Hackers detected trying to match sign-in IDs and passwords against the PSN

[Mavrick]

Sony has just announced that it has detected someone trying to match "a massive set of sign-in IDs and passwords against our network database".

The company suspects that somebody has got hold of a massive list of usernames and passwords from "another source and not from our Networks", and have been caught checking to see if you use the same username and password on the PlayStation Network.

According to Sony's new Chief Information Officer, Philip Reitinger, "less than one tenth of one percent (0.1%) of our PSN, SEN and SOE audience may have been affected". In raw number terms that means 93,000 accounts names and passwords were "matched" by someone other than the account holder, and as a result Sony has "temporarily locked these accounts".

Those 93,000 accounts will now be forced to reset their passwords. In the case of Sony Online Entertainment customers, users will be emailed instructions on how to re-open their accounts.

Regardless of whether you're one of the 93,000 accounts affected or not, now's a good time to remind you to never, ever use the same username and/or password across a whole range of sites!

We want to let you know that we have detected attempts on Sony Entertainment Network, PlayStation Network and Sony Online Entertainment (“Networks”) services to test a massive set of sign-in IDs and passwords against our network database. These attempts appear to include a large amount of data obtained from one or more compromised lists from other companies, sites or other sources. In this case, given that the data tested against our network consisted of sign-in ID-password pairs, and that the overwhelming majority of the pairs resulted in failed matching attempts, it is likely the data came from another source and not from our Networks. We have taken steps to mitigate the activity.

Less than one tenth of one percent (0.1%) of our PSN, SEN and SOE audience may have been affected. There were approximately 93,000 accounts globally (PSN/SEN: approximately 60,000 accounts; SOE: approximately 33,000) where the attempts succeeded in verifying those accounts’ valid sign-in IDs and passwords, and we have temporarily locked these accounts. Only a small fraction of these 93,000 accounts showed additional activity prior to being locked. We are currently reviewing those accounts for unauthorized access, and will provide more updates as we have them. Please note, if you have a credit card associated with your account, your credit card number is not at risk. We will work with any users whom we confirm have had unauthorized purchases made to restore amounts in the PSN/SEN or SOE wallet.

As a preventative measure, we are requiring secure password resets for those PSN/SEN accounts that had both a sign-in ID and password match through this attempt. If you are in the small group of PSN/SEN users who may have been affected, you will receive an email from us at the address associated with your account that will prompt you to reset your password.

Similarly, the SOE accounts that were matched have been temporarily turned off. If you are among the small group of affected SOE customers, you will receive an email from us at the address associated with your account that will advise you on next steps in order to validate your account credentials and have your account turned back on.

We want to take this opportunity to remind our consumers about the increasingly common threat of fraudulent activity online, as well as the importance of having a strong password and having a username/password combination that is not associated with other online services or sites. We encourage you to choose unique, hard-to-guess passwords and always look for unusual activity in your account.

http://blog.eu.playstation.com/2011/...=Google+Reader

[Shin-Ra]

Good to see PSN can detect and automatically shut down accounts affected by these login-match intrusions. I believe this is what's happened to a number of XBL accounts in the last couple of months, with DLC/memberships purchased with the intention of account sale.

[kx11]

well i don't want anyone looking at me , i didn't do it

[slick1ru2]

Originally Posted by kx11

well i don't want anyone looking at me , i didn't do it

Not according to Sony, roflol.

[Steedeel]

Further reason to ensure a download only console should be decades away!

[DavePS3]

Frickin' monkeys need another hobby that trying to hack systems. Get out of your parent's basement and get a girlfriend for God's sake!!!

[kx11]

Originally Posted by Steedeel

Further reason to ensure a download only console should be decades away!

like tablets ??


tablets will kill consoles

[slick1ru2]

Originally Posted by Steedeel

Further reason to ensure a download only console should be decades away!

Like that makes any sense at all.

[slick1ru2]

Originally Posted by kx11

like tablets ??


tablets will kill consoles

He thinks physical media will be around for 50 years.

[kx11]

Originally Posted by slick1ru2

He thinks physical media will be around for 50 years.

10 years from now we won't see anyone publishing them

DL only is the way to defeat piracy ( on consoles )

ofcourse nintendo will use dvd5 in 2021

[Steedeel]

Originally Posted by kx11

10 years from now we won't see anyone publishing them

DL only is the way to defeat piracy ( on consoles )

ofcourse nintendo will use dvd5 in 2021

Your kidding right?

