Over the past 3, nearly 4, weeks we have posted quite a few articles about the demise of the PSN and how things just haven’t gone well for Sony at all.
One of the most common accusations in the comments section is that we don’t know what happened so we can’t comment, which is ludicrous but for those who want to know exactly what happened here it is in Sony’s own words.
On Tuesday, April 19, 2011, Sony discovered that several PlayStation Network servers unexpectedly rebooted themselves and that unplanned and unusual activity was taking place on the network. This activity triggered an immediate response.
Sony mobilized a larger internal team to assist the investigation of the four suspect servers. That team discovered the first credible indications that an intruder had been in the PlayStation Network system, and six more servers were identified as possibly being compromised. Sony immediately decided to shut down all of the PlayStation Network services in order to prevent any additional damage.
The scope and complexity of the investigation grew substantially as additional evidence about the attack developed.
The forensic teams were able to confirm that intruders had used very sophisticated and aggressive techniques to obtain unauthorized access, hide their presence from system administrators and escalate privileges inside the servers. Among other things, the intruders deleted log files in order to hide the extent of their work and activity within the network.
On Sunday May 1, using information uncovered by the forensic teams, engineers at Sony Online Entertainment (SOE) discovered that data had also been taken from their servers. They, too, shut down operations and on Monday, May 2, announced the discovery.
So from my understanding they only knew that something was going wrong from the time that some of their servers restarted for no reason which sets mini alarm bells ringing in my head as it doesn’t sound like they had enough security in place.
But moving on, what are Sony planning on doing about… and again in their words
We have taken aggressive action to give consumers peace of mind, protect them against the abuse of their data, and enhance our security systems moving forward.
We have already advised our consumers in the U.S. that we will offer complimentary identity theft protection services through a leading provider, including an insurance program of up to $1 million. Similar programs are being developed in other markets around the world.
In addition, Sony is taking a series of steps to enhance security of our network infrastructure. They include but are not limited to:
adding additional automated software monitoring and configuration management to help defend against new attacks;
enhanced levels of data protection and encryption, as well as additional penetration and vulnerability testing;
enhanced capabilities to detect software intrusions within the network, unauthorized access and unusual activity patterns;
implementation of additional firewalls;
expediting a planned move of the system to a new data center in a different location with enhanced security; and
appointment of a new Chief Information Security Officer
Emphasis is my own but the two most important moves I can see them doing is adding the network intrusion detection systems and replacing their security officer who for whatever reason got this one entirely wrong.
This information has come from a letter that Sony sent to their partners to explain what’s going wrong, by all accounts it sounds like this is the first official communication to their partners which is pretty shocking in itself and which still doesn’t allude to when the PSN will be back up.
In better news though they did state that they are in communication with the major credit card companies and by all accounts it doesn’t look like there has been any fraud committed due to this data loss.
And yes if you are wondering I am also getting bored of all this PSN nonsense but we have to keep reporting on it as it’s pertinent, but please Sony can you get it up and running again soon.