN?  I.E. 8 letter min, numbers/caps required, etc?  This would help me determine which password I used for it and what I need to change.

Can't even sign in yet to change anything.  Bleh. 

Which ones? So I can avoid them.

I put a fraud alert on my credit and ordered a new debit card.

Hey Sony. Fuck you.

I think that the usename/password combo along with the registration emails are more of a big deal than the CCs.

A substantial percentage of PSN users is going to reuse the fuck out of that username/password, including as the password to get into that registered email account. With that email springboard, now you've got someone's effective online identity for anything registered to that email address - twitter, facebook, even "welcome to XXX!" bank emails with their username. Paypal account. Amazon "one click buy" account. Netflix login.

Get clever and you can start searching for emailed invoices and back track from there, testing random websites to see if credit card info is saved. Tech savvy people use throw away email addresses, different passwords; random schmoes don't. Neither do teenage kids. PSN has both of those in abundance.

We're not talking everyone, but this is a sample size of millions. Robo test those, scrape at least a thousand. Probably more like ten thousand. That's big potential.

I have a PS3 but I've never used it to buy anything, even downloadable content. Only thing I've ever downloaded was game demos - I even resisted buying the Dragon Age downloadable areas.

However, I did register an account and I wandered around PlayStation Home when I first got the PS3. Would it have made me enter credit card details at the time?

It might be wise on Sony's part of force PSN users to create a new, stronger password when things go live. 

I've never bought anything on PSN, but I'm wondering if it might be worth changing my CC just in case it shared a password with anything important that might have my CC on file..

Luckily the Haxors have my name, address and DOB in case they want to contact my bank to change my details for me or anything of that nature!

(http://i.imgur.com/FXUii.jpg)

On another note, yay for not remembering when I last bought something on PSN.  I think I bought something a year ago, which means I may or may not have my current card on file. 

I wonder if they properly hashed and salted passwords in their database.

I'm actually somewhat proud of some of my friends who surprisingly pulled their heads out of their asses and canceled their current credit cards over this, and are furious at Sony for sitting on this for over a week.

I'm sure they'll find some other way to make me weep for humanity at a later date, but I'll take what I can get.

Derp, hit quote instead of Edit.

Seeing as they specifically mentioned that passwords may have been part of the information gained, I am leaning towards them storing them in plain text. Really sounds like the people at Sony thought they could follow security by obscurity because the PS3 is not a "computer".

With as little gaming as I do nowadays, this is the kind of thing that would push me out of it altogether.  Ugh what a pain in the ass this is going to be.  I've defended Sony in the past for some of their boneheaded stuff, but this just makes me livid.

I've been kinda surprised over the anger on this.   This sort of thing has been happening on a large scale for a while now and people haven't even been paying attention really.   This probably isn't even close to the largest breach of it's kind.    Most companies just aren't very worried about protecting such data.    It would be nice if this snowballs into a big deal that would wake people up a bit at least.

Glad I've never bought anything from PSN or Box Live.  Now, if Steam ever gets hacked.... :ye_gods:

That would be the TJX breach, storing credit card info is a big no no for Visa, and results in nice penalties.

Whence the anger? Simple, really: sony's not really inspired any faith; they're like an employee already on probation for multitudes of clownshoes events like the rootkit debacle.

That, and this is an event that causes an immediately visceral response: a customer feels they have trusted sony with their credit card information and as a direct result of using their product, which is now no longer available to them in the interim, they have to go through the hassle of contacting Experian, et al., and put themselves on fraud alert, get new cards, change all their passwords and security questions, and know that a massive operation now has a load of personal information about them that can be used to potentially access their information elsewhere or create opportunities for identity theft and dicking with accounts.

So, of course, people are going to be angry.

Fuck. I just got linked to this thread. I made that identity theft thing also after an employee of a large UNNAMED consumer electronics company made that joke.

Mine is better. It's under funny pictures. The joker up there can't identify fonts. Or use photoshop. I'm not even sure he made it on a computer.

Sony's list of Fucking Awful Questions mentions that SOE was hacked too and they're investigating.

http://us.playstation.com/support/answer/index.htm?a_id=2356

Oh jesus christ...  :ye_gods:

My bad, I just saw one on the internet and linked it, didn't make it.


I'm inclined to agree with you, but technically even if the passwords were salted and hashed properly, they would still have to report that your password was released because technically your password can be derived, it's just not practical unless you are dealing with accounts with stupid passwords.

*edit*
Btw, I strongly encourage everyone here that if your email was using the same password as your PSN account, change your email password, since your email was released in this hack.  When my mom passed away and we needed access to her bank accounts and such, once we were able to get into her email account (via attempting to answer security questions) it was scary how many important sites (banks, insurance, etc..) we were able to gain access to once we had access to the email account(even without looking through email archives), no password knowledge necessary for any of them once we had email access

It's a good thing that my identity was compromised over the trueprotein.com breach a few months back, so anything I have related to Sony or SOE or any of those fuckers has already been replaced.

This kind of shit happens to me yearly. I'm going to make it a point to exclusively use those virtual credit card numbers that are only good for one use. It'll probably save me a bunch of money because it's such a pain in the ass.

For those who don't know what I'm talking about, several different CC companies will generate one time use numbers to use that tie directly to your actual number. Without actually using your number. I've used these for years when buying stuff from shady places, but now I guess it seems like I have to use it everywhere.

I can't even buy fucking protein powder or $5 arcade games without having the information stolen at some point. Such a bummer.

I also said this last page, too (http://forums.f13.net/index.php?topic=20733.msg923575#msg923575). That is the real danger, not CCs with no CVE code or expiration date info.

I agree. I tell all the not super tech savvy people in my life this on a regular basis. Your email password should be very strong, and unique. If some one gets this, they have almost everything.

http://vgn365.com/2011/04/26/psn-users-reporting-hundred-of-dollars-stolen-from-them/

Somewhere between 60-70 million credit card numbers stolen.

Well good thing i have a great bank. I was surfing the boards this morning and saw this thread. So I checked my bank website and noticed that my checking account had a hold on it. They had flagged my account due to several out of state small purchases on the card. Their fraud prevention shut it down before anything major. It ended up being a couple hundred dollars of charges all together. My bank is canceling my debit card and refunding the false purchases.

A big screw you to Sony for not notifying people. All it says when you try to use the PSN network is down for maintenance.

I don't know for sure if this incident is tied to the PSN data theft. It is oddly within the same time span though.

What really disgusts me about this most of all is I haven't received an email from Sony about this at all.  I'm curious if anyone has?

Also I saw this:

http://forums.station.sony.com/eq2/posts/list.m?topic_id=499510

Seems SoE thinks they didn't lose any info.

What should really make you mad is they stored all of this information in plain text. Awesome eh?

And they'll face no penalties what-so-ever I suspect.

There is certainly a penalty I wont ever purchase anything from Sony again. I don't need their games and products bad enough. Sure I will be sad to not purchase the next play station or buy anymore ps3 games, but i can definitely will myself to make good on not buying their shit.

Luckily all of my family's financial stuff is using my wife's logins and email address.  Just in case, I changed my email address password.  This is why I typically use a throw away gmail account for any potentially dodgy website registration.

Nothing alarming on the credit card activity, except for my wife being left unattended in various shopping malls.  :ye_gods:

Even if it was properly salt/hashed they would have to act like it was plain text.   The reality is the avg user has a crappy password that is easily brute forced.  Frankly I bet Sony's security is no worse than nearly every other retail company I deal with.  I consider them all equally worthless so I was already disgusted over such a topic long ago.  I can't even count the number of times I've seen some dumbass system sending passwords in plaintext via EMAIL.

Not even emailing me to say "woops we fucked up" when it's already all over the place in the news is a new low though.

You should get a leash.

Japan will likely not give the first shit, which should surprise nobody. Depending on how outraged Congress gets (especially if CC info has for-sure been compromised) and if the current scuttlebutt over Apple gets anywhere, Sony may be in a bit of hot water in the US... but I wouldn't expect a lot. I could easily see the EU pretty much crucifying Sony over this though.

Quite sure that little accept button you clicked removes all liability.

We don't know if it was plain text or not.

However, this falls under PCI, so expect them to pay visa and mastercard millions of dollars in fines at the very least. Trust me, if you get a PCI violation, your ass and wallet will ache for a long time. PCI doesn't fuck around, and any database that stores credit card info must be PCI compliant.

Dunno. Contracts can be and have been contested.

They don't usually come out on the side of the user though.

In the US. The EU is another kettle of fish.

So far no suspicious charges.  I do keep a fraud alert going on my accounts, though, so that's already done.  My mail account password is PROBABLY different from the PSN one... wondering if I can check this somehow or maybe just go ahead and generate a new mail password.

I can say that I've seen enough stuff to say that you have two options:
1. Don't do ANYTHING important on the web. Don't store any inforation you dont want getting out. (This is what I do)
2. Assume that the company you are doing business with hires random people off the street with no background check and no technical education, gives them full access to their entire username/password list and when working on an issue it is common for these people to write your username/password on a post-it note and stick it on their desk for easy reference. Also assume that the smarter employees get sick of all the post-it notes and eventually build an unsecure access database out on a share drive so everyone can store the accounts their working on and share them between each other and when asked "How do you know people aren't copying this DB and taking it home with them every day" they respond "Huh?" (I've actually seen this, pointed out that it was bad and was told by the VP of the company in question that it was "inside the firewall so not a big deal")

3. Assume all your personal information is also being sent to various 3rd party services as well (see: Epsilon).

Ok, Sony may be the cause of this, but come on. No one knows when the attack actually occurred or what they got and because 3 people have money taken from their debit accounts, it's their doing? I typically only use my debit card at retail locations and ATMs. Its been compromised 3 times in 4 months. I think fraudulent and suspicious attempts/transactions happen a lot more than you know. I only found out because my bank recently started offering chequing accounts so they're nuts about security.

Plus, anyone stupid enough to tie their debit account to an online profile deserves to have their money stolen.

Do you mean Check cards too?

My 10yr boycott of Sony finally pays off.  :awesome_for_real:

I'm kind of glad the whole froglok thing happened now, prolly saved me a lot of hassle and I wasted less of my like on that stupid game.

I wouldn't say anyone deserves to get their money stolen for using a check card for online services.   I would call them an idiot though.

You do realize that debit cards, as fucked up as this might be, are the only way some people can actually use a goddamn credit card and the convenience that provides, right? You do realize that lots of things in our society require a credit card these days and won't accept pre-paid debit cards for such things? You do realize that those reloadable pre-paid credit cards are a HUGE fucking rip off and end up costing you more than if you just used your debit card, right? Because I'm sure you guys wouldn't get tunnel vision when talking about how people pay for things, completely forgetting that it isn't Joe Blow's use of a debit card that suddenly causes massive fraud, it's Sony's colossal security fuckup and banks idiotic "prove it" approach when discussing fraud with their customers.

Agreed. Sony should have to pay through the nose for this. I doubt they will unless congress really needs to distract us for the middle east for a while.

Yeah, I pay for everything using my Debit Card only, online or anywhere else.  Its the only card info anybody would have.

Luckily, I haven't purchased anything from Sony's store in a long time, and I've had to get a new card in the last few months, so I'm safe there.  Looks like I need to change passwords on e-mails however.

Check cards are debit cards that are run like a credit card and feature a visa logo.

You're right I was being short sighted and forgetting that some people don't have credit cards.   Obviously you have to use what you can use.   If you have a credit card though then it is much better to use that than a check or debit card.

I'm finding that some places are not making it easy to change my account password.  Also, what's up with not allowing non-alphanumerics?  What century is this?

For anyone rotating passwords I'd suggest taking a small amount of time to look at something like KeePass (http://keepass.info/). You can generate any kind of passwords per site/account and set them up inside of the app. The database file is encrypted and then throw it on dropbox or such, and if your really :tinfoil: put it on a truecrypt volume.

I'm already on that wagon. :awesome_for_real:  The kink for me is using a secure but memorable master key.  I need to do this for my primary email, my Dropbox, and my Keepass DB.

I came very close to setting up the mobile-phone authentication option for my Google account.  Anyone use this?

Anyway, I cannot for the life of me figure out where the password change link is in GEICO's retarded web site.

Question.

My girlfriend recently bought a TV through Sony. Do you think that would be compromised also?

She gave the person her credit card over the phone. Nothing to do with PSN. But I want to be safe.

Thoughts?

Unless its some sort of smart TV, I don't think so.

Lucky for Sony the Supreme Court just neutered class action lawsuits http://www.latimes.com/business/sc-dc-0428-court-class-action-web-20110427,0,1239412.story  :awesome_for_real:

Just received the email:


Looks like they're not certain if CC info was actually compromised.

I have become increasingly frustrated with this recently. Especially sites that require a number, a lowercase, and an uppercase but won't allow me to use non-alpha characters at all. Hell, AT&T's DSL site made me do that AND The password had to be 6-8 characters or some ridiculously tight range like that.

