And you do? LOLOLOLOLOLpokepuke said:
Yes you are right, Sony left their system WIDE open for hackers and are to blame. Long live the hackers right? LMFAO. I hope you stick around here longer. Your fanboyism amuses me.
[UPDATE] PSN Password Reset Vulnerable to Exploit
- Thread starter Tom Goldman
- Start date
Recommended Videos
Yes you are right, Sony left their system WIDE open for hackers and are to blame. Long live the hackers right? LMFAO. I hope you stick around here longer. Your fanboyism amuses me.
From where are you getting that Sony didn't have the proper dedicated staff for security? From the Escapist? That story was debunked. I should know. I debunked it myself. http://www.escapistmagazine.com/news/view/109747-Sony-Sought-Security-Staff-Shortly-After-Shutdownpokepuke said:
From where are you getting that Sony had outdated server software? From the Escapist? That story's been debunked. They were using version 2.2.17 of Apache (the most current version available) as far back as March 23, which is well before the April 19 intrusion. http://webcache.googleusercontent.com/search?q=cache:h9540GDnnIoJ:auth.np.ac.playstation.net:443/+auth.np.ac.playstation.net
If they had proper dedicated security staff, why would they look to bring someone in? Think about it.JDKJ said:
um... touché? No, not really.gphjr14 said:
Yet Sony is on the defensive. The ultimate lesson is for Sony. Hackers doing whatever they want to don't need to learn anything when they can do it so well. That is, unless you think the lesson is that corporations can do whatever the fuck they want, to the detriment of their own customers.
More non-sequitur. It's mostly irrelevant, other than bad business to attack those people and remove features they paid for.
I thought I said to think about it.JDKJ said:
Who said it was in response? How does a "Security Analyst" make a proper dedicated security staff, and how would it negate the need to hire outside sources to figure out their problems? Really now, think about it, think on whether bring in one guy is comparable to consulting firms or whoever helped them out, and think about how a tech company with a major online presence should have a proper security team, not looking for a security team.
And you think the one position of "Senior Application Security Analyst" they were looking to fill comprised their entire IT security staff? And wasn't but one position among many positions in their IT security team? And the fact that the position's title includes the word "Senior" doesn't suggest to you that it isn't the only Application Security Analyst on staff? And that they, like every other business, don't experience employee turnover and have to refill vacated positions from time to time? And what makes you think that they didn't have to consult extensively with the outside vendor who provided them with what I have to assume is a fairly large IT system?pokepuke said:
That was what your post indicated, not mine.JDKJ said:
Again, refer to your post. You brought up the classified article as if it was evidence of something. Did you happen to forget why you posted it?
No. It doesn't have to mean that at all. It can simply mean a level of experience.
And does this even relate to having a proper dedicated security staff? If they still needed lots of outside help, then perhaps their bare-bones team isn't really cutting it.
Irrelevant to me. You brought that up, and it's not clear why.
Did you even read my posts? It seems you didn't really understand anything I said. I basically pointed out at they needed outside help and that it is a major issue, and you're here asking why I might think they didn't. And if you're trying to say that the IT setup was given to Sony so it must be completely foreign to them, just where is that angle coming from?
Seriously, do you need glasses or something? Try reading more carefully, or actually reading anything at all, considering how little your post appears to be in response to my post.
That you think when a position is advertised as "Senior Application Security Analyst," the "Senior" refers not to the position relative to other Application Security Analysts but, rather, "can simply mean a level of experience," tells me that further discussion with you is a waste of my time.pokepuke said:
Thanksalothaveagooddaybyebye.
Except what I said meant it does mean it is relative, just not necessarily to the people already hired by Sony. Duh...JDKJ said:
It's funny you think this talking point even matters to anything at all in any discussion.
Okay, I get it. You actually read my post again, for real this time, and realized that almost everything you said was practically in response to your own post, not mine. Now you've ignored every point made and singled out the most useless tidbit from a tangential thing you brought up.
But maybe you're right, that one "analyst" being hired to round out the team would have avoided the need for Sony to bring in a security firm to investigate the problem for them.
Actually, your best bet would have been to pick up on the "vendor" issue and pretend that Sony didn't set up their own network. At least then you wouldn't look like you completely backpedaled your way out of having any conversation.
The problem wasn't the security staff or the Apache version. The problem was that PSN was programmed in such a way as to divulge personal information upon a certain set of credentials. There are any number of safeguards Sony could have put in place to deny or limit the damage, such as blocking off IP's demanding more than a few sets of information.JDKJ said:
That's the first part that should not have happened. The second part is that said information, including passwords, was unencrypted, allowing immediate use.
Hacking isn't some arcane magic; systems don't just get hacked unless there's something wrong with them and it's reasonable for people to expect that, at the very least, their personal data is encrypted.
I can't argue if what Sony did or didn't do was reasonably sufficient to avoid data loss. I don't think anyone can because the totality of what Sony did or didn't do isn't at all clear or of general public knowledge. Moreover, I don't think there's any way to absolutely guarantee that data will be immune to a determined hacker or that it's fair to say that a network doesn't get hacked unless there's "something wrong" with it. There are always going to be vulnerable spots in a system and it is these vulnerabilities that are always going to be subject to exploitation. No security is hack-proof. For example, encryption isn't a guarantee against loss of personal data in a usable form. Encryption merely adds another layer of difficulty to a successful theft of the data. But if the encrypted data can be stolen, it's not a far reach from that point to stealing the means of decrypting the data. Or, alternatively, once having stole it, forcing it through rainbow tables that will eventually decrypt it. But we do know, according to Sony, that the most sensitive data (i.e., the credit card information) was encrypted. All data isn't of equal importance or sensitivity. If my name and birth date are stolen in an uncrypted form, I don't think a thief's doing much damage with that information alone. And encrypting data so as to make theft more difficult also tends to make authorized use to the data more difficult. There's a point at which making the data difficult to access by a hacker creates access and use difficulties for the authorized user. A bank could cement your money in a concrete casing thereby making theft difficult. But doing so will also make it difficult for you to withdraw that money with ease.Veylon said: