Sony's password reset system for the restored PlayStation Network has been taken offline.
Sony's password reset system for the restored PlayStation Network, which was
taken down by hackers last month and has only recently
returned to full functionality, has been revealed to have further vulnerabilities of its own.
Sony has been forced to take down some websites in order to fix the vulnerability, which could allow hackers to change users' passwords and gain access to their accounts.
The vulnerability is based around the password reset system, which requires the email address the PSN account is linked to and the date of birth for the user - information which was compromised in the initial attacks and was not encrypted.
Eurogamer claims to have seen video evidence of the vulnerability being exploited.
'
Unfortunately this means that those who are still trying to change their password via Playstation.com or Qriocity.com will be unable to do so for the time being,' Sony said in an official statement.
'
In the meantime you will still be able to sign into PSN via your PlayStation 3 and PSP devices to connect to game services and view Trophy/Friends information.'
Users are advised to change the passwords associated with their email accounts, to be on the safe side.
Let us know your thoughts in
the forums.
17 Comments
Discuss in the forums ReplySince the hackers supposedly got the source code as well as the user data they will have the necessary keys for any encryption. All Sony had to do was change their keys add a line of code to encrypt user data, iterate through it all and then force a password reset on ALL user accounts thus preventing any hackers from making use of pre-existing keys or passwords and all their users would then just have to confirm via a link in an email to then change their password to something they would remember.
All elementary stuff tbh.
But what do I know? I certainly don't make the kind of money those in Sony's digital security department make, so surely they know what's best, right? Right?
Yes, there's heaps to love about security breaches and millions of people having their private details exposed and their accounts compromised.
@SNIPERMikeUK : PSN store was always going to be delayed (31st of may deadline)
/QUOTE]
I think hackers prefer the low hanging fruit. Developers of Securom, etc. - it was always possibility they might become a target one day...
iTunes is secure btw.
Agreed but this should serve as a warning to other corporations not to mess with hackers too much & sony clearly underestimated what they could do thinking they could handle a determined force, which from my viewpoint looks like they can't especially after them holding their hands up & saying they can't guarantee users security, this says to me they were using the best security available & they still knocked it down.
But it is a scary thought of what could be done if master hackers got together for criminal stuff or deeply bad things .
Or yes it could simply be an inside job, guess we'll never know.
There are hackers and then there's organized crime. The worst part about online databases, is that once your data is out there, you have zero control. For example, who here has ever tried to close their PayPal account? I have,upon finding out that my PayPal account details were leaked. And to close my account, they wanted me to give them my bank account details! And I was like... To close my unused PayPal account after finding a breach in their security, where spammers started spamming me with details that had only ever been given to PayPal, I had to give Pay Pal my bank account details.
And I still wonder how the hell this breach in Pay Pal's security never made headlines. I guess there's the heavy rollers, and then there's Sony.
Only a fool would say they have 100% full proof security. Not only would it be untrue it would make you the number 1 target for any hacker/s wanting to make a name for themselves.
I know this but apparently sony didn't or were just too arrogant.