PSN - Now coming back online

[Victoria Raverna]

Hackers claimed that they have the credit card info including the CVV2 and offered it for sale in underground internet forums.

"Supposedly the hackers selling the DB says it has: fname, lnam, address, zip, country, phone, email, password, dob, ccnum, CVV2, exp date," he said, referring. The less obvious acronyms refer to credit card holders' first name, last name, credit card number, and credit card security code.

And...

Reports began trickling out yesterday from PSN users about recent fraudulent charges on the credit cards they used for the PlayStation service.
An employee of GameFly Media tweeted that a colleague's card was used to buy $1,500 worth of goods at a grocery store in Germany. Meanwhile, a reader of gaming site VGN365 said his bank had informed him of a fraudulent $300 debit card withdrawal this weekend. And another person reported on video game forum site Neogaf.com $600 in fraudulent withdrawals.

If you had your credit card or debit card info on PSN, I think it is a good idea to cancel your cards.

[metallicorphan]

yup,seems things are starting to happen now


Australian officials investigating SONY as man loses $2000 to fraudsters

i love the pic that Kotaku used,LOL

[BuckeyeShane]

Hackers claimed that they have the credit card info including the CVV2 and offered it for sale in underground internet forums.

"Supposedly the hackers selling the DB says it has: fname, lnam, address, zip, country, phone, email, password, dob, ccnum, CVV2, exp date," he said, referring. The less obvious acronyms refer to credit card holders' first name, last name, credit card number, and credit card security code.

And...

Reports began trickling out yesterday from PSN users about recent fraudulent charges on the credit cards they used for the PlayStation service.
An employee of GameFly Media tweeted that a colleague's card was used to buy $1,500 worth of goods at a grocery store in Germany. Meanwhile, a reader of gaming site VGN365 said his bank had informed him of a fraudulent $300 debit card withdrawal this weekend. And another person reported on video game forum site Neogaf.com $600 in fraudulent withdrawals.

If you had your credit card or debit card info on PSN, I think it is a good idea to cancel your cards.

How did the hackers get the CVV number since that was never given to PSN?

[hepcat]

How did the hackers get the CVV number since that was never given to PSN?

something sounds a little fishy as I don't recall ever entering my CVV when using any of the online console stuff for any platform.

[MonkeyFinger]

And they've now said that the credit card information was encrypted, the comment is in this article speculating on a return date.

[Clanwolfer]

How did the hackers get the CVV number since that was never given to PSN?

something sounds a little fishy as I don't recall ever entering my CVV when using any of the online console stuff for any platform.

Edit: I wonder how many people buy PSN software a month... according to TrendMicro, hackers are offering to sell a batch of 2.2M card numbers+CVV codes. 2.2M unique users sounds reasonable for, say, 60 days worth of transactions, I think. Just saying that 60 days of plaintext web server logs with the GET request included would include that info... I still don't want to discount it as a possibility.

I'm just saying, it's Rootkit Sony. I still believe they're arrogant, they'll put the best spin on this until they're forced not to, and they've been known to be wrong or do dumb things before. I'm not really excited about calling BS on hackers having everything until Trend Micro or somebody conclusively says there's some reason to.

[hepcat]

Odd, i still don't remember entering that info when using my cc on their network.     ah well, better safe than sorry.  i'll keep checking my statements and change the only one i believe i used.

[mytocles]

Hackers claimed that they have the credit card info including the CVV2 and offered it for sale in underground internet forums.

yup,seems things are starting to happen now

Australian officials investigating SONY as man loses $2000 to fraudsters

I'm just starting to read these articles, so this one may be more of the same, but a friend sent it to me, so here ya go:

http://www.techtree.com/India/News/Hackers_put_up_PSN_Credit_Card_Info_for_Sale/551-115147-585.html

That's exactly what I wanted to do today - read lots of bad news, swear at Sony all day long - all while trying to find which CC I used on PSN, then changing it.  If I get that all done, I'll be on my 360 hoping MS doesn't announce something similar.  Or Nintendo, or iTunes, or... well, you get it.

 

[CeeKay]

I checked my PS3 for anything I might have bought using a CC, and it doesn't look like there was never anything on PSN that I cared enough about to actually purchase so I may have never entered a CC number.  still keeping an eye on my bank account though.

