Wed, May 18, 2011 | 19:27 BST
Sony: PSN and Qriocity sites back up soon, exploit fixed
Sony has announced that it has fixed the URL exploit which caused it to take the majority of its website services down earlier today.
According to the firm, the process of resetting of passwords caused the URL exploit, but it has since been fixed, and users who haven’t reset their passwords for PSN are still encouraged to do so on their PS3. However, if they want, customers can still use the website service once it is brought back up.
Earlier today, a report over on Eurogamer stated that Sony’s PSN password reset system contained an exploit which could potentially allow someone to change a customer’s PSN password using the accounts stored email and the user’s date of birth.
Due to the exploit, Sony made PSN sign-in unavailable on some of its websites, including: PlayStation.com, the PlayStation forums, PlayStation Blog, Qriocity.com, Music Unlimited via the web client, and all PlayStation game title websites.
“Unfortunately this also means that those who are still trying to change their password via Playstation.com or Qriocity.com will be unable to do so for the time being,” Sony said in an earlier statement on the EU forums. “This is due to essential maintenance and at present it is unclear how long this will take.
“In the meantime you will still be able to sign into PSN via your PlayStation 3 and PSP devices to connect to game services and view Trophy/Friends information. Clarification: this maintenance doesn’t affect PSN on consoles, only the website you click through to from the password change email.”
Nyleveia.com, which first found the exploit, suggested folks secure their accounts by creating a new email that would not be used anywhere else other than through PSN.
The site also suggested users switch their current PSN accounts over to a newly created email address.
“You risk having your account stolen, when this hack becomes more public, if you do not make sure that your PSN account’s email is one that cannot be affiliated with or otherwise traced to you,” said the site.
The site contracted Sony on the matter, and noted that the system “went down approximately 15 minutes,” after it received a respoce from SCEE.
According to a post over on NextGen, the exploit if used nefariously, would result in nothing more than a phishing scam, and because the user data was made vulnerable with the original hack, users will just be more susceptible to a phishing annoyance.
“These individuals could use the same information they stole from the PlayStation Network and do similar things with other services you may be subscribed to,” reads the site. “This is not at a weakness in the PlayStation Network’s security.”
NeoGAF noted that the pages were created in a certain manner for a reason, and that it is not technically an exploit.
Sony pulled the password reset website in the hopes of fixing the issue, which it seems to have done. The site should be back up soon, then.
63 
Posted in: PS3, PSN
Tags: PSN, psn website exploit
63 comments
Older Comments
#51
G1GAHURTZ
18/05/11, 8:28 pm
@ Geki:
Who said that XBL was “completely” secure??
#52
Freek
18/05/11, 8:35 pm
And not getting phished or have your password brute forced is something that you have full control over by not falling for dumb e-mails or have your password be Admin1234.
#53
Gekidami
18/05/11, 8:40 pm
^ Phishing isnt the only way to hack a Live account, though. I know because i’ve had one hacked before, luckily it wasnt the one connected to my Xbox Live account. You think Major Nelson got ‘Phished’?
@G1GA
Seems to be the general consensus, hackers have apparently “tried” and “failed”. Yet they dont seem to have any trouble getting to individual accounts, where a persons personal information is stored.
#54
G1GAHURTZ
18/05/11, 8:47 pm
I think what people are basically saying, Geki, (and I agree) is that in realtive terms, and almost certainly in terms of percentage of hacked accounts, XBL is much, much safer.
An individual having his account hacked is not the same as a hacker getting full privileges to an entire network.
#55
Mike
18/05/11, 8:55 pm
@GIGA: Sorry, don’t agree, You just have to employ the right people, and have a decent security strategy.
Also, MS deserved everything they got from the RroD debacle.
#56
DaMan
18/05/11, 8:56 pm
Let’s see some sources then, Gekidami. Or any evidence for that matter.
Xbl accounts get phished or they ‘guess’ the password. there is also the social engineering .
#57
Mike
18/05/11, 8:57 pm
From the previous page, obv.
#58
DaMan
18/05/11, 8:59 pm
yeah, like I said. Nothing pointing to other methods.
The comparisons are retarded. I suppose knowing that someone was hacked because they ‘ve had a password ’12345′ makes them feel better as well.
#59
Gekidami
18/05/11, 9:00 pm
@ G1GA
And i never said it was. Just that Live definitely isnt the ‘impenetrable fortress’ its being made out to be.
#60
OrbitMonkey
18/05/11, 9:05 pm
Back & forth, round & round, same old same old *munches popcorn* carry on
#61
TheWulf
18/05/11, 9:29 pm
@22 & @36
You’re expecting sense from the usual suspects? Really? Those who regularly concoct ridiculous conspiracy theories?
(Here’s my favourite! – “The PSN was taken down by a splinter-cell of Anonymous who’re apparently taking orders from the ghost of Osama Bin Laden. Not just a bunch of fraudsters looking for an easy mark, provided by piss-poor security. Noap! It was Bin Laden leading a highly trained group of hackers into battle, so skilled that they act like fingers of the same hand!“)
Yeah. Good luck with that. I’ve tried and failed to cut through the sensationalist vitriol that some of them are spouting but it’s just too much, and so dense that not even wolverine would be able to leave a scratch in it.
Not everyone posting here is like that, of course, in fact it’s thankfully just a loud minority. As I said, just the usual suspects.
@38
I’m sorry, I know you mean well and all, but you’re wrong. Sony’s been doing software for years and years. They’re responsible for the SecuROM DRM. There are also a number of Sony software arms – Sony Online Entertainment for one, which have been developing games since the original Everquest.
In fact, they should’ve been more prepared than Nintendo. They dropped the ball, simple as.
@40
Incorrect! They have a shop as well, and their Virtual Console sales turn a decent profit, as is my understanding. So there’d likely be a juicy amount of credit card details there, if they could be obtained.
I’m kind of fed up that people are still making excuses about this.
@44
It’d be pretty easy to follow the evidence trail back to a source if a group of people suffered fraud, and then the company responsible would then be sued to hell and back. This is why every other company in the history of credit card information breaches has notified people immediately.
All you need is a modicum of sense to figure out why this is the case. Right. Information is obtained but never used by anyone, it’s just sitting in a closet with nothing being done with it. People are going to try to sell that information off as quickly as possible.
You’d be surprised how easy it is, then, to track it back to the source. It might not happen immediately, but it would happen eventually, and the company responsible would be dismantled for not telling people.
So yeah, living in the real world, that’s not going to happen.
@48
What bollocks.
You’re comparing someone losing their wallet with a bank being hacked and someone having their account cleared out.
This is why I really hate apologists.
Personal security DOES NOT equal corporate security. Duh?
#62
TheWulf
18/05/11, 9:33 pm
@53
So you’ve been stupid enough to install malware before and now you’re blaming the evil hackers and Microsoft for your own incompetence?
Marvellous.
Now I completely understand why you’re being a Sony apologist. Carry on.
@60
It’s better to participate in a discussion than to spam nonsense. You’re just wasting database space and CPU cyclces that could be better used elsewhere.
#63
OrbitMonkey
18/05/11, 9:57 pm
@TheWulf, What Is this I smell? Ah you & your pretentious little mewling. Please tell me you don’t speak aloud when you type, as you’d be wasting air that could be used by someone more deserving
P.s. Spouting the same old same old, time & again waste’s just as much CPU as me I think. At least I can keep it brief dear boy. But. then i don’t jack off to how clever I am whilst typing x
Older Comments