Retarded people run security for some large corps. News at 11.

I just hate having to remember new passwords.  Grr

Purported IRC log of PSN hackers: http://www.reddit.com/tb/gypol

Man, if that is legit...  :uhrr:

Sigh. I think I'll just call my bank tomorrow and get my card redone.

:why_so_serious:

Amazed you could only pick one line to quote out of all the precious lines in that link... kudos

I ordered a new card a few hours ago.

I purchased a PS3 because of Demon's Souls, blu-ray, and no-pay online allowance. And because I'd read that the 360 Red Ring rate was something like 40% after a year of use (seems kinda high to me).

Man, I'm totally jonesing right now. Might get a 360 as a back-up in order to avoid withdrawals in the future. I hear Arcade is robust.

Someone clipped this from the PS blog:

(http://www.theonering.com/images/medialibrary/gandalf010612a.jpg)

Well played Paelos.  :drill:

Lastpass (http://lastpass.com) is also a good option, and you don't have to deal with Dropbox to keep things synced between work, home and phones (I didn't find Dropbox to have satisfactory security to hook it up on my work machine, I like being able to close my browser and know I'm completely logged out of LastPass on this PC).

Just called my CC company to invalidate my card, they didn't even ask me why they just simply wanted to know if it was due to Sony or anything else.

This just leaves the password which was a throwaway anyway. I usually use 1password for rotating passwords anyway. This just reinforces my need to change all my passwords to something like that. Which is a hassle but something I wanted to do anyway.

Reading the suppesed chat log leaves me with a giant WTF Sony, if true that's not just incompetent but negligent and violates the certification rules of Visa and Mastercard. There's a reason why not that many companies actually process CC transactions directly but use processors.

The day they made their admission I got rid of my current card that I use.

And then, my copy of Portal 2 for PS3 showed up.

Now... I decide. Do I return it and just buy it on steam, which is where I was mostly planning to play it.

I totally told you, you would RUE THE DAY!

Sorry, I don't speak puckeater.

As an olive branch, i submit: http://www.youtube.com/watch?v=Cwn4R_GexLM (some NSFW language)

I decided to load up Portal 2 on my PC and looks like I need to use the code from inside the PS3 box.  Does Valve not trust PSN or something? :why_so_serious:

(http://art.penny-arcade.com/photos/1261596481_3Fw2MnJ-L.jpg)

Eh.  More like Yawny Arcade.

Is there any option to not use their servers? I'd rather handle my own database file but it seems the premium still requires you to store it online (and costs $12/year). Major gripe I have with KeyPass is the lack of a decent OS X client.

I like the ones that allow non alphanumerics.. except ! { } |

Gee, guess who doesn't escape their strings properly!

After using lastpass for about 6 months now, I honestly don't know what I would do with out it.

Has anyone else gotten an email from Sony? I haven't, but then I haven't bought anything in over a year.

Got one late this afternoon.  Guess it takes awhile to send out so many...   :uhrr:

Got one this afternoon, too.

It's amazing how quickly the class actions have been filed (http://www.informationweek.com/news/security/attacks/229402362).

I got that yesterday morning.

Nothing here (Australian PS3 user).

Yeah both free and premium store it on their servers (you still have offline access to your passwords though), so if you want to manage it on your own then it's probably not for you.  The convenience of not having to remember my dropbox credentials and having seamless syncing across all mobile and non-mobile devices makes it worth it for me.

I use Password Safe.  It can be put it on a USB stick if you're willing to take the risk.  Rename the program something like 'format.exe' if you want a bit of psychological protection.

http://youtu.be/MeXQBHLIPcw

Hackers Tried To Sell Credit Card Numbers Back To Sony (http://www.ibtimes.com/articles/139672/20110429/psn-attempt-to-sell-2-2-million-credit-card-numbers-back-to-sony.htm)


Ok, I was just watching my card activity but now I believe it's time to have Amex cancel/reissue a new card. I really dislike having to update all my accounts that need CC info attached.

Internet "Journalism" HOOOOOOOO!

$100k? If that's true, they are vastly undervaluing that information. I'm sure there are some Russian fellows who'd pay more than that for a part of that DB.

Cue Austin Powers reference.

Proof that Credit Cards really ARE worth less than WoW accounts on the black market.  :why_so_serious:

It doesn't even sound legit. Some guy at Trend Micro read on a forum they were thinking of trying to sell it? Really?

Pretty much, and I think the lowball confirms that they have nothing.

I thought that lists of credit card numbers could go for a couple of dollars per entry, so 4.5c per record seems exceptionally low.

I suppose some good news is that I have a Keepass app installed and running on my Droid,  which is how I managed to log in and post this.

This is a funny bit from that Playstation Blog Q&A:


The PS3's billing info screen:

The PSP's billing info screen:

 :uhrr:

Wow, they really aren't making facepalms big enough for this.

You are reading that wrong. You do not have to give ANY CC info when signing up, only when buying something.

Sign up is not the same as billing.

Also:

The Q & A isn't exclusively about registration, although the blog dances around the fact nimbly. The question has nothing to do with registration. Why would they ask for credit card info to register?

Sony is really making me feel like trusting them with my cc info again. Not.

Yes they are mixing things up. IIRCC, there is a section where you can set up a CC during registration, but its optional. I believe thats the screen shown. You do however have to enter CC info if you buy something if you do not set it up ahead of time.

Yea I wanted to pick up a PSP game last night and said fuck it.   Waited till the store opened this morning.   Good thing emulators exist for all the PSN exclusive shit.

Link. (http://massively.joystiq.com/2011/04/28/playstation-network-credit-card-info-appears-to-be-safe-no-una/)

And the other shoe drops

 :roflcopter:

Less funny since I do have a credit card on file with SOE.  Also my retirement account (and a good number of other TRS employees) recently had its data stolen.

*sigh*

So, are there any Sony systems left that they haven't pushed the red button on?

If grunk was around we could ask him about FFXI.

this debacle now with SOE involved has done it for me.  Other than paying for utilities, AMZN and PayPal, we're not using any CC's online anymore.  And I've been working in EC for years.

Thank goodness my old SOE account had a very long-since expired card with a vastly different number and security code, an old address, and both a password and a secret question I never use anymore.

I'll still probably scrub what little actually relevant info remains on it when it comes back up, like my name and email address.

Makes me feel almost glad that I had to have my credit card reissued with a different number since 2007 over an unrelated hack.

This is not leaving me with a great feeling about the future of Sony or SOE or my hope that PS:Next will ever be released.  :oh_i_see:

Not really sure what the big deal with credit cards.  I mean yeah, using debit cards online is largely risky, but unless you have a credit card through a shitty bank, it's pretty easy to get fraudulent charges refuted and a new card issued (though it does suck until it's done).  It isn't exactly the end of the universe though.

I'm more worried about debit cards (since fraudulent charges are taken from your bank account until they finish their investigation) and how ridiculously easy it is to make payments for things online with a check (all you need is one voided check from someone to make a lot of fraudulent purchases).

Shit, PayPal should give you a much bigger scare, as they have a history of a lot of shady financial holds previously.

One-use credit card numbers are becoming popular overseas. A friend Czech Republic has one. The way it works is this:

You go onto the CC website and you generate a number of single-use (or limited use) credit card numbers that are tied to your main CC number. Then, you simply use those numbers for your online transactions. When you run out, it's just a click or two to generate new ones. You can put in both the number of transactions they are vaild for as well as the credit limit for each.

It's more work, but at this point I'm seriously considering finding a US company who will issue me one. He also told me of his bank login which also had something I've never heard of before - they not only require your standard username and password through SSL (https), but they also mail you out a page of 50 or 60 one-use security codes. Each time you log in you burn a code and, when you get low, they mail you a new page. Basically, a crude-but-effective two-factor auth for additional security.

I also like ING's password system, in which you click on stuff instead of typing in a password. Much harder to sniff.

I'm also highly considering switching to keypass. Made the switch. I should have done it years ago, just too lazy.

With SOE being hit too, Sony appears to have reached clownshoes level of (in)competence here.

the problem for me with CC fraud is that while I'm not hugely worried about identity theft (although I know it could happen), I have a wife and kid, and I don't have the flexibility to suddenly manage a large fraud hit.  I don't know what to expect if my CC's are suddenly used and what the mean time might be for rescue, or what any long-term risks or whatever might be.  Basically, knowing just a little bit has convinced me it's just not worth it.  And frankly the uptake in hacks everywhere is boggling.

Large fraud hit?  You call your card company, say the words "I didn't make this charge", and they go poof.  Shred the card and wait for your new one to arrive.  It's not like you ever have to pay it.

I use my card for absolutely everything.  I don't carry cash most of the time.  Checking account is for bills.  We've had one fraudulent charge in 10 years, and we live in the identity theft capitol of America.  Hell, the credit card calls us about charges they think might be fraud (mostly me buying shit late at night).

Maybe I'm just lucky, but I find the fraud risk completely manageable and easy to nullify in the case that it occurs.  

I haven't followed the PSN debacle too closely, but apparently this was presented today as new news:

Not to sound too naive about this, but how long are typical expiration dates on cc's? I know my Visa check card is 3 years and I get a new card with a new CVS. So this database would/should be useless, no?

It says they don't even have CVS in the first place.   

I never cancelled my xBox live gold one time because the credit card I used had expired - Microsoft still charged and the cc company still paid out!

Assume nothing Mr. Mulder!

Was in my inbox this morning.

Dagnabit.

 "There is no evidence that our main credit card database was compromised. It is in a completely separate and secured environment."

Up until May 1st there was no evidence that SOE was hacked and SOE was in a completely separate and secured environment... was it not?

Let's just get this out of the way: If you've ever done business with Sony, cancel the card you used... and never do business with Sony again.

Oh shit. That means my old Everquest account data is compromised?

Damn, not having that retarded console didn't help me either! Fuck you Sony!

The implication of this rolling embarrassment to Sony is that the hackers may have done some nasty things to their internal systems and could even have planted time bombs that could cause further damage.

Virtual companies are only as good as their public integrity. You don't trust your credit card details to a company who's been pillaged more than an open bar at an Irish wedding.

SOE could launch the most fun game ever tomorrow and would you really be willing to give them your financial details to gain access? I'm guessing not.

Reading that some are saying hackers are getting in through facebook games, or some such holes in that area.

That wouldn't be too surprising.  Everyone wants you to tie accounts to your Facebook, but that's probably where the weakest security is.

I recommend that everyone change their name, gender, and birthdate immediately.

Again? My coworkers will start to talk...

How, its down.

(http://dl.dropbox.com/u/85916/naked_gun_masspalm.gif)

I think he meant in real life.

The line at the county clerk recorder is going to be long. :(

Yeah it dawned on me later.  :oh_i_see:

Ya know, amusingly, half a cup of coffee later, I missed the sarcasm too, and went the other way. So, I share in your pain.

I also have no idea why I'm admitting to this, other than maybe only being half a cup of coffee in.

Well, when I read it, I was LOOKING for a way to change all my info. 

Just steal someone elses identity and use that. It's what all the cool kids are doing these days.

No they said from the start that SoE got hacked.   They just didn't know if the data was compromised.   As a side note I'll forgive SoE for losing all my data if they go out of business.

http://www.youtube.com/watch?v=ZnHmskwqCCQ

Glad my CC info for SOE is long out of date. (Got a new card) At least there's that.

Well, good luck getting all that changed in real life.  The gender marker can be a real bitch in a lot of jurisdictions.  Oh, a lot of companies won't let you change any of that info even if your info changes.  (Married?  Tough, you're your maiden name forever as far as they're concerned.)  Hope you read that third sentence before going through the hassle.

Or buy one. I heard there is a lot of supply right now.

 :awesome_for_real:

I think the greater danger is the personal information. Changing your CC info and reversing fraudulent charges is relatively easy. Changing your name, gender, address, email address, and secret questions is not.

And with access to all of those, there is far more potential for damage.

I am almost thinking (with the whole "we are moving data centers for better security" which leads one to think it was a physical security issue as much as a software security one) that maybe one of the people who got axed last month may have done this out of spite. And that it is being labelled as an "external" intrusion because the perpetrator is a very recently unemployed former SOE employee.

Has anyone found any kind of PHYSICAL security device or something for dealing with passwords due to this?   I want to switch to unique passwords per site but that would leave me using like 50 passwords.    The idea of storing them on a hard drive even encrypted leaves me feeling a bit meh.

I have one of these (https://www.ironkey.com/personal). When I bought mine, I grabbed the cheapest one. It has a password management feature that is useful for websites you visit on a regular basis. I'd feel pretty safe keeping a plaintext or encrypted file on it as well to store and manage my passwords for stuff that isn't necessarily "connect via a browser."

