Sony Assures Credit Card Data Was Encrypted

[mireko]

This is just more spin. Trying to counter the devastating implications of this: http://lo-ping.org/2011/04/26/psn-hacker-chat-logs/ (where the "users" seem to be indicating that the info was not, in fact, encrypted).

Why counter it? Because they're potentially liable for billions.

Oh, that story again. Says nothing about how the PSN stored user information. The threat they're outlining is that someone could steal this information as it's being transmitted from a PS3 to the PSN if you're on a CFW that someone has really fucked up.

A document written by the hackers has clarified what they did and what privacy and security risks they believe the PlayStation 3 poses. The PS3's connection to PSN is protected by SSL. As is common to SSL implementations, the identity of the remote server is verified using a list of certificates stored on each PS3. The credit card and other information is sent over this SSL connection. So far so good; this is all safe, and your web browser depends on the same mechanisms for online purchases.

The concern raised by the hackers is that custom firmwares could subvert this system. A custom firmware can include custom certificates in its trusted list. It can also use custom DNS servers. This raises the prospect of a malicious entity operating his own proxies to snaffle sensitive data. He would distribute a custom firmware that had a certificate corresponding to his proxy, and that used a DNS server that directed PSN connections to the proxy. His proxy would decrypt the data sent to it, and then re-encrypt it and forward it to the real PSN servers.

Such a scheme would be transparent to PSN users (except for any potential performance reduction caused by the proxying), and would give the attacker access to all the information that the PS3 sends to Sony. This information is shown to be extensive, but apart from the credit card data, probably not too sensitive or unreasonable.

As flaws go, the risks here are not substantial. There is no generalized ability for hackers to grab credit cards from PSN users; only those using specially devised custom firmwares would be at risk. Essentially the same risk could be faced by anyone downloading a pirated version of Windows: extra certificates could be added to those normally trusted, along with suitable DNS entries, to allow interception of any traffic destined for, say, amazon.com. In practice, the risk of either of these is slight, and in any case, trivially avoided: don't use custom firmware.

Ars

Ars was pretty alarmist about that whole thing too, until someone in the comments actually put it to the test and provided the information with which they updated the article.

Obviously, someone did grab credit card and user information anyway, but it wasn't a result of how the PS3 sent this information to the servers. Until we get some clear explanations from Sony about the attack (ha ha), we can't just assume they had this stuff in plaintext.

 

[meece]

Actually I can't help but applaud them "Keep in mind, however that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network."

How much guts does that take to say to a horde of angry people? Impressive, true, and admirable as opposed to hoping people don't notice they never asked for it.

This can happen to anyone and yes, you're in more threat from your average card reader in a restaurant/store I reckon then a company like Sony being hacked.

 

[EchetusXe]

*Checks bank account online.*

Several hundred pounds spent on online pornography.

Nothing out of order there then. Maybe the hackers haven't tried using my information yet.

 

[SharedProphet]

Ah, I read the article before it was updated, and didn't actually read it again when I linked it.

 

[Asehujiko]

The Q&A states: "While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken,

Might want to file this under the "utter bullshit" category and update the article: http://arstechnica.com/gaming/news/...ing-stunning-lack-of-credit-card-security.ars
Sure, the data may be safe it's on the server but that didn't keep the idiots from putting it in unencrypted urls on their logs and it shows:
http://arstechnica.com/gaming/news/2011/04/ars-readers-report-credit-card-fraud-blame-sony.ars

 

[midpipps]

Just yesterday it was revealed by their own security experts the cards were kept in plain text. Wtf is going on.

Do you have a link to this I would love to read that. Cause that is web transaction 101 if they really did store them as plain text then they are definitely negligent in this aspect.

I'll dig it up, people are already using the stolen info which indicates there was 0 encryption involved.

I can see it but I think it is a little bit of jumpin to conclusions. Considering last year 10 million people were affected by identity theft of some sort 26% of that being credit card fraud. so say 2.6 million people credit card fraud. divide that by 8765.81277 hours that is 296+ people being hit by credit card fraud every hour. or approximately 5 people every minute so you tell me the possibilities that these could be coincidences.(This is just US stats)

Like I said I am not saying that they have not been compromised and this is not in direct relation to the PSN issues. But you put up a website get 77 million people connected to it with a percentage of that with cc numbers on your site. then put out that your data has been compromised and that the cc numbers may have been compromised and see how many people start checking their accounts or correlate that warning to a recent cc fraud issue.