[mytocles]

I can't swear this info wasn't posted here already, but right now I'm buried in email and bank account sites, so I'll toss this into the ring in case it helps anyone. While searching my emails from PSN I found one from the end of March, this year... and it looks like I may have done something good - or bad(!) by ignoring it.  The body of it reads:

PlayStation(R)Network
 
===================================

An important message to you from the
PlayStation(R)Network team at Sony Computer
Entertainment America LLC.
 
On April 1, 2011, Sony Computer
Entertainment America LLC ("SCEA")
will transfer its online services
operations, including your wallet
and the funds in it, to Sony Network
Entertainment America Inc. ("SNEA").
The first time you sign in to your
Sony Online Services account on or
after April 1, you will be asked to
enter into a new Terms of Service and
User Agreement with SNEA. If you do
not wish to enter into a contract with
SNEA, you may decline the terms of
service and we will close your account(s)
and return your funds. You can preview
the new Terms of Service and User
Agreement with SNEA at:
http://playstation.innovyx.net/r?xncJcvvEcWlHHqEHWJHlWWcTlJq
 
PlayStation(R)Network will continue to
provide you with the highest standard
of interactive entertainment. Your
access to the best games, movies, TV
shows, music and friends will remain
intact. Thank you very much for being
part of the PlayStation(R)Network online
community! We look forward to continuing
to bring you the best in innovative
online entertainment!

Your PlayStation(R)Network password and
Sign-on ID is required
to sign in to your Sony Online Services
account. Please go to >>
http://playstation.innovyx.net/r?xncJcvvEcWJqTqEHWJHlWWcTlPl
to ensure your account information
is accurate and updated.

The PlayStation(R)Network Team

The second link there is to a page that you can sign in to correct "problems" with PSN - there's absolutely no mention of the hack, of course.

This just gets better and better.  When I tried to sign in, so I'd know at least which password I was using on PSN, I got the message we've probably all seen - but is particularly scary now:

This Connection is Untrusted
   
You have asked Firefox to connect securely to store.playstation.com, but we can't confirm that your connection is secure.
         
Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

 

[metallicorphan]

certainly looks dodgy,i mean get a load of that link 'playstation.innovyx.net/r?xncJcvvEcWJqTqEHWJHlWWcTlPl'

[Teggy]

It's actually legit - http://us.playstation.com/support/answer/?a_id=2324

[mytocles]

certainly looks dodgy,i mean get a load of that link 'playstation.innovyx.net/r?xncJcvvEcWJqTqEHWJHlWWcTlPl'

Yeah, I know, but that innovyx.net thing is in the PSN newsletter address, too, with a string of numbers and  letters, so I can't tell...

Ahh, I see your new post Teggy - thanks, that helps!  I'm still afraid to go to any of their sites though, because they are all coming up with the Site Not Trusted alert.

Are we having fun yet?

 

[Teggy]

So, they've got this in the FAQ now:

Q: Was my personal data encrypted?
A: All of the data was protected, and access was restricted both physically and through the perimeter and security of the network. The entire credit card table was encrypted and we have no evidence that credit card data was taken. The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack.

 

Q: Was my credit card data taken?
A: While all credit card information stored in our systems is encrypted and there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained. Keep in mind, however that your credit card security code (sometimes called a CVC or CSC number) has not been obtained because we never requested it from anyone who has joined the PlayStation Network or Qriocity, and is therefore not stored anywhere in our system.

[CeeKay]

Homeland Security is assisting.

[The Grue]

You know what would be awesome? Getting my PC copy of Portal. I finally see a point to a class action lawsuit on this one. I paid $60 for a PS3 copy and PC copy and I am being denied my PC copy. Might be one class action suit I wouldn't ignore.

[gellar]

certainly looks dodgy,i mean get a load of that link 'playstation.innovyx.net/r?xncJcvvEcWJqTqEHWJHlWWcTlPl'

Yeah, I know, but that innovyx.net thing is in the PSN newsletter address, too, with a string of numbers and  letters, so I can't tell...

Ahh, I see your new post Teggy - thanks, that helps!  I'm still afraid to go to any of their sites though, because they are all coming up with the Site Not Trusted alert.

Are we having fun yet?

 

Which links?  I'm not seeing any issues with the ones here.

[metallicorphan]

certainly looks dodgy,i mean get a load of that link 'playstation.innovyx.net/r?xncJcvvEcWJqTqEHWJHlWWcTlPl'

Yeah, I know, but that innovyx.net thing is in the PSN newsletter address, too, with a string of numbers and  letters, so I can't tell...

Ahh, I see your new post Teggy - thanks, that helps!  I'm still afraid to go to any of their sites though, because they are all coming up with the Site Not Trusted alert.

Are we having fun yet?

 

Which links?  I'm not seeing any issues with the ones here.

you may find a clue to the part i highlighted in Myto's quote..that YOU quoted

and anyway,trust SONY to have a dumb looking link like that,i know i certainly wouldn't of clicked on that link if it came through my email

[gellar]

certainly looks dodgy,i mean get a load of that link 'playstation.innovyx.net/r?xncJcvvEcWJqTqEHWJHlWWcTlPl'

Yeah, I know, but that innovyx.net thing is in the PSN newsletter address, too, with a string of numbers and  letters, so I can't tell...

Ahh, I see your new post Teggy - thanks, that helps!  I'm still afraid to go to any of their sites though, because they are all coming up with the Site Not Trusted alert.

Are we having fun yet?

 

Which links?  I'm not seeing any issues with the ones here.

you may find a clue to the part i highlighted in Myto's quote..that YOU quoted

and anyway,trust SONY to have a dumb looking link like that,i know i certainly wouldn't of clicked on that link if it came through my email

That link doesn't even use SSL, much less have SSL errors.

[metallicorphan]

yes okay i get it,we all bow down to you because you know what a legit link looks like,pat yourself on the back

[gellar]

yes okay i get it,we all bow down to you because you know what a legit link looks like,pat yourself on the back

I really don't think you have any clue what question I'm asking.  Also, I'm not asking you since you're not having the issue.

[metallicorphan]

I said the link looks dodgy,Teggy said it was legit,you came along and said i am not seeing any problems with the links..i pointed out that's what Teggy has already said,and then you go on about SSL...all i was saying was that it looked dodgy because it looked like a kitten had gone over the keyboard when typing the link

[gellar]

I said the link looks dodgy,Teggy said it was legit,you came along and said i am not seeing any problems with the links..i pointed out that's what Teggy has already said,and then you go on about SSL...all i was saying was that it looked dodgy because it looked like a kitten had gone over the keyboard when typing the link

Oh for fuck's sake.  I'm trying to be helpful given the sky-is-falling-retardation throughout the internet and bringing a bit of fact to the fact-impaired.  Here's myto's observation:

This Connection is Untrusted
   
You have asked Firefox to connect securely to store.playstation.com, but we can't confirm that your connection is secure.
         
Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

That is 100% an SSL error and I'm trying to sort out where she might see that error, so I can verify whether she needs to be concerned or not (seeing as how I actually understand SSL at a fairly deep level).  I am asking HER where she saw that error, so I can maybe look at the certificate and then let everyone know what exactly that error means and whether or not it is actually an issue.

Now if you wouldn't mind shutting the fuck up, maybe I can go about being helpful.

[metallicorphan]

okay i still think we are getting our wires crossed because you said that it didn't have SSL errors,but Teggy had already said it was legit,and Myto had acknowledged that when she said she was still having trouble..so yeah i don't know what to say

[mytocles]

Oh, my... and I missed the whole thing!  I was playing Dragon Age 2 on the 360 all night - thankfully that's still working...

Gellar, I might not have been able to answer your question earlier, because I'm the ignorant one here - seriously, I don't even know what SSL means.  I've seen that message from Firefox before, and I know it has to do with some kind of website authentication, or similar.  Now that I've read the rest of the thread though, I think I know what you were asking.

If your question was regarding the links in that email I quoted from PSN - those weren't a problem at all.  The first one brought me to some PS site talking about what was in the email.  The second one had links on it that looked like direct links to PSN, PS Home, PS Store, etc. - and those are the ones that produced the error message.  Given the circumstances, I wasn't terribly surprised; I just backed out and left it at that.  (Btw, I just tried them again, and they seem to be working fine now, go figure.)

