Why are Sony getting more hate than the actual hackers?

[OldGus]

Right this is seriously getting on my nerves, why are people directing all their hate about this PSN hack towards Sony and not the people who hacked PSN and took their details. Sony didn't choose to get hacked so why are they being blamed for it. Yes their security could have probably been better but surely any security system is hackable anyway. Maybe I'm wrong about this whole thing, I don't know, I just think all the Sony hate is a bit unreasonable. What are your opinions on this?

People don't hate Sony because they got hacked, people hate Sony because of how Sony handled the situation of their being hacked.
Consider how the reaction would be different with these different responses by Sony:


A. Straight-forward and immediately honest/responsible: 5 minutes after they find out they've been hacked, a message comes through with a system update- "This is Sony, PSN has been hacked, and sensitive information might have been compromised. We will keep you updated as we find out more information, in the meantime, keep an eye on your personal information and (possibly) credit card accounts."


B. Delayed, honest, and helpful: Some time later, maybe 4-5 days tops, or as soon as they figure out a bare minimum that maybe 10% of their customer's information (Still a lot) was compromised: "Our security was breached on this day. The hackers are as of yet unknown, but we are working on tracking them down. We discovered that this minimum level of compromised information blah blah blah on this day. We would like to ask you to keep an eye on your personal information, your credit and banking accounts, etc., as we will be collecting this information for a class-action lawsuit we will have our legal department file on your behalf. We are currently working together with (X investigative group) to determine who perpetrated the hack and what damages they have caused. We will keep you informed."

C: Irresponsibly delayed, but with good news: "We were hacked on this day (X) weeks ago. This information was compromised. Our private investigations have led to the conclusion that this group hacked our network. Please go to our website for information on how you can claim damages in a class-action lawsuit against them."

D: The Shadow Corporation response: They actually say nothing to their customers, once they detect a breach they immediately encrypt or scramble customer information on the server, as they can reboot it from a non-networked backup database updated weekly. In the meantime, customers experience some servers being down that will be written off as maintenance. Sony tracks the hackers down and does nasty, nasty, non-public things to them, such as uploading a hard-drive burning virus onto their computer, quietly reporting them to the authorities, or other similar nasties.

E: Their real response. "So, about a week ago or so, there was a possible security breach detected. It was confirmed on the 19th, and the servers were shut down for several days so we could find the extent of the breach. By the way, we had a suspicion from the beginning that there was a chance some of your personal information was stolen, and pretty much all your personal information that you put on your account is compromised." And succinctly finished with an unspoken "Good luck!"

The average response in all of those cases would be, excluding the obvious extremes:

"Oh Shit!!! Thanks for letting me know!"

"Well, there's a good chance I'm boned, you boneheads, but thanks for the help, at least you're willing to do that."

"HEY! You really should have told me sooner. I guess good job catching the guys, but still."

No response because no one will find out, except a few people on the internet who may be written off as conspiracy nutters. In the case of the people who do find out, the responses will range from "You're not the Goddamned Batman!" to "Uh... I'm more scared of you than the US Government and terrorists combined now, thank you very much." to "Oh god, they're coming after me next!"

Do I really need to write the real life average response? As I said before, they aren't angry at Sony for letting themselves get hacked as much.

I realize how unlikely it would be to get the hackers taken to court, as from all appearances, cyber-law and computer forensics are still respectively still in its infancy and treated like such. That being said, at least saying they were doing that would make a lot more people a lot less angry.

 

[kortin]

-shrug- people are stupid.

(I've found this response works perfectly for almost any question that involves people)

 

[OldGus]

1. Human error
2. Lack of security policy/procedures
3. Failure to enforce/adhere to 2
4. Using systems with known security flaws

Those are what cause system compromises and all of them can be avoided. The fact they were not is COMPLETELY Sonys fault.

1. Agreed
2. Agreed
3. Agreed
4. To be honest, every system designed to network or interface in some way with external software either has security flaws known to someone other than the user, or that will eventually become known through the life of the system, excluding completely home-built and programmed systems distinct from anything else online (which if they are capable of going online, is very unlikely). Its a big reason some ex-hackers can make money by offering to try to hack a company's system and reporting the holes they find.