I don't have to worry about either CC breach because my card company (Capital One Canada) was brilliant enough to send out everyones fancy new chip cards with the associated pin needed to use it to the wrong addresses. With no activation required. So guess who got a new card number with no notice whatsoever as to why? I'm sure they'd prefer their excuse to be because of Sony.

I always get paranoid when considering the different password vault gizmos (especially the smart phone apps), seems the perfect phishing ploy.  Doesn't help that the majority of product reviews written these days are of the let me google that and find 10 similar items that I can copy paste into a "10 best xxx" article w/o actually looking at any products variety.

So is it back up yet?

Didn't facebook JUST switch to allowing an HTTPS option?

A bit behind the security curve. :)

That's what she said.

That website is confusing.   How does it stop keylogging from snooping the password?  Does it have some sort of external method for entering the password?

Not that I'm aware of. Perhaps it's moreso for the secure browser stuff. I nabbed it for the PW manager feature and the ability to transport client data from work to home without having to use dropbox. It's nice to know that even if I drop it, the data is not going to get into anyone's hands.

And now, Sony blames Anonymous (http://www.reuters.com/article/2011/05/04/sony-idUSN0422224820110504) ("indirectly") for the attack.


Though how a hacker could get in through a successful DDoS is beyond me...  :headscratch:

They aren't saying they got through directly because of the DDoS, they are saying they got through unnoticed because the network staff was busy dealing with the DDoS and not performing routine monitoring of the other aspects that could have detected an intrusion faster.

Total and complete horseshit. There is no defense against a DDOS attack, you block the IP they're trying to hit at the core router level and thats all you can do. An intrusion isn't something you detect and stop... like a burglar... A network intrusion is like a leak in a damn. If the route exists the water/intrusion is GOING to happen. You have to make your damn/network leak/intrusion proof. If the damns already got a crack in it, finding the leak doesn't do you any good. When it collapses it's your fault for building a shitty damn, you can't blame the water. They can make it illegal for water to flow downhill they want, but it'll never do them any good.

1) You have to monitor what traffic is DDoS traffic and what isn't, and actively block those IP addresses.  There's no magical block_all_ddos_ips executable.  Thus my point, it takes resources away from general NOC operations to block and stave off the DDOS attack.

2) If there is no way to detect an intrusion then how do we know there was an intrusion?  Oh right, because they saw signs that an intrusion occurred and investigated it.  This requires resources, which may not have been available due to issue #1

There is no such thing as a network being intrusion proof, except for systems that have no network access at all.  People have hacked into DOD and pentagon systems before, and the most you can do is be vigilant in keeping up with security practices and monitoring to catch things before or as they are happening. 

I'm not excusing Sony, but what they are saying is believable.  It doesn't make it any less their fault or any less their problem, but it's still believable in what they are saying.

1) you're wrong. I worked in a NOC for 3 years. Our customers would get hit by DDOS attacks all the time. You don't block the incoming IP addresses, that would be stupid... there are usually thousands, if not tens of thousands of IPs hitting you at once. You block the destination at a core router. Then the attacker has to start switching target IPs. Every new IP they add to their attack vector degrades their effectiveness.

2) I shouldn't have said their is no way to detect an intrusion... there is... but by the time you've detected it, it's pointless. In my example, the damn is already doomed. They're already in, you've already lost your info. All the info they need was probably smaller than a few hundred megabytes... maybe a couple of gigabytes that the most. Given the probable size of Sony's outbout trunks and that the attacker was probably also operating from inside some other hacked system with equivalent bandwidth the movement of data off Sonys network likely took minutes, maybe even seconds.

What they're saying is not believable. It's silly. The data that was stolen should never have been accessible from outside Sonys firewall... period. Unless you're sitting in the Corporate IS department of Sony Inc after going through 2 or 3 security doors, then logging into your work PC, then logging into their billing system should you have been able to see that kind of info. They only people at sony that would need to see that level of data are developers.

Received the email


Figured was odd as last game I touched of SOE was SWG back in August 2003, then searched the old email account and the only reference to sony was the Vanguard Beta  :drillf:  I knew that 30 minutes was a mistake.

You can also upgrade so that's not totally true.

At this point, Sony is officially Circling The Drain.

I specifically created an email redirect on my domain to use in applying for the Vanguard beta. It has received the SOE email, but I don't think my EverQuest email address has.

Soon all we'll have left is Steam. 

indeed, this DDoS excuse seems convenient.  Blame a loose confederation of well known (via Wikileaks) hackers.  In short, blame the only people politicians may have heard of.

"network staff was busy dealing with the DDoS" => code for "we kept bugging the network folks and having hourly huddles to discuss our current status so often that they couldn't get any actual work done"

At least, if it's anything like any major outage I've worked on. My favorite was bugging the Ops staff every 30 minutes for a status update when the problem was electrical. So, you know, ask the fucking electrician, none of us are actually working on the issue and could be doing something useful instead of running between our office and meeting rooms all day just to say "I don't fucking know?"

Working as intended.  :why_so_serious:

Kildorn has it exactly right.

A conference bridge has been opened on this P1, please dial in for 6 hours of finger pointing and pacing!

Credible evidence. :oh_i_see:

And the real cause is? Incompetence!

"Sony was using outdated versions of the Apache Web server software, which "was unpatched and had no firewall installed." The issue was "reported in an open forum monitored by Sony employees" two to three months prior to the recent security breaches, said Spafford."

http://consumerist.com/2011/05/security-expert-sony-knew-its-software-was-obsolete-months-before-psn-breach.html

This is always the real answer in any major debacle.  That and "budget-minded" executives.

And I picked a bad time to switch to LastPass I guess.
http://blog.lastpass.com/2011/05/lastpass-security-notification.html (http://blog.lastpass.com/2011/05/lastpass-security-notification.html)

Hooray for the cloud, always available except when it isn't.

You always have access to your passwords though without access to their servers.  Just not syncing.

More fun Sony/PSN news (http://consumerist.com/2011/05/security-expert-sony-knew-its-software-was-obsolete-months-before-psn-breach.html)


I'm looking for an adjective past "clownshoes" here and failing...   :uhrr: 

My new favorite word/phrase is "best shore".

The IRC log (http://173.255.232.215/logs/efnet/ps3dev/2011-02-16) of the "hack" is the one from #ps3dev on efnet.


Curious that RHEL/CentOS doesn't ship with 2.2.15 or updated to it. From the time/kernel it sounds like an OS of 5.2/5.3 setup but with a custom/source compiled 2.2.15 Apache for some reason. I'm wondering if they pulled in the 2.2.15 for some feature that the vendor package didn't have let the whole security lapsed because the staff never kept on top of the source compiled updates. Even if they were running Spacewalk (http://spacewalk.redhat.com/) to monitor and deploy updates the httpd(apache) one would slip by any monitoring unless the staff monitoring updates were aware of the lack of a Apache package.

this RHEL3 or RHEL5?   :oh_i_see:

That's the log I posted on April 28: http://forums.f13.net/index.php?topic=20733.msg924037#msg924037

And this was posted 4 posts up:

"Sony"

It's Redhat, their repos are old enough I'm shocked they have x64 rpms. I have no idea why people insist on paying redhat for slow shitty service.

(RHEL 3->5 stock 2.0.57, RHEL6 stocks 2.2.15. Both are crazy out of date.)

To everyone who said "already posted", wanted to put some reference around the version numbers and OS posted  :why_so_serious:


RHEL5.x uses Apache 2.2.3 and RHEL6 moved up to 2.2.15 if I remember correctly (using CentOS everywhere so haven't used 6 in production). Ah here's a RHEL distro package overview (http://distrowatch.com/table.php?distribution=redhat). Both are technically behind the curve in latest and greatest but Redhat patches any venerabilities against the packages. Redhat is aimed to give a stable life cycle product not going to a bleeding edge version every release.

The problem here is the either they left a RHEL6 box totally unpatched (which doesn't work because there is only one errata (https://rhn.redhat.com/errata/rhel-server-6-errata-security.html) for mod_auth_mysql (https://rhn.redhat.com/errata/RHSA-2010-1002.html)) or a manually compiled package

I r kin reed gud.   :uhrr:

This, most thieves hit in the same manner, and the bank quickly stops charges.

Who can forget this classic?

http://www.youtube.com/watch?v=8AyVh1_vWYQ

It cannot get any worse from the latest reports (http://www.reuters.com/article/2011/05/07/sony-idUSL3E7G701T20110507)

Soon we will be marking three weeks of PSN downtime, when they initially said "a day or two", and there's no ETA. They don't deserve to get any of us back.

Take a game like Brink, they're fucked on PS3 launch if Sony doesn't get it going.  At least Portal 2 got a day or two of sales before the crash, and also has a single player.  From what I've seen of Brink, it's about 98% online... if multiplayer isn't live at launch, there's potential for significant losses. 

Yeah I typically pick up multiplatform games for the Xbox, but because of the Steam deal I went PS3 for Portal 2. Since I just set up a projector I want to play the co-op on the PS3 (I haven't built my HTPC yet). I suppose you could say it's set of circumstances/timing thing, but it's left a bad taste in my mouth for the PS3. On the other hand, my only PS3 purchases to date were Demon's Souls, Uncharted, Fat Princess, and Flower... so at the end of the day I guess I wasn't a Sony cash cow anywho.

For me it's the simple fact of how long it's been down. If it was back up in a week or so I likely wouldn't have given resubscribing to their services a second thought, now not so much.

*edit - bourbon = typos

The only thing I care about really is getting my unlockables/dlc for Dragon Age 2.  :mob:

The most annoying thing about the PSN outage is my inability to watch Netflix or Hulu on my TV.  :mob:

I thought I had heard that it was still possible to watch Netflix even with the PSN down.

Sure, as long as you watch on your PC or your Roku or whatever.   :awesome_for_real:  For some reason the PS3 Netflix client requires you to be signed in to PSN even though all of the content is coming from Netflix directly.

If you have it try to sign in so that it gives you the 'Network down for maintenance' message, and then hit the back button to close the PSN login interface, Netflix will open up and let you watch stuff.  Sometimes you may have to attempt to log in several times as Netflix loads before you're good to go, but as long as you make the attempt and get the network down message, Netflix will let you watch stuff. 

Hm... I tried something like that during the first few days of the outage, and I could never get the login prompts to go away.  Maybe I just wasn't persistent enough.

Single-player Brink is basically multiplayer with bots. With PSN still out I'm going to wait and possibly skip it in favor of LA Noire next week instead of my original plan of buying both.

Is all this the ultimate result from Sony's removal of OtherOS? Regardless, Sony's incompetence surrounding the handling of this fiasco from security to PR is nightmarish.

IMO Sony is really fucked here.

MS' strategy as of late is to not have many exclusive titles but instead try to make the 360 the choice for multi-platform games, with timed exclusive maps, heavy marketing and crap like that. These PSN problems play right into those hands. Who the hell is going to get Call of Duty or Madden for the PS3 now?

Just keep trying to sign in, and Netflix will load in the background.

I read that the PSN login has to fail 3 times before netflix starts playing.

If you try to load the PSN three times while looking in the bathroom mirror, the guy from the PS3 commercials appears!




So seriously, on a scale of 1 to 10, how fucked is Sony between this and SOE's fuck up?

Does it go to 11? :why_so_serious:

I believe it does.  Particularly when publishers begin to hit on Sony for revenue loss.  Not that Sony gives a shit; I was explaining to my wife just yesterday why the original Sixaxis is a piece of garbage when compared to the DualShock 3.

When Sony put out the online storage system that let me copy my Dragon Age and Demon's Souls saves somewhere besides on their piece of shit console, I really thought I was doing fine.  At this point, I've beaten Portal 2 and am not very interested in incrementing save games which I could lose at any time.  This past weekend, I've been playing Borderlands on 360... not because I have some awesome way to copy my saves off but just because the PS3 makes me ill when I see the XMB.

I've been able to consistently access netflix by just opening netflix on ps3, and telling it to keep trying to sign in. After 3 attempts, netflix is working, and the login thing does not pop back up.

Anyone have a similar workaround for mlb.tv? the same trick seemingly does not work there, and watching baseball on my netbook is not fun. I tip my hat to MLB though, I received an apologetic email from them about the ps3 outage before I ever heard anything from sony with a $5 credit to my account and an explanation of how to get MLB.tv going on different platforms. They have since followed up with another apology email and another $5 dollar credit.

I just go to the 360 for netflix now, or check AT+T on-demand.

http://arstechnica.com/gaming/news/2011/05/billion-dollar-psn-outage-may-not-be-fully-remedied-until-may-31.ars

3 more weeks, yay

*edit* and FYI, some commenters on the page are saying that something has changed in the last few days with Netflix/PSN, and now the fail 3 times method isn't working for a bunch of people (and thus Netflix is completely inaccessible)

This will answer that burning question: how soon can a corporation build a secure CDN from scratch?

