Wed, May 04, 2011 | 22:15 BST

“Anonymous” file found on server, Sony tells Congress

Sony has issued a response to a US Congress subcommittee following the PSN hacker hearing held earlier today, revealing it found a file on its server saying, “We are legion”.

The hearing was viewable live on C-SPAN.

Following the downtime of the US and EU service for over two weeks after hacker activity and the compromise of user details, Australian and US Congressional hearings have taken place over the last couple of days.

Today, Kazuo Hirai, chairman of the board of directors at SCEA, submitted written answers to questions posed by the subcommittee regarding the PSN breach, and the firm’s US director of corporate communications, Patrick Seybold, shared the documents via the US PS Blog.

Sony has now said it found a file named “Anonymous” on one of its servers with the words “We are Legion” attached to it.

“In summary, we told the subcommittee that in dealing with this cyber attack we followed four key principles: Act with care and caution, provide relevant information to the public when it has been verified, take responsibility for our obligations to our customers, and Work with law enforcement authorities,” said Seybold.

“We also informed the subcommittee of the following: Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack.

“We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named ‘Anonymous’ with the words “We are Legion.” By April 25, forensic teams were able to confirm the scope of the personal data they believed had been taken, and could not rule out whether credit card information had been accessed. On April 26, we notified customers of those facts.

“As of today, the major credit card companies have not reported any fraudulent transactions that they believe are the direct result of this cyber attack. Protecting individuals’ personal data is the highest priority and ensuring that the Internet can be made secure for commerce is also essential. Worldwide, countries and businesses will have to come together to ensure the safety of commerce over the Internet and find ways to combat cybercrime and cyber terrorism.

“We are taking a number of steps to prevent future breaches, including enhanced levels of data protection and encryption; enhanced ability to detect software intrusions, unauthorized access and unusual activity patterns; additional firewalls; establishment of a new data center in an undisclosed location with increased security; and the naming of a new Chief Information Security Officer.

“We told the subcommittee about our intent to offer complimentary identity theft protection to U.S. account holders and detailed the ‘Welcome Back’ program that includes free downloads, 30 days of free membership in the PlayStation Plus premium subscription service; 30 days of free service for Music Unlimited subscribers; and extending PlayStation Plus and Music Unlimited subscriptions for the number of days services were unavailable.

“We are working around the clock to have some PlayStation Network services restored and we’ll be providing specific details shortly. We hope this update is helpful to you, and we will continue to keep you posted as we work to restore our network and provide you with both the entertainment and the security you deserve.”

Hacker group Anonymous had previously stated it had nothing to do with the PSN breach, at least as a group effort. However, the firm was responsible for bringing PSN down for part of a day in early April, apparently using DDOS attacks.

After a public backlash, the group said it would no longer attack PSN, but instead suggested a sit-in protest at Sony stores, which failed to gain traction with consumers.

It was reported earlier today that a third security firm had been employed by Sony to aid in the PSN hacking investigation – an investigation that now involves US Homeland Security and the FBI.

83 comments

#51

DrDamn
04/05/11, 6:49 pm

@49
Unfortunately you don’t seem to have sold your caps lock key yet.

#52

Alakratt
04/05/11, 6:51 pm

@48

Well dude I’m just using something called logic, I’ll give you an example. Anon said that something big was coming…days later, the outage. Then Anon said that they weren’t sure other anons did the attack. And I’m not even mentioning the file that was left on the server. So 1+1=2 NOT 3. But hey, since it’s cool to defend Anon, fuck logic right?

#53

Kerplunk
04/05/11, 6:53 pm

“Expect us”
“We do not forgive”
“We do not forget”
“We are legion”

“We never did anything! Why are you accusing us?”

#54

ManuOtaku
04/05/11, 6:55 pm

#52 you use logic and is good,iam not debating that, is a great possibility by the way , but i did use logic too and is also a great possibility, therefore both are equal on the level that anyone could end up be the truth, iam not saying fuck logic, iam saying that there is more than one possibility thats all.

#55

Alakratt
04/05/11, 6:58 pm

@54

Agreed, there are many possibilities, I’m just leaning over the one that seems more viable to me.