[Steedeel]

Tablets have about as much chance of killing consoles as the globe having fibre-optic super fast connections by 2020! In other words, no chance in my opinion.

[dwane5]

Originally Posted by DavePS3

Frickin' monkeys need another hobby that trying to hack systems. Get out of your parent's basement and get a girlfriend for God's sake!!!

nice icon, what movie?

[Rike255]

Very interesting, I wonder which site(s) were compromised? Glad to see they caught this incident, dealt with it, and reported it so quickly. I changed my password two days ago so I'm definitely safe!

[RiseDarthVader]

Originally Posted by DavePS3

Frickin' monkeys need another hobby that trying to hack systems. Get out of your parent's basement and get a girlfriend for God's sake!!!

Oh great he comes the insults implying every hacker lives in their parents basement and doesn't have a girlfriend. Did you like it when gamers were generalised the same way? Or when the mainstream media was calling video games a kids toy? I'm not a hacker and I'm not interested at all in getting into a debate on whether what they do is ethical or not I just hate it when people generalise hacker like that.

[AutomaticDriver]

Originally Posted by kx11

10 years from now we won't see anyone publishing them

DL only is the way to defeat piracy ( on consoles )

ofcourse nintendo will use dvd5 in 2021

No offense. But we can not predict the future.

Its like this. Look at CDs and digital music. After 10 years, I can still choose to buy a CD or download it off iTunes. If DLs wiped out CDs 100%, then you could have used that as more padding to your argument.

But since that has not happened. I dont see how you can say that games and movies will go DL only. If it has not happened with music, what makes you so sure it will happen with this other stuff?

[Ite]

Not these annoying no life nerd hackers again.

[blu-mike]

Originally Posted by Ite

Not these annoying no life nerd hackers again.

Revenge of the Nerds - NERDS! - YouTube

[Mavrick]

Sony: stolen user/pass info not from us

It was "simple math" that told Sony the data used to illegally access 93,000 accounts recently was not taken from Sony's network.

There were a lot of attempts but relatively few successes. Had the username/password combinations been taken from Sony, the pass-rate would have been higher.

"It's just simple math," Sony Online Entertainment president John Smedley told GameSpot.

"There was such a small percentage of successes. They were attacking with a large number. Because of that, the math tells us it wasn't [Sony's information].

"We've said publicly when we were compromised before that the information is out there and could have been used. That was obviously the first thing we looked at. Then we did the mathematical analysis and said, 'Obviously that's not what happened.'

"I'm not going to say it's impossible [the info came from Sony]," Smedley added, "we just think that's not the most likely case."

Smedley revealed that "a great number" of accounts targeted were "dormant". That is, accounts with log-in details unchanged since the Great PlayStation Network ID Theft of April 2011.

"We really strongly encourage users to change their passwords," Smedley said. "We can't force them to log in and do that.

"A great number of these accounts they were going after were dormant accounts. Those people in many cases had not yet done their password change. It takes some work to get them to focus on that."

Sony locked the 93,000 compromised accounts once aware of what was going on. A tiny fraction of those accounts were reported to have shown any activity prior to being locked. Exactly what the accounts were used for once illegally accessed is still being assessed.

Sony's head of security reassured users that even if you have a credit card associated with a Sony account, the number on that card is "not at risk".

Of the 93,000 accounts illegally accessed, 60,000 were PlayStation Network / Sony Entertainment Network accounts, and 33,000 were Sony Online Entertainment accounts.

EG

[Terjyn]

Originally Posted by 3DForLife

No offense. But we can not predict the future.

Its like this. Look at CDs and digital music. After 10 years, I can still choose to buy a CD or download it off iTunes. If DLs wiped out CDs 100%, then you could have used that as more padding to your argument.

But since that has not happened. I dont see how you can say that games and movies will go DL only. If it has not happened with music, what makes you so sure it will happen with this other stuff?

You can go back further actually with the advent of digital mail. Email has now been around for 40 years, and while people predicted the death of snail-mail, it's not even close to disappearing entirely.

I personally don't know of an example of a digital market killing off a physical one, although I don't doubt there's some niche products out there somewhere.