I will agree that there are ways to reduce the risk of a system being hacked, but there are almost no ways to completely eliminate that risk as long as it is able to download information from an outside source, especially if that information can be accessed or added remotely. A system like PSN by its nature (and arguably the same for XBLA,) must do exactly that.

 

[InsanityRequiem]

Time to post a letter I received from my health insurance company! Spoilered for space and for those that really care.

March 14, 2011 was when I received the letter.

Spoiler

Dear LordofInsanity,

We are writing to inform you of an incident involving personal information of certain former and current Health Insurance members.

On January 21, 2011, Data Protection Company, which handles HI's data center operations, notified HI of an information security incident. Specifically, DPC informed us that the company could not locate several hard disk drives that had been used in HI's corporate servers and that DPC was handling on behalf of HI. We promptly began an investigation of the incident, which is continuing. Based on our investigation, we have reason to believe that information that pertains to you is included on the hard disk drives. The information included details such as your name, address, health information, Social Security number and your financial information. We are writing to tell you about the incident out of an abundance of caution and to call your attention to the steps you may take to help yourself.

So, lets look at this. March 14, me and my family all received separate letters regarding stolen information. Said stolen information was FOUND OUT on January 21, nearly two entire months. How long was that information missing before?

Two months before that, as in November of 2010, me and my entire family was getting fraud attacks, me getting hit the worst. So we're looking at least 4 months before I, and the other members of the health insurance company, received these letters.

Several hard disk drives, which could contain thousands, potentially millions of personal information.

Sony? Not even one week before they let people know. I mean seriously, one week isn't even enough time to cypher through all that information that was supposedly taken.

The hackers-mix-identity thieves should be destroyed.

Less than a week and people know. They have a much, much better ability to not get fraud attacks against them.

 

[Elamdri]

Spoiler: snip

Time to post a letter I received from my health insurance company! Spoilered for space and for those that really care.

March 14, 2011 was when I received the letter.

Spoiler

Dear LordofInsanity,

We are writing to inform you of an incident involving personal information of certain former and current Health Insurance members.

On January 21, 2011, Data Protection Company, which handles HI's data center operations, notified HI of an information security incident. Specifically, DPC informed us that the company could not locate several hard disk drives that had been used in HI's corporate servers and that DPC was handling on behalf of HI. We promptly began an investigation of the incident, which is continuing. Based on our investigation, we have reason to believe that information that pertains to you is included on the hard disk drives. The information included details such as your name, address, health information, Social Security number and your financial information. We are writing to tell you about the incident out of an abundance of caution and to call your attention to the steps you may take to help yourself.

So, lets look at this. March 14, me and my family all received separate letters regarding stolen information. Said stolen information was FOUND OUT on January 21, nearly two entire months. How long was that information missing before?

Two months before that, as in November of 2010, me and my entire family was getting fraud attacks, me getting hit the worst. So we're looking at least 4 months before I, and the other members of the health insurance company, received these letters.

Several hard disk drives, which could contain thousands, potentially millions of personal information.

Sony? Not even one week before they let people know. I mean seriously, one week isn't even enough time to cypher through all that information that was supposedly taken.

The hackers-mix-identity thieves should be destroyed.

Less than a week and people know. They have a much, much better ability to not get fraud attacks against them.

First, while one week was certainly a lost faster than the time that it took your insurance company to let you know, I still think they waited too long, and since it was MY information that got stolen, I think I'm the one who gets to decide that issue.

Second, the fact that it WAS stolen is reason to be upset. Sony didn't encrypt their data and they knew their system was vulnerable, quite frankly I think that's reason enough to be upset with them.

 

[Mercsenary]

http://www.gamesradar.com/f/why-you-shouldnt-blame-sony-for-the-psn-mess-and-why-you-really-really-should/a-20110427114345836073

This sums up my feelings nicely.

Don't blame them for being hacked...but...the other shit. YEAH.

^ This.

Any large company can get hacked. I mean hell you hear about it all the time. So and so credit card consumer group was hacked. X amount of card numbers may be compromised.