#56

LOLshock94
04/05/11, 7:05 pm

anoymous is for the GREATER GOOD

#57

Dr.Ghettoblaster
04/05/11, 7:07 pm

Bottom line is you can’t publicly THREATEN a global company such as Sony, then expect NOT to get blamed for this shit happening right after…

Whether Anonymous did it or not, because of their public involvment, and more importantly their threat towards Sony (see #28), they are now primary suspect(s)….and rightfully so.

#58

DrDamn
04/05/11, 7:08 pm

@56
They’re feminists?

#59

KrazyKraut
04/05/11, 7:10 pm

hope Anonymous burn in hell

#60

HauntaVirus
04/05/11, 7:12 pm

This sucks bad, I want to play some fuckin Uncharted 2!

#61

LOLshock94
04/05/11, 7:14 pm

The FBI or any law enforcement cannot imprison or stop an idea, nothing can.

#62

TheWulf
04/05/11, 7:17 pm

“Sophisticated cyber attack.”

Really Sony?

This reminds me of that Penny Arcade strip.

“Sir, the hackers have stolen our Internets!”
“Which ones?”
“ALL OF THEM!”

It’s the sort of thing that makes your brain want to leap out of your ear so it won’t have to be exposed to what it’s seeing any more.

Reality: They had incredibly lax security and a bunch of kids found their way in.

Sony Version: In a dark basement in the Middle East, Anonymous gear up in their L33T Cyber HAX Gear and prepare to dive into the Internets! Trained by the best guerrilla warfare specialists in the world to wage cyber war on our Internets! They were calculated, they acted with precision, they were like fingers of the same hand. They… were… legion.

/facepalm

(They should totally have a game made about that. You know, Sony fans would lap it up. “Battle the evil hordes of Anonymous in your Playstation Power Suit, hit them where it hurts, and send them running home to mama!”)

#63

Cozzy
04/05/11, 7:17 pm

I don’t care anymore! I just want PSN back!

#64

Dr.Ghettoblaster
04/05/11, 7:18 pm

@61 Not sure if you’re refering to my comment or not (#57), but just encase you are… :)

If I PUBLICLY threaten to kill the president to millions of people over the internet, then days later the president is killed, whether I did it or not, I’m going down.

I hope they track these bastards down and they get prosecuted to the fullest extent of the law.

@62
“Reality: They had incredibly lax security and a bunch of kids found their way in.”

I don’t buy the poor security argument. How does lax security keep PSN safe and secure for 5 years since it’s initial launch? And don’t say no-one tried hacking PS3/PSN the first 5 years until GeoPutz came along…

#65

OlderGamer
04/05/11, 7:21 pm

Great post TheWulf! I laughed good at that. :)

#66

Cygnar
04/05/11, 7:22 pm

Wait, wait, wait.

Did the article just call Anonymous a “firm?”

#67

Kerplunk
04/05/11, 7:29 pm

@64 The only people that take TheWulf’s comments with any seriousness are the ones who want to believe the same line of crap.

Going by TheWulf’s mantra and logic, Sony hacked Sony.

Once you realise that sort of thinking is afoot, you know what to expect from such people and their supporters.

#68

Gama_888
04/05/11, 7:37 pm

It is obvious that a member, or several, members of anonymous did this attack.

Even though they released that video saying they did not a few weeks back, theres no way any one person can speak for anonymous, simply due to the nature of the group, “Anonymous” xD

#69

TIMCSS
04/05/11, 7:39 pm

Read the whole letter HERE guys, the blog is just snippits.

http://www.flickr.com/photos/playstationblog/sets/72157626521862165/with/5687530922/

#70

Stephany Nunneley
04/05/11, 7:46 pm

@69 the link to that was in the post from the beginning. Some people are just link adverse :p

#71

spiderLAW
04/05/11, 9:02 pm

im not gonna lie. I didnt read the article fully or any of the comments. i just wanted to say.
Get them mother fuckers Sony!! Beat their asses down!!! Fry em!

#72

theevilaires
04/05/11, 9:11 pm

Put a 5 million dollar bounty on these fuckers heads and see how fast they pop up. I swear I hope Mike Bowden is some how connected with these fuckers and he goes down with them.

#73

Lord Gremlin
04/05/11, 10:02 pm

Well, all freaks who form Anonymous will burn in hell for sure, but how about some punishment in real life?
I think it’s time not just Sony, but governments of all large countries track and eliminate this stain off the face of Earth.