 

[Trogdor1138]

*Checks bank account online.*

Several hundred pounds spent on online pornography.

Nothing out of order there then. Maybe the hackers haven't tried using my information yet.

I lol'd.

But seriously, only a fool spends money on porn now, especially online, what the hell man?

 

[SovietSecrets]

This is just more spin. Trying to counter the devastating implications of this: http://lo-ping.org/2011/04/26/psn-hacker-chat-logs/ (where the "users" seem to be indicating that the info was not, in fact, encrypted).

Why counter it? Because they're potentially liable for billions.

Man if those logs are legit that would be fantastic.

EDIT: If whoever did this got the credit card info...Oh Sony boy, the pipes, the pipes are calling

 

[GonzoGamer]

That is releaving to here.

Though I still plan to change my card...Just in case.

You don't even need to change your card. Why put another one in danger?
The credit card is insured.
Unless it's your debit card but you shouldn't use that for anything other than an ATM.

What worries people is the idea that the hackers (or whoever buys the info) will be able to take out new credit cards & loans under our names.

This news doesn't really make me feel any better.

 

[mireko]

The Q&A states: "While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken,

Might want to file this under the "utter bullshit" category and update the article: http://arstechnica.com/gaming/news/...ing-stunning-lack-of-credit-card-security.ars
Sure, the data may be safe it's on the server but that didn't keep the idiots from putting it in unencrypted urls on their logs and it shows:
http://arstechnica.com/gaming/news/2011/04/ars-readers-report-credit-card-fraud-blame-sony.ars

You may want to actually read the article you linked before calling bullshit. If you had, you would maybe have seen this:

"As flaws go, the risks here are not substantial. There is no generalized ability for hackers to grab credit cards from PSN users; only those using specially devised custom firmwares would be at risk."

A commenter cleared it up:

Spoiler: It is a pretty long post, so I'm putting it behind a spoiler.

So there's very little good info floating around on this, and the paper in question is really lacking on details and good info.

The .pdf that is going around outlining this issue is here:
http://demo.ovh.com/download/e1ae850ae7 ... 20/psn.pdf
(from: http://streetskaterfu.blogspot.com/2011 ... -user.html)

The section on "sensitive information" seems to contain a lot of filler, and doesn't make too much sense. He claims that Sony uses HTTPS/SSL, but that this "isn't good enough". He then goes off topic about how Sony is a large network and that the ip addresses of this large network are all publicly accessible. This is all true, but does not contribute to his argument that the information is not secure.

Let's get to the HTTPS/SSL issue.

When an SSL session is negotiated by your PS3 with Sony's servers, you fetch a certificate from the PS3 server that is authenticated against a CA, verifying that the server claims to be who it says it is. In that certificate is the server's public key, which is used by the client to encrypt information to send to it. Information cannot be decrypted by the public key, only by the server's private key, which only it possesses.

So the information being sent to Sony is encrypted, and it's using SSL, the accepted standard for banks, remote terminal sessions, your gmail, and generally anything else of importance. There are no current flaws in this protocol when implemented correctly.

The ability to forge a client certificate on the PS3 weakens this somewhat, but not directly, and the paper fails to describe this. But I think I can identify what he's trying to get at.

The PS3 needs to have a trusted root certificate from a Certifying Authority (CA) stored in the console in order to verify that when contacted by a system claiming to be a Sony PSN server, it can verify that is really is a PSN server. (This is the same mechanism that identifies your bank to be who they claim to be.) The ability to create custom firmware (CFW) means that a hacker could distribute a CFW that possesses an altered, additional, or different trusted root CA.

Recall whenever your web browser gave you an alert upon finding an expired certificate, or probably more appropriately, a self-signed certificate. If you're using HTTPS on a home router, you probably have one of these. Since there is no pre-loaded root CA on your system, you need to decide if you can trust it yourself.

By having a CFW loaded, you're never prompted for this, and unless you audit the code yourself, you won't know if there's other root certificates loaded. Any that are loaded are assumed trusted.

Here's where we get to the "third-party DNS" that he mentions. Assuming you're not running your own DNS server (to say nothing of if it's secured) it is possible that the DNS server you connect to could be spoofed to identify a Sony PSN server's host name as a different IP. At that point, assuming you're running a CFW that has a crafted root CA loaded, the PS3 will recieve the spoofed address, the altered certificate will identify the server as legitimate, and a connection will be established. Voila, your information is being sent.

So the short of this:

- Your information is not being sent in the clear, but is being sent via industry standard HTTPS/SSL.