It happens. People can moan and btch about it. But they cancel their card and get a new number and watch their accounts.

They release this information. "Shit. We fcked/got fcked up. Watch your accounts people."

Sony's response? "Shh. Say nothing." "EVERYTHING IS FINE PEOPLE JUST A OKAY. Some maintence trouble that's all."

And when it comes out that personal information is compromised you do not keep that crap down low. You want to get that out and tell your consumers that their crap is out there. Keeping it hidden only inspires consumer avoidance. Not loyalty.

We're not stupid Sony. We know how to watch our accounts.

 

[cookieXkiller]

To hate something, you need a name and a face.

Sony has a name. Sony has a (metaphorical) face.

An anonymous hacker does not.

Plus, they botched the whole thing massively.

My thoughts anyway.

ninja'd
dont think it can be said better.
so happy I only have an xbox 360

 

[Callate]

1) No one, at least no one outside of Sony at this time, knows who the hackers are.
2) Sony is the company that chose to collect the data the hackers have accessed.
3) Sony is a major digital information company, and thus should have been prepared for the fact that
3a) Hackers attacking digital information companies is approximately as predictable, in a long-term, general sense, as rain.
3b) In the sense that someone, somewhere would have tried to hack the PSN (in fact, many probably have tried), Sony could have been better prepared for this eventuality...
4)...If not in a digital security sense, than at least in as much as letting their customer base know their information had been compromised.
5) This is not the first customer-unfriendly decision Sony has made, nor even the first they've made in the last year.

All this said, I don't hate Sony (possibly in part because I'm not a customer of the PlayStation Network). But boy, I won't pretend I don't get it if people do.

 

[sheic99]

Either way, Sony can't genuinely be blamed for it. It can be just 1 line of code out of 1 billion that brings down a system.

This just blows my mind. It's disturbing that people can think this way.

Of course Sony can be genuinely blamed for it. This "everything can be hacked" attitude people have needs to go. Of course IT systems are very complex, and having a 100% secure system is probably a pipe dream. But you can make your systems prohibitively difficult to break into. By and large, most of the headline hacking incidents involve unsecured systems (and increasingly, social engineering), not some genuis hacker finding some fiendishly obscure backdoor. Having the entire database stolen raises some red flags.

By your logic, any company that loses customer data to hackers can just wash their hands and say "sorry guys, 1 line in a billion".

Of course people hate the hackers. They're the criminals, they stole the information, that's a given. But none of us gave our info to Sony expecting hackers not to hack. We gave it to Sony expecting Sony to keep it secure.

And yes, Sony have confirmed that the entire personal information dataset was kept unencrypted. Failing to at least hash passwords would be poor practice for an amateur web developer, let alone a multi-national corporation. This isn't just some obscure code vulnerability, this is a serious failing of security practices. So yeah, I will quite happily hate on Sony for failing to do what companies like Microsoft, VISA, Amazon, and countless others have managed to do for quite some time now: keep the majority of their customers' information safe.

I would appreciate if you quote me correctly next time.

 

[Frostbite3789]

Sony didn't leave the data unprotected in the bad part of town.

It's the internet. There is no good part of town.

That being said, I really don't play Sony at all, as a PS3 owner.

 

[FalloutJack]

Unpleasable fanbase, of course.

People whine and cry, ***** and moan, all the ever-loving time when something doesn't go their way. And do they care who gets the blame? They will blame ANYONE (including the victim) because they are {A} pissed off and {B} without any real sense of proportion.

I, for one, don't rightly give a damn. I feel bad for Sony, but nothing I had on there was at risk anyway.

 

[Sparcrypt]

4. To be honest, every system designed to network or interface in some way with external software either has security flaws known to someone other than the user, or that will eventually become known through the life of the system, excluding completely home-built and programmed systems distinct from anything else online (which if they are capable of going online, is very unlikely). Its a big reason some ex-hackers can make money by offering to try to hack a company's system and reporting the holes they find.

Correct, but that then falls down to points 2 and 3 - if they left out third party testing on their software that also falls into the catagory of their fault. I work in IT - this is something that is done regularly against our systems.