#74

NightCrawler1970
04/05/11, 10:21 pm

#75

NeoSquall
04/05/11, 10:35 pm

@56 PURGE THE TAU DOUCHES!

#76

TheWulf
04/05/11, 10:45 pm

@67

No, I’ve never said that at all. I’m just saying that Sony went out of their way to make it as easy as possible for people to hack them, they had no barriers, no defences, and they just didn’t give a shit until the worst happened. And now they think that throwing ever more lawyers and police forces at this will solve the problems that they created.

if they’d not been lazy and cheap, and actually budgeted in some decent security experts in the first place then none of this would have happened. To this day, Steam, the PC content platform, is an impregnable fortress. Why is this? Valve aren’t stupid. They started out as developers themselves and they realise the importance of software security, so they tend to make sure that they’re always on top of the latest forms of security. Ex: That particularly nice Steam Guard feature.

Valve are always doing things to increase the security of themselves and their users. This is a concern that they take seriously, but for Sony it was a joke to them until someone actually took them up on their offer to raid their completely open networks.

The hacker in question was likely just a bored kid, you know the sort, rebellious, angry at the world, and so on. Yes, the hacker is at fault, but if Sony made it as easy as possible for the hacker to accomplish their goal, then do you believe that Sony has no fault? But that’s the problem with you fanboys and your blind loyalty to Sony. You treat their corporation like some kind of god, and you’re its cult. They don’t need PR when they have talking heads like you, do they?

Wake up. Seriously.

Sony dropped the ball, here. No, Sony didn’t hack Sony, that’s stupid, but the only people to hurt Sony really were Sony. Why? I mean, you’re not a complete imbecile, man. You’re not. You shouldn’t be. So take off the blinkers and think for a moment, will you? Please? I’d really appreciate it. If you have absolutely no data security going on whatsoever, then making things so easy is just an invite.

Sony are just as culpable and responsible as the hacker, and they’re certainly responsible for not keeping credit card details safe – yours and mine. If this had been Microsoft that had dropped the ball I’d be just as angry, I don’t care. Either way. Whomever. The point is is that Sony spent more money on lawyers and marketing, and none on security.

That credit card details, personal information, passwords and more are out there now in the hands of people that shouldn’t have them is Sony’s fault. if Sony had had security like Valve’s, then the hacker would’ve just gotten bored and given up. But it was easy for them. You just have to stop and think about WHY that is. Think about why it’s never happened to Valve. Use your brain, man. You must have one, surely.

Conclusion: If Sony made it as easy as possible for hackers to steal your personal data, whose fault is it? Sony’s fault, obviously. And thus, if their reputation suffers from this, from their own negligence, whom would you say is hurting Sony? Sony. It doesn’t take a rocket scientist to figure this out.

#77

klewd
04/05/11, 10:55 pm

@76
“Sony dropped the ball, here. No, Sony didn’t hack Sony, that’s stupid, but the only people to hurt Sony really were Sony. Why?”
then you just proceed with insults and then changes subject.

you’re basically saying that if your house gets robbed and you don’t have an alarm, then it’s the victim’s fault. it doesn’t work that way in the real world. whether sony was irresponsible or not doesn’t have anything to do with this. this is about the attack on their network, a crime done by someone. your logic is completely retarded.

pro non sequitur, though.

#78

OwningXylophone
05/05/11, 12:10 am

@77

No, the analogy you are looking for is: “if your house gets robbed but you left the doors unlocked then your at just as much fault as the robber”. Not sure I agree with it, but that is what he is implying.

#79

mathare92
05/05/11, 12:14 am

The only console I own is a PS3 and I can attest to being somewhat of a Sony fanboy (hell, theirs is the only console that lets me play MGS4 :D ), but that will not stop me from saying that #76 makes a mighty good argument there.

Yes, malicious cun- ahem, hackers, were intent on causing damage, but ffs, we’re talking about Sony here – a multinational, global fire-breathing powerhouse of an electronics company. Are you telling me they didn’t have the wherewithal to anticipate such an attack and beef up their networks’ security barriers? Sorry, but this all just rings of corporate negligence to me. Hopefully the lessons they’ll have surely learnt from this whole mess will keep them in good stead for the future.