I have to keep remembering: SOE is also down.  While probably not many people here are playing anything from SOE, it's still amazing to me for sub games like EQ2 that people still can't log on.

http://venturebeat.com/2011/05/09/bad-information-spreading-on-playstation-networks-return-date-nothing-new-folks/ (http://venturebeat.com/2011/05/09/bad-information-spreading-on-playstation-networks-return-date-nothing-new-folks/)

I guess even longer than previously thought to rebuild, or maybe less. Sony has no idea!

Quote from that article: "And now Anonymous has no avenue back into Sony’s servers." Way to pin the blame.

Might be for some, but I only have had to attempt to log in to PSN once to get Netflix up, unless I've turned off the Playstation since last I started Netflix, then I'll have to do it twice.  Occasionally, I'll have to sign in to PSN in the middle of watching something.  Though, I was having the exact same issues for a week, or two, before they brought the PSN down, so it's all the same to me.

Did you just skim the article, or are you selectively quoting to make yourself sound like a retard?

Edit: fucked up a quote tag.

Sorry, I did just skim it and missed the context.

(http://i.imgur.com/xJZhg.gif)

http://www.next-gen.biz/news/psn-outage-begins-to-hit-retail

I'd like to see the number of PS3 MW2/Black Ops copies that got traded in over the past 2 weeks.

I feel for the PS3 gamers...I would be fucking sideways if XBL was down for more than a couple of days. OTOH, I am really enjoying watching Sony twist in the wind.

I've already been sideways over the PS3 last year.  Too bad I quit drinking.  I'm sure Dark Souls on 360 will be fantastic.

Why'd you quit drinking ?

Not having dedicated servers work via the internets is clearly paying off for these people  :why_so_serious:.   Has anyone seen anything about people going back to PC?   I'm not holding out much hope console FPS players are going to switch to a mouse but we're talking about a LOT of people.  There must be some affect on PC sales.

One of my buddies from my Planetside days was a huge PC geek/builder back then. Since, he has gone completely console and his words were something akin to, "I doubt I'll ever go back to sitting in a chair in front of my computer horsing around with a mouse and keyboard. Rather sit in my nice comfy lazyboy with a controller and shoot bitches on my big screen." Take that for what it's worth, but my outlook is that a generation that started gaming on PC shooters is now aged out of it and relies on consoles to scratch the itch... the methadone of old gamers that still need a fix every now and then.

No I completely agree.   It's just that we're talking about a LOT of people here.   At least some of them will look at the computer they already have and weigh it against buying a new 360 at the cost of their PS3.

There is that... but how many would take a look at their old rig they been using as a media station and think that they have been outta the PC building game for so long that it is: a) not worth the effort trying to research and piece together another gaming rig with all the new whistles and whirlly lights and/or b) cheaper just to swap into a different console.

My feeling is some will take a glance at the PC situation and feel a sting of nostalgia but realize the proverbial ship has sailed off.

I've got a PS3 and about 5 games. I mostly use it as a CD/DVD/Blu-Ray/InternetTV device (it made my dedicated Blu-Ray player redundant), but I do play the games. This whole PSN thing has made me think about trading it in, switching to an XBox 360 and seeing what that's all about, as I've lost all confidence in Sony's services.

The duration of the downtime beggars belief and they've come across as extremely arrogant towards their customers. You simply can't take your online gaming services offline for three weeks, for any reason, ever. Not even to rebuild them securely. It represents a complete failure of what you offered in the first place and you don't deserve any return customers.

So it's up to 3 weeks now?

I mean shit, they had the internet up in New Orleans faster than that right?

In the first place I was talking about people who have gaming computers that are only relatively out of date.  A 5 year old gaming computer has about twice the stats a 360 does.   You may be right though that a lot of them suffer under the assumption that this isn't the case.   Really too bad considering a very cheap video card is more than a match for MW2.

How much does a decent gaming rig cost? Plus $ for an OS, fucking around with drivers, etc etc.

How much does a XBox360/PS3 cost?

Depends a bit on where you're coming from. I don't own a TV, and my monitor only has VGA and DVI, so I'd have to get either a TV or some type of conversion gear in order to use a console. It would still be a bit cheaper than a new rig, especially if I cheaped out on the TV, but thanks to the console market, I've not had to update my PC in 4 years. Eventually I will have to, probably this summer sometime, but that will last me another 4 years or so. Then I reuse my monitor, case, DVD, hard drives, PSU, then I'm left with vid card, memory, cpu and mobo, which a judicious upgrade can get you up and running with around $800 for an excellent rig. Cost of TV and console probably exceeds that. Add extra money if you don't want crappy TV speaker sound.

But this is somewhat neither here nor there. Sony screwed the pooch with both PSN and SOE, so its not really about the PlayStation perse, but just about anything Sony does from now on that requires your credit card.

I see this hurting Sony, but not the Xbox 360.

While fucking around with drivers seems to be a thing of the past with Windows 7, a gaming rig still costs at least double what a console costs.

double? It's a little more than that around here... :why_so_serious:

I'm talking about most people. Nothing personal toward you, but If you don't own a TV, you're in quite an unusual situation and a tiny, tiny minority. So small, I don't think anyone would take your personal situation into consideration. Homes with multiple TVs and multiple consoles would probably easily outnumber your situation, particularly when we're talking about potential game-player-machine customers.

My "one-level-behind state of the art" rig cost me 900 Euros while the 60GB PS3 cost 500 Euros. I just googled the new prices and the PS3 costs 300 Euros now. I humbly stand corrected. Double to three times the price.

Netflix officially not working now - for whatever reason they're requiring being logged into PSN now for it to work.  Inconvenient, but at least we have it on the Wii and the crappy TV.

I also do not own a TV (and I connect the 360 to my 24"), but there's a reason for that: there's actually a yearly tax of around £300 which norwegians have to pay for owning a TV. I'd rather watch series on either the 30" or the 24" than pay £300 for the right to own a TV. vOv

1% of US households do not own a TV at all.  1%.

Approximatly 80% of US homes have a personal computer. Want to guess how many of those can run a FPS vs how many just use an integral video chip on their low-end processor? 

As someone with a 5-year old machine that wasn't top-end but one tier down, you don't have fun in FPSes on your PC when it's that old.  Despite the games being developed for consoles, the PC crowd demands higher res textures and features that kill rigs like mine, even when turned-down.  Or if you get decent performance they look like ass so you wonder why you bought it for the PC instead of the console.

Plus, as mentioned, computer chairs suck.  And you feel more closed-off from your family and friends sitting in front of that monitor. 

I never kept my PC cutting edge, but I generally upgraded it regularly (memory and video cards), and would replace it as soon as I couldn't run whatever new game I wanted. I was lucky in that I didn't play a lot of shooters -- more RTS and RPG's -- so I could go five or six years, minimum, on a mid-level gaming rig without problems.

Then my wife got an Xbox. IMy PC is like 8 or 9 years old (single core Pentium IV), I replaced the video card solely because the last one died not as an upgrade. I added memory back in 2006. I sorta need a new PC, but I don't want to fork out the money (1000 to 1200 for my usual mid-level rig + professional Windows 7 + Home Office) when an Xbox is...300 dollars.

I mean I really want to play Diablo III and SC2, but on the other hand -- it's going to wait until my PC absolutely DIES and I have to replace it anyways.

If I had a PS3, I'd probably buy an Xbox at this point though. I wouldn't go back to PC games.

On the bright side, I saw Jade Empire on the Xbox Classics list -- somehow missed that one, always wanted to play it...

$50 and 2 minutes on craigslist and anyone could own a TV. For less than $50 you could use the VGA on a computer monitor.

I'm still gaming on a C2D based computer that I built 3 years ago for $900.

I wonder what % of that 1% are serial killers?

I used it last night.

It took a few tries, but yah, I've got Netflix working right now.

I am not one - that I know of.

Heh, way to run with my somewhat disingenuous comment! In any event, it was meant to be more of a social commentary than a realistic fiscal analysis. Bottom line is, most folks have already forked over money for a big ole TV and a cable subscription with internet bundled into it; a console can be cheap because its somewhat of an add on.

For serial killers like me, who have neither cable or a TV, the costs of acquiring a console is steeper since it involves buying into a whole media system that I've avoided since the early 90s. A computer system to my liking, with a generous monitor and a mid to high range video card, is going to end up being a bit more expensive than a TV, cable subscription and a console, but then again, its a computer. Not only do I get access to off the beaten path games like World of Tanks, but its a one stop for just about everything else, be it work, music, TV and well, anything else. When living in an apartment, its nice to have it all in one place.

But again, this is a derail. Sony's woes affect anyone who gave them money for internet services, it seems.

FYI, I am so dependent on Xbox-mediated Netflix to my TV that if my Xbox red-ringed, I'd have to fight the urge to just run out and buy a new one that second rather than try to get it fixed.

This whole thing may actually affect my shopping habits.  I'll probably buy LA Noire on 360 if this keeps up.  Luckily Witcher 2 stalls that decision for a while.  Dark Souls?  Maybe on the 360 as well.  We'll have to see where everyone's getting it, and they may be shunning Sony due to this.

I just wish my elite was a hell of a lot quieter.  The next 360 needs to do something about that.  It also needs to come with wireless built-in this time, or I'm done with them.   These last months have shown I can be a pretty dedicated PC gamer when there's a lack of console games I'm dying to play and my rig is passable.  Only my Mass Effect save game predicament has had me for much time on either console this calendar year. 

:oh_i_see: I played Planetside on my big screen. Accurately, with a mouse and keyboard from my comfy sofa.

The console vs pc thing is funny. Since "most people" (may I see your polling data, please) would need a pc for their facebook nonsense. Console + laptop = decent gaming pc (unless you live on the prison continent). Not to mention: Steam. PC gaming is the best it has ever been. So is console gaming.

My long-standing anti-console bias is that while a console is initially cheaper for the hardware, you're stuck with shitty, underperforming hardware for years without being able to upgrade it; you pay a premium for games; and it's a mostly a unitasker. Also lolz controller for shooters. So there. I can play the slapfight, too!

I just shut off my cable box, but I'm more of a parallel killer.

 :oh_i_see:

I have yet to pay for the network. However the PS3 is rather integrated to my media consumption. So, while its fun to be all, "haha sony", it sucks for people like me who enjoy the things the PS3 offers more than xbox.

Thankfully Netflix still works for me.

To consoles credit, having a known hardware configuration is a boon to development.

:grin:

The new 360 model does have wireless built in.

So now you can have random disconnects on the console as well. :awesome_for_real:

You can go down to Best Buy with a little knowledge and find a decent gaming rig (HP or Compaq) for around $400, spend another $100-$150 on a mid-range video card (even have them install it) so total of around $500-$600. No, it won't blow the doors off of anything, but it will be comparable to what you'd get with a 360.

EDIT: Add another $100-$150 for a decent monitor if you don't have one. Add about $10-$20 instead if you have an HDTV.

I'm 90% sure that's terrible advice.

Maybe so, but my wife's PC that I bought less than 2 years ago cost about the same - a Compaq with a AMD X2 dual core processor. The only thing we added was a decent video card. Seems to be running fine to me.

It's called "tweaking" and "optimizing" you noob!  :why_so_serious:

Also, apparently Eidos wants to play with hackers too!
Anonymous Splinter Group Implicated in Game Company Hack (http://krebsonsecurity.com/2011/05/anonymous-splinter-group-implicated-in-game-company-hack/)

Rumors about the result of this hack:
* ~9,000 résumés from Eidos
* information on at least 80,000 Deus Ex users (as in.. fans signing up to hear more about the game, or what?)
* "src" - which could be anything. or nothing.

"A Little Knowledge" to you or I is a vast chasm to the average user. You know, the one who actually pays for services like Geek Squad and thinks it's a good deal.  There's a shitload of those people.

Consoles are an appliance.  You plug it in, it works.  That's what people want.  

Think of something you don't like doing or lack the skill to do.  Somewhere out there, someone's lauging at you for being a sucker and paying extra instead of doing it yourself.  Now ask yourself why you don't just learn how to do it and apply that to consoles and PCs.  Listening to you all talk about how they could just do this or that and get so much better is like listening to the field guys laugh at how badly their neighbors mangle DIY home repairs all over again.  

There's a reason I pay a guy a ridiculous amount to replace a three-way switch for my ceiling fan. If I did it myself, I'd probably burn the house down.

And hell, I hate mucking around with my PC -- especially for bleeding edge stuff -- so much that having a console that WORKS is such a damn relief.

No driver conflicts, no weird video card issues, no trying to figure out what version of Nvidia drivers I need to use because something broke CoH or whatever in the last patch....

I want to play SWTOR and Diable III and SC2, so I'll have to upgrade my PC. But I really don't want to.

It's the "decent" part that's so easy now.  Really there is only one requirement for a computer to be decent.  It has to have a PCIx slot.   If you have that you can plug in a cheap video card and you're gaming.   Monitor doesn't matter anymore as any card you'll buy can output 1080p to a TV these days.