Also serious security holes are patched within days of their discovery, if not hours. Not keeping up with security patches would also be their fault.

They should also be using multiple layers of security - that way if a vulnerability is discovered in one then they might get through that layer, but then they get stuck at the next one. As long as all layers are maintained correctly and you have enough of them then the odds of them all being compromised are basically zero. It is the responsibility of Sony to make sure there are enough layers of security.

I will agree that there are ways to reduce the risk of a system being hacked, but there are almost no ways to completely eliminate that risk as long as it is able to download information from an outside source, especially if that information can be accessed or added remotely. A system like PSN by its nature (and arguably the same for XBLA,) must do exactly that.

This is where multiple layers of security come in again. Lets look for instance at the sign up process to an online service. They take info from the user and store it - thus creating an potential security risk. So what can they do?

1. Run checks on the data from the console for validity before sending it to the servers (formatted correctly etc - this will stop the risk of code injection).

2. Run the same check server side - this means they have to compromise the local checking of data and THEN get the server to accept it.

3. The data will be stored by a process - this process has the permissions of the user who executed the process. Create a specific user for this purpose and restrict their access to being able to do nothing other then take the data and put it into the database. This way even if you get past 1 and 2 and make this process run some code it will only run with the permissions availible to the process it runs as.

4. Now for anything to happen the code that was run needs to be an exploit of its own that grants privileged account access. This means you need knowledge of the server - what OS is it running? What services and what versions of those services? Do they have any known exploits that could give you more access? If you don't know this stuff you've got no hope of getting any further, unless you can find it out by using your previous code execution on the database process. If it's set up right you can't.. but even if it's not..

5. Log everything and check those logs. This way you will see the database process running commands it shouldn't, or at least trying. When it happens, you go find out why.

Now I did skip a bunch of other things you'd do in that situation, however basically, noone is going to break in using that form. If however there was no data checking and a badly set up database that hadn't been patched running as the root user? That server would be compromised in about 10 minutes.

THAT is the kind of thinking that needs to go into every aspect of services like the PSN. Anything else is just idiotic.

I've heard how exactly the PSN was compromised, but haven't confirmed it so I won't comment there.. however I can say that if what I heard was true then it was COMPLETELY their fault and could have been easily prevented.

 

[Death God]

Because people feel Sony didn't protect their information well enough against the hackers. But I do agree with you. The hate needs to be spread more evenly among the two if anything.

 

[Frostbite3789]

Time to post a letter I received from my health insurance company! Spoilered for space and for those that really care.

March 14, 2011 was when I received the letter.

Spoiler

Dear LordofInsanity,

We are writing to inform you of an incident involving personal information of certain former and current Health Insurance members.

On January 21, 2011, Data Protection Company, which handles HI's data center operations, notified HI of an information security incident. Specifically, DPC informed us that the company could not locate several hard disk drives that had been used in HI's corporate servers and that DPC was handling on behalf of HI. We promptly began an investigation of the incident, which is continuing. Based on our investigation, we have reason to believe that information that pertains to you is included on the hard disk drives. The information included details such as your name, address, health information, Social Security number and your financial information. We are writing to tell you about the incident out of an abundance of caution and to call your attention to the steps you may take to help yourself.

So, lets look at this. March 14, me and my family all received separate letters regarding stolen information. Said stolen information was FOUND OUT on January 21, nearly two entire months. How long was that information missing before?

Two months before that, as in November of 2010, me and my entire family was getting fraud attacks, me getting hit the worst. So we're looking at least 4 months before I, and the other members of the health insurance company, received these letters.

Several hard disk drives, which could contain thousands, potentially millions of personal information.

Sony? Not even one week before they let people know. I mean seriously, one week isn't even enough time to cypher through all that information that was supposedly taken.

The hackers-mix-identity thieves should be destroyed.

Less than a week and people know. They have a much, much better ability to not get fraud attacks against them.

This. Exactly this. People saying Sony is reacting incredibly slow, have clearly never been affected by anything similar, as when this happens, it usually does take far longer for this kind of information to be released.

A week is actually very on the ball.

