Sony still refuses to detail the exact exploit used to hack the PlayStation Network and its Qriocity streaming service, but has admitted that as well as updating the software security of the network, it is physically “moving our network infrastructure and data center to a new, more secure location.” The changes are part of a number of steps Sony has been forced to take after reportedly pulling down the PSN after rampant piracy took hold.
According to reports earlier this week, a custom PS3 firmware allowed hackers to unofficially gain access to the PlayStation Network developer channels. There, they were supposedly able to use false – and unchecked – credit card details to make purchases. Sony’s only recourse, it was suggested, was shutting down PSN access altogether.
In a new Q&A – which overlaps considerably with Sony’s previous FAQ on the subject – Sony’s Patrick Seybold, Senior Director for Corporate Communications & Social Media, confirms that the company is working with both law enforcement and “a recognized technology security firm” on what is being viewed as a criminal act. According to Seybold, credit card data was encrypted and users are only being warned about it “out of an abundance of caution”; personal data, however, was not encrypted but was, he insists, “behind a very sophisticated security system.”
It’s that security system which has been breached, of course, a side-effect of what Sony hacker George Hotz suggests is likely down to “arrogance and misunderstanding of ownership.”
“Traditionally the trust boundary for a web service exists between the server and the client. But Sony believes they own the client too, so if they just put a trust boundary between the consumer and the client(can’t trust those pesky consumers), everything is good. Since everyone knows the PS3 is unhackable, why waste money adding pointless security between the client and the server? This arrogance undermines a basic security principle, never trust the client … Notice it’s only PSN that gave away all your personal data, not Xbox Live when the 360 was hacked, not iTunes when the iPhone was jailbroken, and not GMail when Android was rooted. Because other companies aren’t crazy.” George Hotz
Sony maintains that certain services will be back online in under a week, though is yet to confirm which those services will be. The company is also facing a class action suit and what experts predict could amount to $24bn in credit card fraud.