How much do they charge to install a video card anyways?   If it's anything more than $25 that's highway robbery.   Though somehow I bet it's $50.

Probably $25-$50, I think. Yes, it's a fairly easy install, but not to people who know nothing about computers.

Show most people the inside of a computer, and you might as well be showing them the inside of the human brain.

I'm all about console = just works - old hardware, but with this PSN business and releases like New Vegas or more recently Portal 2 freezing on me the equation ends up negative.

Its odd, I was on a console kick for quite a while, but starting around Jan of this year, I think I have bought maybe 6 games, and they where all PC. A few might have been better on console, but I am really on a PC kick right now.

I agree that for a lot of people buying a console is the best way to go. But on the flip side. Its also pretty easy to have a computer savvy friend give you enough advice to be able to buy a decent computer with minimal work.

Agreed though, still not as easy.

They already addressed both of these issues with the current "slim" model, so I assume we could take both for granted whenever we get the XBox 720 or whatever.

Lots of "the kids" these days do their facebook from mobiles and such. Not to mention laptops and non-gaming-level machines. To wit: My mum has a PC, and if she was interested, she could do facebook and such. She's not going to be able to run Call of Duty on it. Also most people simply do not want to fuck about with upgrading hardware. I'm not talking about people on f13, I'm talking about most normal people in the street, in schools, at the mall, etc.

We don't have netflix availability here in Aus. Aside from the music video channel, what does PSN offer that the 360 doesn't? They seem pretty much the same to me. I still use my PS3 as a BRD player, regardless of PSN. It just means I don't get "updated movie trailers" (oh noes) or get to use the shitty online Blu-Ray movie features that I never use.

To expand:  Laptops over took PCs in #'s sold back in 2008.  The general populace preferred the more mobile device.  Smart phones are expected to surpass laptops by next year.  Again, a more mobile device and, as story I heard in the last week emphasized, a device that does 'everything'* that the laptop did for them and at a lower up front price. (Remember, people are dumb about recurring costs, so that $240/ year for data doesn't register.)

The masses don't care about the PC in general.  Why's it such a heyday for PC games on steam? Because the big dev houses are out there pushing consoles and smart phone/ tablet games.  The upswing in indy games is because that's what they have to do to get their game out there.  Nobody else is going to do it.  Not a bad thing, and certainly the model of new business, but if internet distro had never caught on they'd be SOL.

* I will note that when the reporters say 'everything' that word processing and report writing aren't mentioned.  Nobody's kids are texting their senior thesis papers, but you certainly don't need even a $600 PC to do that function.

So it is really looking like Sony won't be alone in being a target.

Square Enix sites hacked (http://www.bbc.co.uk/news/technology-13394968)

Not to say Sony is handling this well at all, but this whole idea that Sony are somehow alone in being A) incompetent or negligent and B) potential places to get information stolen from is laughable.

What the hell. There has clearly been a rash of high profile Hacking lately.

Is the current gen of security just to old now? This is getting out of hand.

I'm hoping that MS and Blizz have both stepped up their security...

This is a little irritating for the first time, now that I can't stream Netflix on the big TV anymore.  I can get past the PSN logins just fine, but I'm getting a Netflix error message regarding their communication with the PSN servers.  Suck!

There's a recession on. Hackers need money too and the thought of big beautiful unsecured databases full of credit card numbers is enticing.

Or idiots like Sony have really pissed off the hacker community lately and Square just happened to get caught in the middle?

Medical issues.  Certainly not because my life is full of candycanes and blowjobs.  Rest assured, if I can deal with whatever it is that makes me ill when I drink, there's a bottle of Macallan 15 year that will have a bad evening.

That and security everywhere has gotten sloppy.   Security through obscurity is something a depressing amount of professionals believe in.

3.61 updating coming


In regards to the Xbox discussion earlier in Canada all retailers dropped the price on Xbox Slim 4Gb's to $129 across the board for a week soon as the outage happened. I'm sure anyone with a fix for online play picked one up that week it's a pretty great move by Microsoft.

Has anybody been able to sign on to PSN yet? I tried to log in through the Web site and it said it was sending an email but of course I haven't received anything yet :oh_i_see:

http://blog.us.playstation.com/2011/05/14/play-on-%E2%80%93-psn-restoration-begins-now/

SOE services back online as well
from main site: http://www.soe.com/


And a rewards program for the outage (http://www.soe.com/securityupdate/welcomeback/)
Only seems to be giving things to active members, or current subscribers, which isn't in any way a way to apologize to former subscribers for their info getting taken.

I expected free winbacks on any Station Pass game I had, and think SOE is hurting their image with MMO players even more.   :oh_i_see:

EDIT
Guess I spoke too soon.. After changing my password the subscriptions page did in fact update to include 45 free days on all the Station Pass games.

Played Fat Princess and Portal 2. No lag, things seem normal. Can't redeem codes yet.

Well looks like Australia is still down (I should really stop being surprised by this), I guess I'll have to wait another weekend before multiplayer portal can be had.

There isn't enough precautions being taken to separate out different systems and the methods to access them. Someone can hack your shitty website's CMS software, get some passwords due to inadequate hashing/salting, turn around and use those passwords to access your internal email system, find some key login details in the email there to gain access to even more sensitive system, etc. etc. etc. Your security is now as good as the weakest link in the system. This is the recurring theme now with these hacks. Essentially people at the script kiddie level of ability can gain incredible access because of publicly known vulnerabilities that lead to ever more sensitive internal systems.

It doesn't take a hacker genius to break into systems nowadays because there's so many gaping holes. It's more like we're working on the honor system where Open is the default and we just hope no one will try any funny business.

Only took them 3 1/2 hours to send the email :oh_i_see:

Sadly, my e-mail is an old one that does not exist anymore. Fiddlesticks.

Somewhat nice to have a free 45 days to EQ2 - Vanguard and EQ are on that list, too, if you have an account for them.  I just can't even try to do EQ1 anymore and VG... never got an account.

Sony/PSN can bite me. The new Terms and Conditions are laughably contradictory on privacy, and pretty much you have to agree that Sony is your lord and master. And the Do Not Accept button does nothing!

I don't need to play online PS3 games badly enough to agree to that.

I logged in to check to see what CC they had on file for me (thankfully expired) to find out that all my game accounts, except for EQ2, had been 'suspended'. Seems someone haxxored me way back.

PSN Web log in down again :oh_i_see:

This is mostly laziness. People buy software solutions without knowing what they do or how they do it, and link them into their internal authentication, or don't fully isolate them. Integration points are always potential failure points, and nobody ever learns that their neat new feature needs to be weighed against that. Though in Sony's case, their homebrew was in dire need of someone with a pair of balls to do a code review, since "we use http for authentication, SSL is for pussies" was actually in practice there this spring.

We had the same issues working medical IT. We had all the medical systems isolated to avoid intrusion and failure (mainly worms, since medical equipment is notoriously behind on patches), and people were constantly trying to bridge that air gap between the desktop network and the medical network so they could use neat new features without switching computers/monitors. I mean, I get that you want to use this cool new medical imaging program to link with all the MRI systems, but the MRI systems are legally unable to be patched beyond NT4 SP3, and it was 2005 at the time. Seriously, not happening.

Yep, I wonder why companies with custom multi-million $ IT infrastructures don't want to pay $20k for an audit / review. Both this and the RIFT "you can log in without authentication lol" issues should've been discovered within a day...


edit: also, this (http://www.schneier.com/blog/archives/2011/05/interview_with_20.html).

I have my unlockables but after the patch none of my DA games can find my DA:O/A saved games. Quick Google search leads me to believe I can resolve the problem if I was able to copy saves to usb but apparently saves are "locked" (i.e. can't save to another storage device).

Sony has the solution though: all I have to do is sign up for their new PoS+ to upload my files.

Excuse me while I go break something.

Remember on the day the PSN went "offline for a day or two", the day's major scandal was that the Amazon EC2 cloud was down? People asked if they were linked (see page 1) but the answer then was "no".

Turns out the hackers may have used EC2 and been responsible for both events: Amazon.com Server Said to Have Been Used in Sony Attack (http://www.bloomberg.com/news/2011-05-13/sony-network-said-to-have-been-invaded-by-hackers-using-amazon-com-server.html)

If an EC2 cell went dark because someone was using a fake account to proxy an attack, bad on Amazon imo. Shutting down an identified malicious IP should be trivial, not a hit the big red button event.

That said, I'm entirely non interested in the fact that the attack came from EC2 as long as it was a targeted hit. A DDoS somehow being setup via a cloud service? News. A proxy hit via a hosting service? Meh. There's pretty much no defense against that, since all you need to do is sign up for an account with a stolen card, and you're pretty much just as vulnerable to tracking as you would be if you just proxy in via some trojan'd home PC.

No that's not why there was an Amazon outage.

Yeah, don't believe ALL the shit on the internet.  Just the good bits about threesomes.

Dear Penthouse, it was raining when two lasses showed up at my door to fix my plumbing...

What are the Cliff's Notes version? I still can't log in here in Aust to see anything.

I went to change my info on the SOE page, saw I had 45 days open in EQ2 (all pass games, as mentioned). I got as far as updating the patcher before I remembered why I stopped playing EQ2.

I debated reinstalling it just to give it see how it looks after a year or so away, but the same thing happened to me.

I'm debating reinstalling SWG so I can fly around space for a bit.  All that will probably happen is I get angry about what they turned the game into then never log in again.

I was bummed I never got my Tie Interceptor. I'll just keep wishing for a Tie Fighter with Wing Commander physics while playing the shallow (but fun) Darkstar One.

I've got an Advanced X-Wing since I'm doing the Rebel Pilot stuff (that thing is a beast), and an ARC-170 decked out in the finest level 9 combined guns with an authentic look.  I had stockpiled an amazing amount of stuff to give to my shipwright for reverse engineering.  Made some really nice gear, with painstaking effort put into equipment appearance.

Gah.  Now I'm remembering back to all the data I put into SWG Creatures and the pilot site, all the fun I had in game, and I'm already sad.

I flew some sort of weird sausage looking things with wings. I did, however, manage to put a really kicking set of guns and shields on it. :)

Free stuff from Sony (http://blog.us.playstation.com/2011/05/16/details-for-playstation-network-and-qriocity-customer-appreciation-program-in-north-america/)

There's some more bits there, free movie weekend and such, but that's the meat.

Sadly, it seems i need to call to change my e-mail. :(

The free games they are offering are much better than I was expecting. I figured we'd get a small choice from PSN-only games, similar to getting Undertow for the XBL problems a few years back. I'll gladly take Wipeout HD, infamous, Killzone liberation, and LBP PSP.

Meh.  I have any of them I'm interested in.  A nice $10 credit would have worked wonders. 

They also said everyone was getting 30 days of PSN+, so you ought to have access to some other free games through that. Some free movie rentals too.

The "free" games in PSN+ are pretty much just access to them while you're a member, as opposed to actual ownership, right?

That's correct. No PSN+, no PSN+ "free" games.

:awesome_for_real:

Wow I really didn't think it was possible for a company that large to take a 10% stock hit over this in the span of a month. The CEO came out and made the comment that "he cannot guarantee the security of any network in the "bad new world" of cybercrime."  :facepalm:

There is going to be an incredibly uncomfortable shareholder meeting on the 28th of next month.

Maybe they can bring Michael Scott along to placate the shareholders. I hear he needs a gig now.

As Lincoln said: If you are a hacker, I will attack you with the North.

http://kotaku.com/5803050/


Can't believe they use the same token.

Hang on... this is happening after their collective network failure? I mean they are bringing the servers back up only to get smacked with this bit of stupid? good christ...

No, fuckers, you do have to review the ENTIRE network.  Jesus.

Had they not had data from the original hack, this would not be an issue. If it is an issue, Every single MMO host needs to change how they do recovery passwords.

A better question then why do they share the token might be:  why did it show the token instead of just checking the data =p

Meh.

The attacker needs your email address and DoB to initiate the attack and even if it's successful you get an email saying, "Your password has changed, if you did not change it contact us."

It's a silly annoying flaw but hardly fatal.

The point is that people who hacked into the PSN systems last month have your email and date of birth.

He's right, though I'm not sure that was the best thing to say at this point in time.

Nothing is ever 100% secure, but the vibe Sony put off is "We can't achieve perfection, so...fuck it. We'll just hope no one bothers".

Any prison can be escaped, any bank robbed, any network penetrated. The idea is to make it as difficult as possible with the system still usuable, to close off the avenues script kiddies would use, and generally make it so only the most skilled and determined could get in, and even then they'd probably go after softer targets.

Ahahah.  I thought you were just paraphrasing, but upon looking it up he actually said that.  Yes, technically what he is saying is correct but he could have phrased it as its' an industry wide problem, and not phrased it in a way that makes Sony look like incompetent idiots.

Security is tough and made even tougher by the fact that the people who insist on being part of the decision making process can't seem to tell the difference between security fact and fiction.