I hope that helps - but please do not not tell anyone here to shut-the-fuck-up, not on my account at least.  Lets just get back to bashing the real enemy here, S-O-effin'-N-Y.

Thanks, everyone, really.  This is still the best place on the Internet Machine!

 

[gellar]

OK that's what I figured... I tested a few of the links on the pages you posted and didn't see any cert errors myself so Sony must've corrected what minor errors there were.  Just wanted to make sure of that.

[metallicorphan]

there is going to be a press conference tomorrow at 1am EDT(2pm Japanese time) to address the PSN breach,hopefully they will re-confirm that 3rd May is when they expect PSN to be back up

http://kotaku.com/#!5797331/kaz-hirai-to-address-psn-breach-in-news-conference-tomorrow

Kazuo Hirai, Sony Corp.'s second-in-command, in line to become its CEO, will brief the media on the catastrophic security breach in the PlayStation Network. The news conference will be held at 1 a.m. EDT (2 p.m. in Japan). Hirai will discuss Sony's investigation of the breach, its information management system, and the schedule for bringing PSN back online, Sony said in a news release today.

[CeeKay]

this is starting to become like that scene from A Christmas Story where Flcik is outside with his tongue stuck to a flagpole and the other kids re announcing who all is showing up to investigate:

Holy cow, it's the Homeland Security Department!
Wow, it's the Congress!

[jersoc]

more like Chernobyl, meltdowns all over.

[CeeKay]

to help alleviate suffering:

unspecified free download(s)
free lap dance from Kevin Butler
30 days free PSN+ and Qriocity


OK, so I made one of those up.

[metallicorphan]

i just read it on Kotaku,i read that the PSN store is not up until later in May...isn't the Playstation store like,one of the main uses of having Playstation Plus so you can download the free or discounted stuff??

Sony's statement implied that its PlayStation Store "and other Qriocity operations" would be slower to come back online than PSN, returning later in May, as the company continues "to reinforce and verify security" for both services.

I guess it depends on just how much later in May

[jersoc]

to help alleviate suffering:

unspecified free download(s)
free lap dance from Kevin Butler
30 days free PSN+ and Qriocity


OK, so I made one of those up.

I don't care about PSN+ so i'm glad that's fake.

[Zinfan]

Just checked PSN (thanks for the info to search for "[email protected]") and the card on file is one that expired over a year ago.  I don't use the PS3 that much and in this case it came in very handy to have old data and not my current CC info on file with them.

[TiLT]

I was surprised to see that the patch system on PSN still works. Has it been up the entire time?

[leo8877]

I was surprised to see that the patch system on PSN still works. Has it been up the entire time?

Yes, that caught me by surprise too.

[ras752000]

I was surprised to see that the patch system on PSN still works. Has it been up the entire time?

Yeah, noticed that day 1 of the outage when my kids went to play an older game.  Guess the update servers work above the authentication level just with Internet access. Suppose they have to; how else could you download a firmware update when you are not current (it auto signs you out of psn in that situation).

[metallicorphan]

bah,i just realised that the BBC/ITV/4oD i players are still working,i could of caught up on my TV 

[MonkeyFinger]

News on the press conference that Sony held today about the timing of things coming back online and a 'Welcome Back' program.

[metallicorphan]

Each territory will be offering selected PlayStation entertainment content for free download. Specific details of this content will be announced in each region soon.

I have a UK and US account...can i have both?

[Victoria Raverna]

I was surprised to see that the patch system on PSN still works. Has it been up the entire time?

Yeah, noticed that day 1 of the outage when my kids went to play an older game.  Guess the update servers work above the authentication level just with Internet access. Suppose they have to; how else could you download a firmware update when you are not current (it auto signs you out of psn in that situation).

The question is if it is safe to patch from the update servers when PSN has been compromissed. What if the hacker set PSN to distribute a hacked firmware update signed with the leaked private key? They can have full control of your PS3 if they manage to do that. They can get all your credit card info entered through your PS3 or use your PS3 as part of a botnet.