For now though, Sony, just bloody get PSN up again! BFBC2 is literally crying out in its case for me to play it. We’ve never been apart for this long. :)

#80

Cygnar
05/05/11, 5:45 am

@79
The response obvious to me is that no network is perfectly safe. In much the same way as no software is unhackable, and as no lock is unpickable, no network connected to the internet is completely impervious to attack. Sony could have seen an attack coming, but that does not mean that they knew every possible means of attack or every way to prevent each sort of attack.

Now, the very fact that an attack was successful does not mean that Sony ‘left the front door open.’ What it means was that someone outsmarted Sony’s security measures. If the network was not highly secure, it may not have taken much to break into it. However, it may have been the case that the network was very secure, in which case it may have taken someone very creative and clever to access the information. We do not know the nature of the attack. We do not know the means or mode of access; the identity, number of, or background of the attackers involved; or the measures Sony used to secure its network, whether these measures were in line with industry standards, et cetera. Given the information available to us, we have no basis to conclude that the network was either poorly or highly secured at the time of the attack. All we know is the obvious fact that the network was not secure enough to prevent the attack.

The fact is, there is only one way to completely secure a network, and Sony did just that when it learned of the attack: it disconnected the service. If it wanted to prevent all attacks, it wouldn’t ever turn the network on. But as Sony provides a network service, it shoulders the risk of attacks on its network, and bears the burden of taking reasonable measures to maintain security. While analogies are intuitive, they do not inform us what Sony’s legal responsibilities are. Laws tell us those. And I can guarantee you that there is no law that requires Sony to ensure that no hacker can ever outsmart its security system.

#81

Kerplunk
05/05/11, 7:03 am

@80 Your posts are always a pleasure to read – showing common sense and rational thought. A welcome and refreshing change from the norm.

@76 Well, your argument holds true. Oh, hang on. I just realised some things:

- You’re overlooking 5 years of hack-free history
- You’re overlooking Valve themselves getting hacked

Whoops

The rest of your argument is based on the notion that Sony’s network doors were deliberately left wide open. Which doesn’t really fit with that whole ‘last 5 years’ thing. I guess we’ll ignore history and just believe your spiel instead!

On top of which, it’s highly doubtful you’re in any position to speak with any authority on the set up of a global corporation’s network infrastructure. You’re clearly not Sony, so you’re either a hacker or someone making guesses. You supposed authority is even more doubtful with your fondness for overlooking facts that don’t fit your argument.

After that, your repeated statements basically boil down to “bitch had it coming” which really isn’t a very good argument at all. Ignoring history and overlooking logic isn’t a great tactic either.

It’s astonishing how easy it is to deconstruct these outraged rants when you simply apply history and logic to them. If you remain objective rather than rant off emotion and some ridiculous bias you can usually see straight through the bullshit. Unless you’re emotional and biased yourself – in which case you’d probably just endorse any sort of bullshit that suited your view irrespective of how silly it actually is.

tl;dr: The only one hurting TheWulf’s credibility is TheWulf

#82

klewd
05/05/11, 6:43 pm

@78
no it’s not. If your house doesn’t have a lock, then that means it’s open for everyone without any kind of function to keep people away. Sony’s servers do, on the other hand, have functions to keep people away. If they didn’t, then I could “hack” sony as well. Those servers and the data within is locked from the public. Just because they managed to break the lock doesn’t mean there never was any.

#83

azunomi
06/05/11, 1:26 am

so just coming into this argument, this entire thing just sucks. Yeah Sony got hacked, so whats your point if it was anon or some one else trying to prove that they had what it took to stand with the big boys and do this sort of thing then well good job, you have lost Sony a lot of money at this point by doing a truly dick move and well the millions of PSN/SOE users out there will want to beat the crap out of you in a dark alley some where.

As for this argument by anon about Sony “limiting the free flow of information” so what you sign an end user agreement when you buy and run your PS# that you have to follow what the company decided to do with up dates. Here is an idea why don’t you hack Microsoft for the same policies that where put into place for the decade+ due to the allowance of DRM software/hardware that has been put into place thanks to US laws that where past back in 1998.

Look it comes down to this who ever did this your an asshole who has stopped millions from enjoying what a game console is designed to do these days play games with any one in the world. your not Robin Hood fighting for the little guy, your just a prick with a chip on your shoulder. So yeah thanks anon or whom ever. way to hurt alot of people, also can you take the stick out of your ass and grow up?

Leave a Reply