Sadly, this whole thing is nowhere near as sexy as Neuromancer or Shadowrun. 

reg paths are hard m'kay?


especially hard when you forget about them

The point is that it notifies you if your account was compromised.

e:  Also, the people who hacked the PSN already have your password.  That's why you're being asked to change it.

Assuming little Timmy and Suzy do not have the same passwords for their email account.  :oh_i_see:

So are these games any good?

Dead Nation
inFAMOUS
LittleBigPlanet
Super Stardust HD
Wipeout HD + Fury

I have LittleBigPlanet 1 already, and it's hilarious multiplayer, though I got tired of it before i finished it.

Infamous is a pretty good super-hero game.

Professional reviews and player reviews seem to rank them as follows:

inFAMOUS
LittleBigPlanet
Wipeout HD + Fury
Super Stardust HD
Dead Nation

None of them are considered bad.

More Sony-linked security clownshoeing: http://www.gizmodo.com.au/2011/05/vodafone-nz-stolen-xperia-play-saga-a-hoax/

What possessed them to use "major security breach" as a fake marketing stunt about a PlayStation thing?!

Is Wipeout the F-Zero-esque racing game? Or something based on the TV show?

Wipeout is based off the PS2 series Wip3out, and is the TechnoPunk version of F-Zero.  Which also was quite fun.

...man, I need to beat Wip3out: Fusion one of these days.

All I remember is the goofy jogging animation and being surprised (in a bad way) it played like a 3rd person shooter. There's a demo if anyone wants to try it before spending $0 on it.

So I got an email today telling me that I have a free 45-days n my EQ accounts, since it's a station game.

Do I bother trying to take my wife on a Tour of Guk, etc? Last time they had a "please come back" we did Qeynos, some of the Karanas, Kithicor, the Commons, Nek forest and the DE city and Skyfire (and got lost in SolA). Hopped to Iceclad, got lost trying to find the Ry'Gorr Orcs, then finished in Crystal Caverns.

hmm...


Is that PS3 Wipeout Multiplayer-only?

I've got InFamous and LBP.. the others.. they don't excite me.

I just installed from my EQ release CD. It refused to update so I played through the tutorial instead.

(http://dl.dropbox.com/u/85916/seinfield.gif)

Yea this is such BS.   I'm going to bet Sony isn't going to do something obvious like roll out two factor authorization via cell phones.   I'm hoping to see a lot more services offering it soon at least as a result of this.   There's a LOT of clownshoeing going on out there.   Yahoo doesn't even offer it and GMail only offers a somewhat clumsy cell phone SMS thing.

So I updated my firmware to 3.61

Now even on a static menu screen I get flickering and the picture drops out for a second, then it's stable, then I get flickering, then the picture drops out for a second, then....
Since I actually spent 30mins or so gaming on my PS3 on the weekend and no cable has so much as been bumped, I think it's the firmware.

I googled it and it seems that R* are blaming the new firmware for issues people are having with LA Noire, and drop-outs have been a semi-common issue on PS3s for years. I don't really give too much of a shit about gaming on it right now, but I do want to use it as a Blu-Ray player. Sony are fucking clownshoes. I'm glad the majority of my games are on 360, and it's doubtful whether I'll buy a PS4 since it seems to be just fuckup after fuckup with this thing (my machine shits itself on ingame FMV as well.)

Google accounts have a smart phone app you can use for proper two factor authentication. It's quite nice.

Jesus fuck, I remember that.  I have a release EQ CD laying around as well.  Launch day week of EQ nobody could get onto the god damn servers, so I fucked around with that in the mean time.  It was sooo fucking horrible.  It scares me to think there was a time when a company could actually release something that unfinished and bad, and not be imprisoned in San Quinton for mass fraud.

Though it gave me a good insight into what I should have expected for the future.  EQ was my first MMO (well, I played Neverwinter nights on AOL, and some muds, but those dont count).  Opening day, when nobody could get in, the chat room on the launch screen was filled with people typing "Fuck!" over and over again as fast as they could.  Hundreds of them, including myself.  The chat room was frozen and a mod came on, gloating that he had the names of everybody misbehaving, and if we didn't stop, punishment would be handed out.  As soon as he unfroze the chat room, twice as much verbal abuse was thrown out (again, including me).  Jack shit happened to anybody.

Original EQ1 CD installations haven't worked for many years. It looks for a patch server that stopped existing around Luclin or PoP era. Their answer is "oh you can just download the client".

You're far better off messing with Project 1999 (http://www.project1999.org) if you want an original EQ experience for free. The current EQ live UI and gameplay is alien to anyone who played in the old days, but P1999 emulates the early years almost flawlessly and has a similar population to the original EQ1 servers. Currently their world is Original + Kunark, likely adding Velious in a year or two.

But what if you want to go to Gmail on the smart phone?  You completely lose two factor that way.

Something as important as Gmail should have those things for your keyring available at least.

I too am planning on messing with the 45 free days I received to Station games, and since I had the Station Pass, it means I have numerous different games to play.

Was shocked to see all of my SWG possessions and decorated housing still survived, but somehow Sony lost 4 of my characters in EQ during server merges. I was entertaining the thought of happily exploring my old haunts in EQ, but obviously that's been majorly sidetracked (if anyone is interested I posted the full drama of missing characters on another forum (http://www.thearcadians.net/forum/viewtopic.php?f=8&t=507)).

I still have tons of money and items in PotBS (Antigua server) and SWG (Bloodfin server) should anyone be interested in searching through millions of things for something they might find useful... Send a PM if interested.

Why? You still use something you know (the password) and something you physically hold (the phone) to establish your identity, same as when you are logging into gmail through your browser. The fact that your browser runs on the same phone doesn't really change that.

Heh, last few news items on that P1999 are about hacks and DB wankery.

For one the concept of one factor being something you "hold" means that nobody but you has access to it.   It's always on you or in your sight and thus is not likely to be compromised without you knowing it.   A smart phone doesn't fully meet this condition because it can easily be remotely compromised without you knowing it.    Thus it is not truly an object you "hold".   It's way better than no two factor at all though mind you.   For something like WoW or semi-important stuff it's plenty good enough.

For email though you will probably check Gmail via the phone and if you're phone is compromised then suddenly you've lost both the factors at once.

Like I said though I'm not saying this is dumb or anything.   Using the cell phone app is wayyyy better than not using it.

If the fuckers have my phone, them reading my father in-laws latest chain mail is the least of my concerns. I'm still sad there isn't an explode option for the iPhone find my phone feature.

If having a trojan on your smart phone is scarier than people reading through every single private email you've written for years then what on earth do you do with it?

I lost a couple of characters as well. Lower-level mules that happened to have all of my wealth on them. When I contacted sony last time I had a trial to get them restored, they asked me to supply the character names. I don't recall their names since I haven't played in 5 years, and when I did it was on old computers, so I don't even have any eq.opts files with them on them around anymore... at this point, SOE didn't bother replying to my email, since clearly it was too hard to look up the details n my account and see what was deleted...

Great, so it is good to see that PSN being completely down is not enough to stop Sony from releasing PS3 patches that further disable your system.  When I turned my system on tonight I noticed a system 'upgrade' was available and went ahead and installed it thinking maybe PSN is coming back online... What the F was I thinking, now Netflix wont work at all, at this point my PS3 may as well be a brick.

Well, I did get my characters restored, but mostly because those characters showed on the EQ Players site with their names and all of their equipment showing there. I don't know if your mules will show there, but this was a big factor for my getting characters back (including one that was in existence for almost 11 years).

SOE's password change server is stilll down and now it's fucking with my ability to watch netflix, which is highly agitating.

Humm? My friend changed his password last night no issues, through the console that is. Could this be the regional thing they were talking about?

How is netflix related to SoE?

Apparently it now is. last night my friend ALSO was required to renter his user name and password for the netflix service as it was "Disconnect from this device". Update PSN password, then renter your Netflix and you should be good.


I assume Sony ( Not SOE ), decided to remove the device associations with those services that check the device numbers. I assume this matters for SOE games on the PS3.

I don't know, BW, I tried changing my PS3 login last night and the e-mail was from PSN but the link gave me an SOE error page that said "this site is currently offline."  I tried several times over an hour and then just gave up.  /shrug

Engels: The PS3 requires you to be logged-in to connect to Netflix.  Until the firmware updated you were able to just cancel past the annoying pop up pageto get it to run.  Now it's not letting me do so.

My friend was not required to do anything with an e-mail. So, I dunno.  He just signed in with the old, and it asked him for a new one. Then, he simply signed into the netflix account.

:oh_i_see:

Ah, gocha. Netflix to be viewed on a PS3 on PSN, rather than SOE, which as far as I know, is a PC-only thing.

His PSN acct didn't require a new password?  Mine did and wouldn't let me login with the old one. I had to hit the "Change my password" button which sent me an e-mail.  Did he not update the firmware? :confused:

He updated firmware a few days ago. When he logged into the PSN ( ON the PS3 ) with his old username and password he was prompted to change his password, he did so. Then logged into PSN. Then logged into his Netflix account. FIN.


No E-mail, no website. If that makes the steps more clear.

So which is more annoying, this PSN debacle or the old red ring 360's?

I don't have a PS3, but I would say this is more annoying than the red rings, simply because my billing/identity info was not at risk with the 360.

So far, the PSN issue has actually prevented me from spending money, so I guess the red-ring is more annoying.

I had an E-79 or whatever the video card issues that 360s used to get as a problem. The full time it took for me to get the coffin sent out, send it back to them, and received my refurbished unit was less than the time PSN has been down. When I got my 360 back, they didn't release a patch that fucks up playing games and the basic UI. So even though I barely game on it, I'll go with the PS3 being more annoying.

This could potentially have more damaging impact than the RROD. This is people's credit card and identity security they are talking about. A bricked console is a PITA, but it can be fixed. You fuck with someone's money, they get stabby.

Yeah, that's my point. I also had to pay my bank $10 to get a new CC issued, aside from all of my personal details having been compromised. I wonder when I'll find out I have a mortgage, 20k credit card and 10k car loan? Thanks, Sony!

MS ignoring the RROD issue wasn't a good move, but arguably getting their console out early helped put the Xbox 360 up and over the PS3. Of course, if Sony had been less stupid, it could have hurt MS a lot too.

This is worse. As a 'virtual' service, account security is a 'basic' requirement. As Haemish said, a console breaks, you send it back and get another one or store credit. Here Sony have lost a key part of the actual customer relationship and have handled it badly.

Also this is something that has affected everyone, I still haven't had the RROD on my original 360 (this was when 10 or 20GB was the biggest HD available, I think, I don't remember). Granted, I'm not the one to use the 360 a lot, but it's still 5+ years old.

Its increasingly becoming something that is widespread, how many high profile, high sensitive hacks have gone through in the last year? I want to say its a bit unprecedented, its also not just Sony. Thats why I asked before if the current way of doing things is just too old now.

It's not just that - there's also the realisation of how much money can be in a hack. Or even the threat of an attack.

There are a few reasons for this (I was holding a training about itsec / secure coding for ericsson programmers yesterday, and this conversation eerily reminds me of it :awesome_for_real:):
- technical: Security testing is Hard. Most companies don't care about it at all ('I only need to check that my program works when accepting valid input!'), and even for those that do, their developers might not have the "hacker mindset" to know what kind of malformed input to look out for, how to do threat modelling / misuse cases / attack trees, how to set up negative test cases, fuzz testing, taint analysis, etc.
- scale: You have x people doing security testing on your product for y months (and yes, x/y are both often 0) and you need to fix every single vulnerability. The hackers have tens of thousands of specialists who only need to find one exploitable vulnerability to run your day. They also have until the end of time to find these vulnerabilities. No pressure, guys!
- market forces: Secure development is expensive. This means your product will be more expensive to make, you have to sell it for more and... so what? Yeah, you can spend crazy amounts of money/time to get certified by Common Criteria and get a spiffy EAL4 rating, which means bugger-all to 98% of your customers (quiz time: raise your hands if you heard about Common Criteria and/or knew what EAL4 meant without googling it). Oh yeah, and if you're billing your product at extra secure, expect the most skilled hackers to view breaking it as some kind of achievement, which means you're making things even harder for yourself!
- lack of responsibility: Development companies don't need to care about data loss / theft etc resulting from their systems getting compromised. They'll release a patch x days after the discovery of the vulnerability (and if they're lucky, the one who discovers the vulnerability discloses it to them before exploiting it for profit), but the onus is on the end-user to keep their systems patched. You didn't apply the patch that came out just 2 hours ago? Tough, some script kiddie may have already exploited the fact that you are still running an old / vulnerable version.

The only positive development is forcing companies to publicize data breaches in detail (like this one), which is a good start... it SHOULD start some kind of feedback loop that eventually forces developers to give a crap about security. Me, I'm still waiting to see some hard data on how exactly the Sony attack took place instead of some random rumors.

