Sony Detects New Web Attack, 93,000 Accounts Are Locked Down

From DailyTech: Sony Corp.'s new SVP & Chief Information Security Officer, Philip Reitinger, certainly has his work cut out for him. While beloved by many gamers, Sony is also loathed by many hackers for its such tactics as trying to sue modders of legally purchased consoles into oblivion and trying to get PSN users to sign away their rights to sue Sony for negligence.

That vehemence led to it getting mauled in a series of intrusions[5][6][7] this spring, which struck a massive blow both financially and in terms of reputation for the electronics giant.

Reitinger announced on Monday that his staff had detected a major, concerted effort to attack Sony's online services -- the Sony Entertainment Network (SEN), the PlayStation Network (PSN) and Sony Online Entertainment (SOE). The new security chief accounts:

We want to let you know that we have detected attempts on Sony Entertainment Network, PlayStation Network and Sony Online Entertainment (“Networks”) services to test a massive set of sign-in IDs and passwords against our network database. These attempts appear to include a large amount of data obtained from one or more compromised lists from other companies, sites or other sources. In this case, given that the data tested against our network consisted of sign-in ID-password pairs, and that the overwhelming majority of the pairs resulted in failed matching attempts, it is likely the data came from another source and not from our Networks. We have taken steps to mitigate the activity.

The attacks appeared to use a large database of usernames and passwords, which Sony believes came from a third-party. Sony backs this hypothesis by point to the fact than only 0.1 percent of accounts appeared to have been compromised out of those where login was attempted.

While that's relatively good news for Sony, it still means that "93,000 accounts globally (PSN/SEN: approximately 60,000 accounts; SOE: approximately 33,000)" were compromised. As a precaution, Sony has locked down all of these accounts. The company will be issuing affected users an email, allowing them to reset their password.

View: Article @ Source Site