Dados pessoais na PSN podem estar nas mãos de piratas.....

[DarkPhoenix]

Mais um enorme, gigantesco, astronómico fuck-up da Sony....

Por via das dúvidas, vou já tomar algumas providências...

Leiam atentamente o comunicado:

Those responsible for the "unauthorised intrusion" that has shut down PlayStation Network for the last week have obtained users' personal information, possibly including credit card details, Sony has admitted.

A new statement published by the platform holder on the PlayStation Blog and currently being emailed to all PSN account holders reads as follows:

"Although we are still investigating the details of this incident, we believe that an unauthorised person has obtained the following information that you provided: name, address (city, state/province, zip or postal code), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID.

"It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained.

"If you have authorised a sub-account for your dependent, the same data with respect to your dependent may have been obtained."

The statement goes on to explain that there is every possibility that users' credit card information may have been compromised as well.

"While there is no evidence that credit card data was taken at this time, we cannot rule out the possibility," it reads.

"If you have provided your credit card data through PlayStation Network or Qriocity, to be on the safe side we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.

"For your security, we encourage you to be especially aware of email, telephone, and postal mail scams that ask for personal or sensitive information. Sony will not contact you in any way, including by email, asking for your credit card number, social security, tax identification or similar number or other personally identifiable information. If you are asked for this information, you can be confident Sony is not the entity asking."

The update adds that Sony hopes "to restore some services within a week". When service does resume, Sony urges you to change your password immediately.

"When the PlayStation Network and Qriocity services are fully restored, we strongly recommend that you log on and change your password.

"Additionally, if you use your PlayStation Network or Qriocity user name or password for other unrelated services or accounts, we strongly recommend that you change them, as well.

"To protect against possible identity theft or other financial loss, we encourage you to remain vigilant to review your account statements and to monitor your credit or similar types of reports.

"We thank you for your patience as we complete our investigation of this incident, and we regret any inconvenience," it continues. "Our teams are working around the clock on this, and services will be restored as soon as possible.

"Sony takes information protection very seriously and will continue to work to ensure that additional measures are taken to protect personally identifiable information. Providing quality and secure entertainment services to our customers is our utmost priority. Please contact us at www.eu.playstation.com/psnoutage should you have any additional questions."

Sony also confirmed that it had employed "an outside, recognised security firm to conduct a full and complete investigation into what happened."

To prevent a similar security breach happening in the future, Sony has also "quickly taken steps to enhance security and strengthen our network infrastructure by re-building our system to provide you with greater protection of your personal information."

http://www.eurogamer.net/articles/2011- ... ompromised

[DarkPhoenix]

Possíveis processos contra a Sony a caminho:

Sony is "unlikely" to face legal action from gamers upset over the PlayStation Network outage – but it is "probably" in breach of the Data Protection Act over the identity theft furore.

The PlayStation Network has been down since last Wednesday – preventing gamers from playing online.

According to Alex Chapman of Sheridans Solicitors, Sony's PSN terms and conditions – which all users must agree to before accessing the service – means legal complaints are unlikely to lead to compensation.

"Our applications are provided on an 'as is' basis," reads the T&Cs. "At times, applications may not be available or may be affected by faults or maintenance work, or by circumstances outside our control. No warranty is given about the quality, functionality, availability or performance of our applications or any content accessed via our applications. We reserve the right to change, suspend or withdraw all or any part of any application and to suspend your access to the application, at any time without notice."

"This is pretty self explanatory and probably protects Sony in respect of the outage," Chapman told Eurogamer.

However, users may have a cause of action through the Unfair Contract Terms Acts.

But to do so they would have to show a number of conditions, including that Sony hasn't provided the service with "reasonable care". They would also have to show some actual loss or damage. All rather unlikely.

Last night Sony addressed those who might be looking for a refund of any associated subscription fees or for any purchased content. "When the full services are restored and the length of the outage is known, we will assess the correct course of action," it said in a FAQ.

The situation intensified last night when Sony confirmed a hacker had stolen personal information and possibly even credit card details, putting millions at risk of identity theft.

It is likely that the huge security leak means Sony is in breach of the Data Protection Act 1998 - and could face claims from those impacted.

"One of the guiding principles of the Act is that personal data must be kept secure and the exposure of the data in this way would likely breach that principle," Chapman said.