Also, see http://www.schneier.com/blog/archives/2011/05/interview_with_20.html

SonyMusic.gr, Sony BMG's Greek presence, has been hacked. The site fell prey to an SQL injection attack, with the hackers releasing thousands of account names, e-mail addresses, and unencrypted passwords. (http://arstechnica.com/security/news/2011/05/sonymusicgr-sony-bmgs-greek-presence.ars?comments=1)

 :awesome_for_real:

So who did Sony piss off that badly? Jeezus Christ...  :ye_gods:

Blood in the water.

Hide yo wife, hide yo kids....

Did you miss that bit where they pissed over the entire cracker community before all this started?

Now they've hacked Sony Music Japan and Sony Ericsson: http://news.cnet.com/8301-27080_3-20065816-245.html

Dear "Professional Computer People":

IF YOU AREN'T HASHING PASSWORDS, YOU IS DOING IT WRONG.

Do I need to make a lolcat for it? Is that what it'll take? Some cat or walrus sitting here with "I haz a salted and hashed password" bucket?

This isn't Rocket Science. I know rocket scientists. They have to do math and shit. YOU merely need to call already written functions! Hell, in some cases you just need to go into your DB settings and schema and click a damn checkbox.

Maybe if I add "Am aware of all internet needs to hash passwords" to my resume, I can ask for more money.....

Refer to my earlier post ('taint analysis' and 'fuzz testing' included... can't say I haven't seen Sam's reply coming btw :awesome_for_real:): developers and their companies don't give a shit about security because they don't think they need to. Film at 11.

I think I missed that.

Sony feels so bad about losing my personal info that they would like for me to sign up for an affiliate offer.

There are going to be case studies written on this one.

Welp with the store still offline you cannot use the code with Dirt3 that unlocks the DLC of multi-player. (Codemasters uses the $10 DLC as a control on reselling the game, a free one time use code is in the box).

SQL Injection? REALLY? Are we doing that again? Didn't we all have like, a solid week of why you never let your webserver send direct arbitrary SQL?

I'm also amused that the dump seems to imply they're running MS SQL Server?

Erm, there's nothing wrong with running MS Sql Server...

Don't make me sneer at mysql.

Aren't SQL injection attacks fairly easy to prevent? Wouldn't you think that a company with an IT budget the size of Sony should have someone that could do that?

They are ridiculously easy to protect from, and the solutions for it are well-known for every language known to man.

They are, they should, and they don't. Sadly, they're not alone... (http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=sql+injection)

edit: people are also writing C code with buffer overflows in them, don't know how C handles integers, use hardcoded passwords, etc etc... all this in 2011. Everything old is new again!  :why_so_serious:

Is little Bobby Tables running loose again?

Heh.  I loved that one.

This is the company that had unpatched version of Apache with known exploits on core auth servers. Very easy for them to have an unpatched MVC framework if they had one at all.

People are just systematically scanning anything Sony related and having a fun time.

Saw a tweet by a hacker: "I would like to congratulate Sony for holding the best and most enjoyable CTF ever".

It's like the first goddamn thing they teach you in high school programming - how to take a string of number and letters, cut some of that shit out, then concatenate the remainder all back into a whole.

Actually, the proper way to defend against sqli is to NOT concatenate user input into the sql query at all, but use prepared statements instead (https://www.owasp.org/index.php/Guide_to_SQL_Injection#Parameterized_Queries_with_Bound_Parameters). If you're trying to cut some stuff out from the input ("things that look like sql commands"), inventive hackers can find ways to get around your rules ('DR/**/OP DATABASE' is a quick-and-dirty example, see some more here (http://www.netspi.com/blog/2010/12/22/sql-injection-death-by-blacklist/)) and you may end up filtering valid input as well. If you're going to do filtering, use whitelisting: reject all queries that do NOT fit a predefined schema. Blacklists = Bad, Whitelists = Good.

e: of course, "use prepared statements" is among the first things you learn when they teach you SQL... and a lot of developers still don't know how to use them.

But my code is SPECIAL and may do all sorts of fancy off the cuff queries I couldn't possibly list out!

<-- just got done with an email thread that was basically declaring that as the reason for not letting the DBAs know what queries were going to come out of a new utility app.

Yes, but my impression as a layman was correct. :oh_i_see:

So, dissecting that article, it seems like the correct method is to add an additional layer of abstraction between your database and your user interface that enforces bounds and type?

You use an O/RM (http://en.wikipedia.org/wiki/Object-relational_mapping).

I had a nice rant going but, eh, not really the place.

If this thread has taught me anything, it is to never EVER piss off nerds.

Wow. You want bad news? RSA got hacked. Apparently their IT people were pretty quick on the ball and moved promptly to limit damage, but it looks like the hackers got a hell of a lot more than RSA was hoping.

Like, say, token seeds and timestamps.

For those who don't know -- RSA is the guys that do SecureID, which is widely used by the US government and defense contracts to do two-factor authentication (key-generating keyfobs, basically). A sufficiently successful attack could give the hackers everything they need to generate the random token.

But is my WoW account okay?

Interestingly, the school I went back to finish my BS is beginning to offer an Internet Securities BS starting in the fall. 

I totally understand that Sony needs to get their security under control, but at the same time they need to get the store open.  I've been waiting on DLC for two of my games for weeks now and I'm hitting the point that I'm losing interest in playing them now.  If I were single with my indispensable income, I would have already picked up a 360 to cover this shit while PSN is down. 

I don't know if the WoW tokens use RSA, but now part of me thinks it wasn't defense department secrets that got RSA hacked -- it was WoW gold-farming.

WoW authenticators are made by Vasco.  Do they use RSA tech?

I have no idea! Hence the question.  :-)

No. Vasco is seperate. (I just looked it up!).

I'm rather fond of RSA and two-factor authentication in general. A four to six digit pin backed by a 6-digit token is so much better and more secure, in general, than a regular password. Especially when your IT policy is something ridiculous like "12 character password, no dictionary words, one special character, one capital, one number, 30-day aging, and no reuse for a year.". People end up writing those down.

Of course, if you hack the token administrators that gets everyone just as if you'd stolen an unencrypted DB. OTOH, you can shut it all down and reissuse tokens centrally to a new seed.

Yeah, this is the second stage of the RSA hack in March (http://www.schneier.com/blog/archives/2011/03/rsa_security_in.html). The irony is pretty thick in this one (same when one of Comodo's RAs was compromised in mid-march and hackers were able to generate fraudulent certificates until the inevitable blacklisting). Who watches the watchmen, etc.

PSN came back up last night.  It is slow and errors a lot, but at least it is working. 

LulzSec (who did the PBS Frontline 'Tupac is alive' hack) claims to have got into Sony's corporate servers http://twitter.com/LulzSec

How do we go about downloading our free games, now that the PSN is back up?

Yep. And they're releasing stuff in about 3 hours.

LulzSec The Lulz Boat
Releasing mediafire/pastebin/torrent link to a large cache of compromised internal @Sony data in exactly 4 hours. #Sownage

AAaaand it was a million entries of plaintext user information and 25k music codes from sonypictures.com (http://pastebin.com/Y38gCS82)

Is there any legitimate reason to store things plain text, or is it just a lazy/cheap/stupid thing?

There is no legitimate reason, no. Maybe incompetence? There's also no reason a trivial sql injection should grant access, either.

There are reasons to store shit in plaintext. From that link's blurb, it wasn't usernames.txt, it was a SQL database of everything, but no fields were hashes or anything fancy. That's pretty inexcusable for passwords and codes, but not so much for usernames.

There's absolutely no reason to have a plain .txt file sitting around with anything important, or even more than like, 20 records. But I'll forgive you for not encrypting the username field of a sql database. But not the password field. You idiots.

Seriously, is there an internal Sony website SDK they've been passing around that just has shit code at it's base? How the shit do you have every website you run vulnerable to SQL injection?

Also: jesus, they had no password requirements, either. The user/pass list is up on pastebin as well, and they have a ton of six character all lowercase passwords.

Anyone know the answer to this?

Sony says check back soon (http://blog.us.playstation.com/2011/06/01/playstation-store-is-available-and-updated-now/).  :why_so_serious:

Clicking on that link made me almost want to buy Bonk's Adventure, and maybe that Japanese Wizardry game as well, but I managed to restrain myself.

The welcome back program is live, though it just ate my first game choice - seems to error quite a bit. 

So it is an appropriate warm welcome that is completely appropriate to Sony at the moment?

Eh, it had a work around.  I had to go into account settings and find the 'purchases' there instead.  Their network is slow as hell, but I have to imagine thats about 10 million copies of LittleBigPlanet being downloaded at once. 

Give it a few days, I'll bet it gets to normal pretty fast. 

You'll all be happy to know that the movies they're allowing us to watch for this weekend only are: Ghostbusters, Bad Boys and Final Fantasy: Spirits Within.  Yeah...... Sony did no part of this 'welcome back' program out of the true spirit of welcoming their customers. 

Three shit movies for two days.  Check!
Infamous, to prep everyone for their Infamous 2 purchase.  Check!
LittleBigPlanet, for DLC sales and more LBP2 purchases.  Check!
Three other piddly games, two of which were nearly at system launch.  Check!
PSN Plus membership for 30 days to get people hooked on the service.  Check!

How dare you call bad boys a shit movie. :ye_gods:

You're right - "Bad Boys" would have to get on a tall ladder to reach the level of shit.

What a half-assed welcome back. Oh well, I had put off buying infamous and LBP forever so now I get them for free. Yay.

Infamous is well worth it for free.  It's one of the few games I paid full price for that I felt I got my money worth.  I was wholly unimpressed with LBP, but I'm a broken individual. 

Sony Europe now supposedly hacked (http://www.usatoday.com/tech/news/2011-06-04-sony-data-breach_n.htm)

But at least I'm downloading my free games.  But god damn the system errors a lot.

*Edit* and seriously, what the fuck is up with having to download a patch for digital downloads, just fucking download the latest version the first time........

Nintendo just got hacked.

So, Sony, The DoD, Nintendo, Gawker, Google, FBI Partner InfraGard and about 20 others in the past 6 months.

Bethesda Software was just hacked.

Reports are the hackers then fell into the void when trying to jump over a rock.

I got mail from Codemasters (Dirt series) that they got hacked too.

Epic software also hacked (http://www.pcmag.com/article2/0,2817,2386861,00.asp) by LulzSec

A link, good man.  Three points to Griffindor.

It would be interesting to know how many of these hacked companies just recently started looking more closely for hacks.

Probably > 99% .

Also, did anyone who had a fraudulent charge on a CC and blame it on Sony have a Citibank card? Because Citibank got hacked around the same time and had a bunch of card numbers stolen.

Might also be that they are being reported more now, also.  I remember seeing many comments about how this happens all the time but usually the companies do not mention it.  I don't believe they are under any regulation to do so in most cases.

At least one of these companies (Bethesda?) reported/noticed the intrusion only after the hackers posted about it on Twitter.  Not exactly reassuring in terms of security or transparency.

I got WipEout on PSN as part of the identity theft package and was surprised to see a Honda Civic commercial play during loading screens.  Hope that door stays shut.

CCP, and Eve online hacked.

EvE site is down.  Where did you read this?   This is ironic I was just thinking they were clearly not pursuing security seriously due to a lack of those secure ID things.

Twitter, it just Happened. Log in, Account DB, Website all hacked.



Also:



Minecraft:

I don't see any info about them getting "hacked" in the sense of an intrusion though.   It just says they nailed the login server.   Not that I'll be surprised when we see info about an actual intrusion.

What I saw mentioned was "just" a DDoS.

I am sure we shall see when the dust settles.

they hacked Minecraft?  that doesn't seem fair or warranted

This shit is getting tired - what's even the point? To show they can be disruptive twerps with too much time on their hands? :oh_i_see:

Relax, they didn't even take out any good games yet.

Is it wrong to hope they nail Warcraft so hard it's down for weeks?

If I wasn't sure that Warcraft's servers were probably powered by a borg cube I'd hope for that too.

Yes? Just like for any of these companies. Sure it might inconvenience a few dozen suits that probably deserve it, but it also kind of fucks over thousands and thousands of "us" who probably don't. I mean, ultimately the consumers who's shit is actually stolen are hurt more in the long run than the companies are usually.

I thought we were talking about WoW players here?

We look down on WoW players?

Yes.

http://www.youtube.com/watch?v=P3ALwKeSEYs

Those still playing, yes.

I was thinking more a DDoS like what they hit EVE with than data breech.  I'm never happy with the latter.

I got dibs on the phrase "I feel a great disturbance in the Force, as if millions of voices suddenly cried out in terror, and were suddenly silenced" if Warcraft servers go down.  :why_so_serious:

Given their target list for DDoSing, their botnet either isn't as large as they like to imply, or they really don't want to hit someone bored enough to notify every ISP about every botted IP.

They're hitting companies with pretty small pipes. Blizzard.. does not have a small pipe or easy to overwhelm infrastructure. The only time I could think to DDoS it would be a patch day, where you could have the user base unknowingly help by all trying to log in to check out the changes.

Sooo, expect WoW to go down next Tuesday shortly after maintenance?

I completely understand Minecraft guy's twitter responses to this. Better to (at least publicly) yuk it up with these guys than to invite their wrath.

I don't think there's anything very lulzy about a DDOS (from either perspective) but if it were me, I'd do the same.

http://ingame.msnbc.msn.com/_news/2011/06/15/6868847-nerd-fight-4chan-takes-on-lulzsec-over-game-attacks

Nerd fight? Dunno about that... but interesting none-the-less.

They attempted, or accomplished a hit on the CIA sites.  This has the potential to get ugly.

They're feeling awful full of themselves to go after the big dogs like that.  Then again, kids with nothing invested in anything often do.

They hit the public CIA site with just a DDoS attack, which is not particularly impressive.

I'd be more impressed if they went after DHS, who has a lot more statutory authority to go after domestic targets...like kids causing trouble from their parents' basements.

My sites go down and no one even has to DDOS them. Usually it's just Microsoft helping me out.  :drill:

Fixed.

Actually, would DHS or the FBI, or someone like that go after them for DDoSing the CIA?

They're even getting people to troll /b/ itself.

Old BioWare NWN forums hacked (http://www.theregister.co.uk/2011/06/16/bioware_hack_horror/) now. Not been claimed by LulzSec yet however.

Codemasters hacked. Just got this in my email.

Codemasters is on top of it though.  It's only been 13 days since the intrusion.  Thanks for letting us know... or not. 

I saw an article about Codemasters being hacked last week on the BBC site.

I got that e-mail too and I'm trying to figure out why they have my e-mail at all.

OOP, sorry.  I realize that sounded shitty towards Morfiend.  Didn't mean it that way...  I meant to direct my shittiness towards Codemasters, who waited a full 13 days after intrusion to let their user base know. 

Sega's Sega Pass website hacked (http://www.theregister.co.uk/2011/06/20/sega_onemillion_hacked/), 1.3 million users "email addresses, dates of birth and encrypted passwords" taken.

LulzSec seems to claim it wasn't them, and also posts a manifesto (http://lulzsecurity.com/releases/1000th_tweet_press_release.txt) of sorts.

Starting to feel like we need a separate thread on internet security and a discussion about any realistic ways to protect yourself from identity theft/credit card fraud without simply stopping using the internet.

Admiral Adama says: don't network the computers.

I don't think there is any answer other than not using the internet.  It doesn't matter how well protected my computer is, or how strong of a password I make for my account, if the idiots at Sony, Sega, or wherever aren't keeping their end of things secure as well.

Things like keepass so you can have different passwords for everything (just only use local repos, never trust some "cloud" solution to keep the files), and bank with a company that will waive fraud charges. It's a pain in the ass, especially from the identity part of the equation, but about your only option. Right now the negatives from having shit security are pretty much nothing compared to the costs of having good security, so nobody seems to run good security. I mean, most of these hacks are well beyond shit security and right into shit network design, shit process, and shit coding.. but it all winds up being the same for the company's PR. Evil unstoppable hackers (use 8 year old idiotic code exploit to) break into our network and steal YOUR data(that we never really needed for anything more than marketing reasons anyways)! Those fiends!

What this had made me more aware of are really shitty billing implementations. There seem to be an increasing number of sites where I don't need to input my CCV to buy things with saved CC information. As idiotic as the CCV is (I know, we can protect the card's inherent insecurity in the form of being just a number typed in by... putting another number on the OTHER SIDE OF IT!), it's even dumber for companies to be apparently caching it.

NPR Just did a piece on this in their Monday Tech segment.  It's odd listening to these guys try and ascribe more than just malfeasance to the motivation of Lulzsec and "Anonymous".   I wasn't aware Lulzsec were being classified as "Hactivists," for example. 

Seems pretty inevitable that one or more of them will get caught, eventually.

A credit lock can reduce the chances of identity theft but it can also be an inconvenience to you depending on how frequently you open up new credit accounts. CC fraud there's not much you can do except to use a card(s) from a company that makes it easy to reverse charges.

For online accounts use different emails accounts and passwords for each account so a break in at one site won't compromise your other accounts. On security questions for non-financial/critical accounts lie -- do not use your real information like real birth date or any information that can discovered by looking at your Facebook page/blog/etc. like the real name(s) of your pet. As an aside companies like EA/Mythic that ask for things like your mother's maiden name on their game account signups need to be nuked from orbit. Fucking idiots.

I placed a security freeze with all 3 credit agencies years ago. At the time it was only available for CA and TX residents.  :uhrr: When I need to open new credit or get a credit check I call an automated number (probably online too) with my code and pay a small fee for a temporary unlock.  So far so good, but the same can be said of my homemade lion repellent.

So, someone got arrested, unclear if they actually are connected to LulzSec as of yet:

http://www.cnn.com/2011/WORLD/europe/06/21/uk.sony.hack.arrest/index.html?hpt=hp_t2

It's bullshit. They've arrested a guy who fell out with Anonymous in May, who was NAMED by Anonymous back then, even giving his UK phone number! LulzSec seems to consist of key members of Anonymous who had since kept Ryan Cleary at arm's length.

Story from May 9, naming him: http://www.msnbc.msn.com/id/42963715/ns/technology_and_science-security/

It merely took a month and a half for the British police to do anything with this information.

Edit: A journalist even interviewed Ryan last month! http://www.thinq.co.uk/2011/5/9/exclusive-anonops-splinter-group-speaks-out/

I was under the impression that credit lock is currently either unavailable or expensive if you do not have an ID theft/CC fraud police report to present to the CBs.  Fraud Alert seems to be the current cheap or free service available to replace it but I don't think it prevents your credit report getting pulled like a credit lock does.

And another to the list. 

Bioware

Yup, I just got that Bioware one too.

Awesome, changed my password again on my Yahoo account, seeing as I may have used the new password going back that far.

The good thing about having to change your password every 60 days at work is I have a good stable of passwords.

Also, changing the password was obnoxious, first it told me it didn't take, however I couldn't log back in and used the new password.

Yeah, I got the Bioware/EA email as well.

I got the email, and I had to change a lot of passwords at work because of suspected attack.  Dammit.

http://lulzsecexposed.blogspot.com/

And here is more

http://www.thesun.co.uk/sol/homepage/news/3653684/Bleary-eyed-internet-hacking-suspect-Ryan-Cleary-looks-wasted-after-inhaling-gas.html


BLEARY-eyed and puffy-cheeked, this is internet hacking suspect Ryan Cleary after inhaling lighter fuel at a fellow computer nerd's flat.
The dazed 19-year-old - remanded in custody today after being charged yesterday by cops probing the hacking of major corporations and security agencies - got so wasted he could barely speak.

Most (all?) banks have services to let you generate temporary credit card numbers for online trasactions, with an exact limit and time period. Set one up for 3/6/12 months for subscription stuff with a low limit. Bank of america's website let's me do it within 3 clicks of logging in, instantly.

His mother reminds me of the main character in one of the barbarian movies. The snake guy.

That stupid site has no more solid information on LulzSec than Andy Greenwald had in the article I linked June 15: http://forums.f13.net/index.php?topic=20908.msg941377#msg941377

A hacker group actually released information on all Lulzsec members real life information (except 2 of them) here (http://pastebin.com/iVujX4TR).  A lot of in depth information and logs from the members.

Did EA just get hacked? I've got an email from "EA" saying that they've reset my password:
Though it may just as well be a phishing email as well

Got that too by the way.

Apparently there are three versions of that and nobody's sure what's right or wrong. This group claims they will be releasing the "real" version of LulzSec IDs: http://twitter.com/teamp0ison_

Best way to cover your tracks ...

... Because the DHS couldn't possibly have the resources to just track all 3 lists and discard the ones that weren't panning out, right?

Sure they have the resources... it's the use of those resources that I question.

So in a non-gaming related, but security related note, Rent.com decided to send me an email about how I haven't logged in a while.  That's fine, those emails annoy me but not that much.

I then opened the email and and my face now hurts due to my massive facepalm.  Inside the email, I guess they assume I haven't logged in because I forgot my login credentials, and so they decided to be nice and send me (in plain text) my password to their site.......

Reply to them with a link to one of the bajillion online security articles about the recent spate of hacks.

Looks like the EA thing was legit, as my BF password didn't work anymore. I went directly to EA's site to change it though, rather than via the email link.

I'd change the email account I use for these games, but then, these game sites are the ones being hacked for the most part...

Oddly, my BF1943 game did not seem to care I could not log in. *Shrug*

It seems as though the feds busted Anon.

http://www.cnn.com/2011/CRIME/07/19/new.york.anonymous.warrants/index.html?hpt=ju_c2

Those aren't the core anons or anything close to core of anon, they are retards who thought they could use the DDOS tool without hiding behind proxies and weren't smart to realize their actions are broadcasting their real IP address to everyone.

They will learn the hard way you don't join in on illegal activity unless you have some vauge idea of wtf you are doing.

I doubt they'll learn.  They were dumb enough to participate in the first place.

Topiary arrested.

http://www.reuters.com/article/2011/07/27/us-britain-hacking-idUSTRE76Q4YM20110727

Good to know that there is an internet connection in the Shetlands for when I go full-hermitard.

In hindsight as a Scot, the videos where he speaks could have pinpointed him. Native English speaker with a Scandinavian lilt - that's a Shetland Islands accent. I missed it as I usually would, because it makes you go "Norwegian? Swedish?".

Spokesman part made me lulz.  :why_so_serious:

Who knew, the scary hacker group had a community rep...

He was the main voice on the LulzSec and Anonymous Twitter accounts for the past year or so - anything involving clever wordplay was him. He wrote the more amusing press releases they've put out. His role appeared to be far more about being the mouthpiece than doing any actual hacking. In chat logs, they were urging him to write a book. "Spokesman" isn't far off the mark.

Edit: Gawker has written a profile of Topiary http://gawker.com/5825248/

Spokesman or Hacker, in the US they'd use racketeering laws to make him as guilty of each count of hacking as the actual hackers because of his affiliation.  He'd best have a genius of an extradition lawyer.

I suspected that the UK's Serious Organized Crime Agency would have a similar set of charges to bring to bear as the US mafia laws.

Ah, I'd imagine so.  I wasn't aware the UK had such a force.

Is there a Funny Organized Crime Agency too?

Perhaps, since it seems the agency was named by one of Monty Python or that other funny British show.

Wouldn't they name it more like the Moderately Amused But Not Too Witty Organized Crime Agency?

I want to work at the Seriously Sloppy Crime Agency, because going after people who are actually organized is a pain in the ass. I'd spend my day hunting those guys who are stupid enough to leave their wallet with photo ID and a copy of the heist plans at the crime scene. That seems like an appropriate use of my criminalistic talents.

http://arstechnica.com/gaming/news/2011/09/mandatory-ps3-update-removes-right-to-join-in-a-class-action-lawsuit.ars (http://arstechnica.com/gaming/news/2011/09/mandatory-ps3-update-removes-right-to-join-in-a-class-action-lawsuit.ars)

Sony is removing your right to participate in future class action lawsuits.

Not sure thats very different then other devices/companies. Quite sure I have read the whole "only arbitration" thing on many things I have to sign. Blame Lawyers and the decline in being personally responsible/Honorable for your product/services.


http://arstechnica.com/tech-policy/news/2011/04/scotus-rules-att-can-force-arbitration-block-class-action-suits.ars


EDIT: Before I'm misunderstood. Yes, its a shitty thing.

It's a very shitty thing and you've already agreed to it for any service you're signed up for in the US.  Cable, cell phone, warranty agreements... Those are the ones I can think of that I *know* have mandatory arbitration when you sign the contract.

That the PSN agreement didn't have it surprises me more than them adding it.

Well, your Supreme Court only screwed you over a few months ago and made that legal. Big companies need time to implement such changes.

Network is down too. First full hour of free time I've had in days.  :mob:

Sony locks down 93,000 accounts across SEN, PSN, SOE after a password probing attack: http://www.pcmag.com/article2/0,2817,2394549,00.asp

Man, I am just never going to bother buying DLC tc on the PSN...

So, it's affecting people who didn't bother to change their password after the password theft.

Simply signing into PSN after it came back online required you to immediately change your password. Must be people who had multiple accounts/sold their machines/died/etc.

Did it whine if you changed the password into the old password?

Yes.

....and the hacks roll on.

Lulzsec involved?

I don't think Lulzsec still operates (at least as Lulzsec) since at least 3 of them are under arrest.

nod. that's what I thought...

Steam's forums have been taken down due to a possible security breach (http://arstechnica.com/gaming/news/2011/11/steam-forums-down-following-apparent-hack.ars)

EDIT:  Already posted in Steam forum.   :oh_i_see: