April 29, 2011

UNCONFIRMED - Early Versions of PSN May Have Sent User Information In Cleartext Over HTTP [UPDATED]

This is in no way confirmed to be legitimate, but if true is rather unbelievable.  A couple of days ago, lo-ping.org reported that they've found what appear to be chat logs from a group of PSN hackers.  Reading through them, they seem to be pretty legit, but obviously, again, there is no way to confirm this.  Among the most interesting things in the transcript is the following exchange:

<user5>  yeah if you go public with your info they either remove the store or psn all together
<user5>  as an update
<user6>  I doubt it :P
<user7>  from all the actions they've taken the past years, we can only deduce that Sony don't care about their customers
<user2>  impossible
<user7>  :)
<user2>  they wont update their whole psn lol
<user6>  but this should really get out there, but I guess it's on psx-scene.com in a matter of minutes already ;)
<user5>  3.60 removal of psn
<user2>  i know a few guys who worked @ sony's psn backend. just when the ps3 was released we talked bout the first psn, at this time ALL was http and unencrypted. so you could see userpass etc plain. i asked em why is it that way. lame answer was "we thought it was adressed." - lol
<user2>  sony qa --> trainees
If true, for an unknown amount of time Sony was committing a pretty grievous error intentionally in the world of security.  An error that may even be illegal, as they'd have been knowingly sending unencrypted credit card numbers via the Internet back to their servers.  In any case, if true, this shows exactly how seriously they valued the protection of their users' personal data.  I've reached out to Sony for comment on this, and will report more if I receive a response.  However, I realize I'm a miniscule fish in a big ocean of press and companies wanting their attention, and especially given their VERY recent PR history, so I'm not holding my breath.

UPDATED 4/29/11 3:12 EST - Added information that these don't appear to be *THE* PSN hackers, but rather a group of hackers that work on hacks for the PS3/PSN.

No comments:

Post a Comment