The Information Commissioner has confirmed to Eurogamer that it intends to talk to Sony over the data theft.

The fact that user passwords have been "obtained", as Sony puts it, suggests Sony stored user passwords as plain text – and did not encrypt them.

"The Information Commissioner often fines companies for such breaches and affected consumers will also be entitled to bring a claim against Sony," Chapman added.

UK consumer rights group Which? says it's very unlikely that PlayStation owners will have to pick up any costs in the event that their credit cards are used for fraudulent activity.

"Unless you've been involved in the fraud or have been grossly negligent – for example, writing down your Pin and leaving it with your card – the most you can be liable for fraud on debit and credit cards is £50, and this is normally waived," reads an FAQ on its site.

http://www.eurogamer.net/articles/2011- ... h-probable




Isto pode ser um golpe duríssimo para a PSN.
A confiança está de rastos.

[DarkPhoenix]

...
PSN security has been breached server-side and all the information the user entrusts to Sony when signing up to the service has been compromised. Names, addresses, login details, security questions and passwords have been purloined – and while the platform holder isn't 100 per cent sure that credit card details have been stolen, it won't rule out the possibility.

The whole notion that password details have been taken defies belief. There's a reason that most internet sites can't tell you what your own password is and can only reset it – it's because the server itself doesn't actually store it at all. Your chosen password is hashed when it's first transmitted, and only this checksum is stored. When you enter your login, the password is hashed again and compared to what is on the system – if we have a match, you are granted access.

In short, there is no actual need whatsoever for your password to be stored server-side at all. Sony's statement suggests that it was actually storing sensitive information in plain text format, which defies belief. The only other explanation is that hackers only got access to the hashes and may have compromised a small minority of passwords by brute-forcing this data using something like a dictionary look-up. However, from the tone of Sony's apology this does not appear to be the case.

While Sony says there is no evidence of credit card details being accessed, PSN users should be under no illusions that they are in the clear. If email addresses and passwords are available, they can be tested on other sites such as PayPal and eBay – just two potential avenues of fraud on a grand scale. With so many people re-using passwords on multiple sites, Sony's security failure could have severe repercussions for hundreds of other sites.

If hackers have access to your name, address and date of birth, that information on its own is more than enough to cause trouble, and the notion that the security questions may have been compromised too only adds to the severity of the damage that can be done.
...

http://www.eurogamer.net/articles/digit ... ty-scandal


Aconselha-se a mudança de passwords em sites susceptíveis de pishing ( Paypal, Ebay, Hotmail, Gmail, Facebook, etc....... ), para aqueles que usam habitualmente a mesma password ou variantes lógicas da mesma.

[DarkPhoenix]

Demorei uma eternidade, mas mudei uma série de passwords em sites importantes.

Sinceramente, não volto a confiar os meus dados pessoais à Sony...
Acho que quando a PSN voltar ao activo, criarei uma nova conta baseada num novo mail só para jogar na PS3.

[JoaoMX5]

Acessos desconhecidos à minha conta de gmail (igual a da PSN):

Desconhecido China (163data.com.cn:59.56.72.209) 9 Abr
Desconhecido Coreia Do Sul (121.158.55.211) 11 Abr

Enfim...

[Musicslave]

é realmente lamentavel toda esta situação.
é inadmissivel a sony ter um sistema tão inseguro, e ainda por cima demorou uma eternidade a ter real noção da quebra de segurança.

lamentavel tambem existir um grupo de individuos sem mais nada do que fazer, tudo por causa de guerrinhas desnecessárias, isto não prejudica só a sony como tambem a nós jogadores

[DarkPhoenix]

Atenção que não há ainda uma ligação directa entre este ataque, e essa cambada de filhos da p*ta que ameaçaram há dias a Sony.
Isto pode ter sido um puto qualquer numa cave...

O que o mundo precisa é de rever urgentemente a forma de lidar com estes criminosos digitais.
Há que reduzir a idade mínima para imputabilidade, mandar esta escumalha para uma jaula logo a partir dos 14 anos, para um reformatório qualquer ( sem net, claro ) a partir dos 10.
O que não pode continuar a suceder, é que adolescentes com demasiado tempo nas mãos, se divirtam ( faz parte da idade ) a infernizar a vida de milhões de pessoas.

Hoje é a PSN, amanhã é um banco qualquer...
Todos os que já foram vítimas de fraude online, sabem o que custa, a frustração que causa ser roubado por alguém invisível.