For an attack to succeed:
- An attacker must persuade you to load a CFW that has a self-signed root certificate loaded on it
- the attacker must successfully poison the DNS cache of a DNS server that YOU use
- the attacker must then wait/hope/pray that you connect to the server he spoofed so that you can authenticate to him.

That, ladies and gentlemen, is a pretty tall order, though it's by no means implausible. But it is the sort of issue that gets a lot of attention these days (and is a large part of the reason why certificate validation has become so visible in web browsers as of late.)

So if you're not using a CFW, then you're pretty safe. If you are, then you need to ensure that no other forged or crafted root CAs exist, and that you are using a relativity secure DNS server. In my opinion, any DNS server by a major ISP should be more than sufficient.

In other words, this probably isn't relevant to the hack.

But really, why would it be? This information was stolen from the PSN servers themselves, not from decrypted user connections. They "may" have got all 77 million accounts, so they must have gained access to the main network.

This is just more spin. Trying to counter the devastating implications of this: http://lo-ping.org/2011/04/26/psn-hacker-chat-logs/ (where the "users" seem to be indicating that the info was not, in fact, encrypted).

Why counter it? Because they're potentially liable for billions.

Man if those logs are legit that would be fantastic.

EDIT: If whoever did this got the credit card info...Oh Sony boy, the pipes, the pipes are calling

Legit? Probably. Completely unrelated to the hack? Very probably. Only a threat to people on shady CFW? Yes.

 

[TheAmokz]

http://www.sankakucomplex.com/2011/04/28/psn-victims-report-credit-card-fraud/

Does not look like encryption made any difference...

 

[Asehujiko]

You may want to actually read the article you linked before calling bullshit. If you had, you would maybe have seen this:

"As flaws go, the risks here are not substantial. There is no generalized ability for hackers to grab credit cards from PSN users; only those using specially devised custom firmwares would be at risk."

You know where those URL's go? To server logs.
You know how Sony finds custom firmware users? By checking their logs for any BS transactions.
You know what was compromised in the attack? The entire server, logs included.
So yes, CC data was compromised.

 

[MattAn24]

This Q&A was released on Sony's blog a day ago.
Kinda late in reporting this.

Just like Sony!

Um, not quite. Considering, as I've stated several times, the PlayStation blog has been regularly updated all week. The Escapist just reported what they wanted to report. Your problem for not reading it for yourself.

 

[irani_che]

the main question here is how good can the encryption be?
these hackers dont mess around, they already hacked the god damn PSN network, somehow your 256 bit encryption doesnt look that tough

 

[Quiet Stranger]

And that makes it better?

 

[oldtaku]

'encryption' means very little unless they give you the specifics. Was it something industrial strength like rot-13?

Also keep in mind that Sony used that info when you made a credit card purchase on PSN, so they had an automated way of decrypting it. Whoever was inside had access to that too, so it could be the best damn encryption in the world but that doesn't matter if you have the keys.

Edit: But there is some bright news here. Sony says they didn't have the CVV2 codes stored, which makes the info slightly less dangerous.

 

[subtlefuge]

I still want to know the scale of the attack. Was it one hacker? 10? 100?

The idea of one hacker sitting on a mountain of information is amusing, but for Sony's sake that better not be the case. Nobody will forgive them for anything less than an Ocean's 11.

 

[perabalaofmystery]

bah encription means nothing. encriptions can be broken. i went and changed my cards asociated with sony. and grah so dissapointed in sony first they become asses with the goehot case.
nowe they screw up royaly. it also sucks i have a psp go so no new games for new games for awhile. if ever i don'/t even know if i would continue buying sony products. though i do want the new dissida game.

 

[bob1052]

Keep in mind, however that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network."

So I guess that you requesting it every time I want to buy something from the Playstation Store doesn't count? Don't lie, Sony.

If they requested it every time, wouldn't that mean they weren't storing it?

Im gonna call it now. Nobody is going to believe this, because everyone is too angry at sony to be logical.

Nah, nobody is going to believe this because Sony has changed their story with regards to this incident more than most people change their underwear. There's no way to know if this one is finally the truth or if tomorrow we'll get another story which also may or may not be the truth.

They actually haven't. The reason everyone is crying that they took forever to report that stuff was taken is because they are taking their time and not announcing anything until after they are sure that the announcement has happened. How can you complain that they are constantly changing their story when everyone is complaining that they aren't even giving out their story.

It sounds more like anti-Sony people are changing their interpretation of the story more than most people change their underwear to justify their blind rage.