 

[Raistlinhawke]

The perception of the incident is that Sony's lack of encryption on personal data was the impetus for the hack. Keep in mind this is personal data, not credit card numbers. Still, most people believe it to being akin to leaving a diamond ring on the dashboard of a locked car. Technically, it's safe, but if someone really wanted it...

This is still untrue in the current situation, as the motivation for the hack was not the acquisition of user data, at least within the parameters of the incident that we know.

Another reason is the perceived length of time it took Sony to inform its consumers of data hacking. That is a bit less defend-able. Even given Sony's timeframe of a day or so, that is a terribly long interim before contacting your customers. But again, until we get a report from an independent third party on the damages, so much is unknown. And that's the biggest problem.

 

[Elamdri]

A week is actually very on the ball.

I disagree.

Pointing at someone who sucks more than you doesn't mean that you don't suck, it just means you suck less than someone else. You still suck.

 

[mjc0961]

for the same reason the bank guarding $77 million Dollars would get more hate than a bank robber If it was Robbed if they left one guy with a BB gun to guard all the money. People can't really hate on the bank robber as that's what bank robbers do, they rob banks, the bank on the other hand had a responsibility to protect the people's money that was stored and by failing miserably they would naturally receive lots of hate by the people who lost their money to the bank robbery. The only other option would be to hate on the existence of crime.

it would be one thing if they truly made an effort and failed but by all accounts only was not even making a valid attempt to protect the information and was slacking on their duty for security, thus the hate.

Yep, that pretty much sums it up. Except you left out the part where the bank is closed and the owners say they don't know why for 2 days, at which point they claim that they shut the bank down to shut down an "external intrusion", and then wait another 2 days or so to admit that they got robbed for every last penny in the place. But the fun doesn't stop yet because now we get a new story every day about whether or not they got into our safe deposit boxes too. They don't know if the robbers got them. The robbers probably did get them. The robbers definitely didn't get them because they are locked.

Bottom line: Combine poor security (there really should have been no way that regular consoles can be switched to developer consoles just by custom firmware, developer consoles shouldn't be able to get to such sensitive customer information in the first place, and customer info should be encrypted too [the implication I got from Sony when they said the CC info is encrypted is that our info wasn't if the intruders got it]) with some of the worst PR I've had directed at me and yeah, Sony deserves some hate.

Pointing at someone who sucks more than you doesn't mean that you don't suck, it just means you suck less than someone else. You still suck.

I agree 100%.

 

[Frostbite3789]

A week is actually very on the ball.

I disagree.

Pointing at someone who sucks more than you doesn't mean that you don't suck, it just means you suck less than someone else. You still suck.

With that logic:

Michael Phelps just sucks less at swimming than everyone else. But he still sucks.
Whoever wins the Super Bowl just sucked less. But they still suck.
A kid who wins the science fair just sucked less. But they still suck.

 

[mjc0961]

With that logic:

Michael Phelps just sucks less at swimming than everyone else. But he still sucks.
Whoever wins the Super Bowl just sucked less. But they still suck.
A kid who wins the science fair just sucked less. But they still suck.

More like with no logic. You're taking something that applies to people who suck and applying it to people who don't suck. A proper comparison would be that the guy who got second to last place doesn't suck because he wasn't dead last. He just sucks less than one person.

 

[Elamdri]

A week is actually very on the ball.

I disagree.

Pointing at someone who sucks more than you doesn't mean that you don't suck, it just means you suck less than someone else. You still suck.

With that logic:

Michael Phelps just sucks less at swimming than everyone else. But he still sucks.
Whoever wins the Super Bowl just sucked less. But they still suck.
A kid who wins the science fair just sucked less. But they still suck.

No, think about it this way

You go to McDonalds and you buy a Burger and a Drink.

You expect to get the Burger and Drink with no flaws.

Now in the insurance example the one guy posted, instead of getting the Burger and Drink with no flaws, he instead get's a burger with a bunch of dead flies on it and someone has p***ed in his drink.

Now, in the Sony example, there's no p*** in your drink, but there's still a dead fly on the burger.

So yeah, the one meal was better than the other, but that doesn't mean they did a good job.