Agora a Sony vem dizer que afinal, os dados dos cartões de crédito até estavam encriptados...
Mas nesta altura do campeonato alguém ainda acredita no que a Sony afirma?!?
Perderam completamente a credibilidade, na minha opinião.

Só lhes peço que permitam alterar o mail e password da minha conta.
Caso contrário, mando tudo abaixo ( savegames, trophies, friend list, dlc ) e começo de novo.

Sony has insisted credit card data it stored on users' behalf was encrypted, and it is yet to find any evidence that it was stolen as part of last week's unprecedented PlayStation Network hack.

"All of the data was protected, and access was restricted both physically and through the perimeter and security of the network," communications boss Patrick Seybold wrote on the US PlayStation Blog.

"The entire credit card table was encrypted and we have no evidence that credit card data was taken."

However, Sony reiterated its previous statement, saying it does not know for sure whether credit card information was taken.

"While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility," Seybold continued.

"If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained. Keep in mind, however that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network or Qriocity, and is therefore not stored anywhere in our system."

Sony's latest comment should go some way to reassuring worried customers – but for many who have already cancelled their credit cards, it has come too late.

Adding fuel to the fire, Sony has admitted that personal data – PSN logins, passwords, emails, names and addresses, was not encrypted. Sony confirmed this week that this data had indeed been stolen.

"The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack," Seybold said.

Sony has come under increasing scrutiny for the way it protected the personal data tied to over 70 million PSN and Qriocity accounts.

The fact that user passwords have been "obtained", as Sony puts it, suggests Sony stored user passwords as plain text – and did not encrypt them.

The Information Commissioner's Office plans to talk to Sony about this, and if it finds it is in breach of the Data Protection Act, it may issue a fine.

Elsewhere, Sony offered some tips for those who don't know which credit card they have attached to their PSN account.

If you've added funds to your PSN wallet in the past, Sony said, you should have received a confirmation email from "DoNotReply@ac.playstation.net" at the email address associated with your account.

This contains the first four digits and last four digits of your credit card number. You can also check your previous credit card statements to determine which card was attached to your PlayStation Network or Qriocity accounts.

When the PSN is back online, users will be required to change their passwords, Sony said. "We will provide more details about the new update shortly."

http://www.eurogamer.net/articles/2011- ... -encrypted

[Musicslave]

concordo contigo Dark..
falei no grupo de uma forma generalizada, não sei se são, mas isso é-me indiferente.. o que conta é o enorme prejuízo para as duas partes, so peço que os encontrem e os punam como deve ser
pelo que li a sony vai obrigar a que mudemos a pass quando o serviço estiver novamente online

[DarkPhoenix]

No meu caso, mudar a pass não chega.
A conta PSN está ligada a um hotmail que serve outros serviços, tão ou mais importantes do que a PSN.

Foi uma "asneira" que não voltarei a fazer.

[zepedro_b]

Se eu tiver usado o mesmo email para outros serviços mas a password for diferente continua a existir risco de ter problemas no futuro?

[Wickedbug]

Atenção à ideia de ter sido um puto numa cave qualquer.

Na era em que vivemos a nossa informação pessoal e ainda por cima de cartões de crédito vale muito dinheiro e à todo um submundo organizado que se dedica a obter e vender esta informação. E uma rede com 77 milhões de contas é certamente um alvo apetecível principalmente por, aparentemente, não ter de todo o nível de segurança adequado para a sua dimensão.

[taxman]

A combinação username/password que uso na PSN, apenas a uso noutro site, portanto é só com esse outro que tenho que me "preocupar"?

[Satyr]

Felizmente tive o cuidado de usar um email único assim como a password para o PSN. No entanto tenho vigiado a conta de email. É lamentável esta situação.

[DarkPhoenix]

A combinação username/password que uso na PSN, apenas a uso noutro site, portanto é só com esse outro que tenho que me "preocupar"?

Em princípio sim.

Não esquecer que também a pergunta e resposta de segurança ( usadas para recuperar passwords ) estão aparentemente nas mãozinhas dos criminosos.

Mail + pergunta de segurança + resposta = password

[DaveT]

Recebi hoje o mail oficial da Sony em relação a isto. Pergunto-me se vale a pena cancelar o CC e quem vai pagar isso tudo...