Web-based PSN Login / Password Recovery Exploited

Submitted by greg; May 18, 2011

You'll notice trying to login to PSN via playstation.com that again the service is down for maintenance. Don't get it twisted though; on your PS3 console itself you can login just fine. PSN remains up. The problem lies in the web-based password recovery function where all that's needed is your email address and date of birth. Yup -- that's right... A database of 77 million user email addresses and birth dates was stolen. Put two and two together and you can figure it out. Your shit ain't necessarily safe, regardless of the forced password change in firmware 3.61. Originally reported by Nyleveia, the specifics remain under wraps:

While we will not reveal specific details regarding how the exploit is performed for obvious reasons, we can say that the exploit involves a vulnerability in the password reset form currently implemented, not properly verifying tokens.

What Nyleveia suggests: Creating a new email address somewhere, keeping it secret, and associating your PSN account with said new address; and never use that address anywhere else. Brutal... I guess the hired "recognised technology security firm" missed this one. - source: sony.nyleveia.com

Tags: exploits, PS3 Hacks, PSN

It wasn't even a phishing attack. They already had all the data, they could have just entered correct data into that form 77 million times and changed everyones password to whatever they damn well pleased! (I hope that form atleast used a good captcha so they couldn't use a macro.) Thats like stealing a car after you mugged the owner for the key.

If they didn't have credit cards yet, they probably could have logged in as you and gotten that data now...

# Guest 2011-05-18 22:08

Sony just made the sequel to Titanic. They cant even breathe with their heads so far up their own ass. Maybe they should hire some hackers a fire some suits.

# Guest 2011-05-18 22:11

Is Sony still using the password 1234 on all their servers, Cause they need to change that shit C'mon!

# Isaac Paul 2011-05-18 23:04

Who is in charge of their security? seriously first place people go to steal accounts is with password recovery pages. Maybe they should start hiring highschool nerds cuz they'll probably do a better job

# James Soileau 2011-05-18 23:21

Seems like some of the people they hired were also owners of ps3 systems and rightfully said in lame terms "Fuck your security Sony..."

# James Soileau 2011-05-18 23:34

Depends on your thoughts of what phishing are...

Phishing is an example of social engineering techniques used to deceive users and exploits the poor usability of current web security technologies.

So its using your "bait" to find further information.

*wiki shrug*

So yes they used information obtained to phish information whatever that may of been.... what part of that did you not understand?

OH WAIT your ideal of phishing is only emails and someone replying or maybe molesting cookies from browsers.....oh ok the simple minded view.

"If they didn't have credit cards yet, they probably could have logged in as you and gotten that data now..."

.....awesome contradiction of point.

# Curan Altea 2011-05-19 02:26

Maybe not cfw exactly, but modded os', flashcarts, modchips, etc. Hackers allways find a way.

# Yes Yep 2011-05-19 04:49

Why would they do that just because they own a PS3? Personally i dont think that these people would jeopardize their job and reputation over something like this :) I think that it is more likely that these firms only focused/worked on the PSN servers themself and not the websites. But i cant say for sure though, it is just a guess.

# James Soileau 2011-05-19 17:25

<sarcasm>
Come on really? I swear they own ps3's and its the whole point! REALLY!

</sarcasm>

Easier to identify?

# Yes Yep 2011-05-19 19:18

Are you being sarcastic now? Hehe

Seriously though, i know that what you wrote earlier was more ment as a joke, so i didnt mean to take it 100% serious as my reply maybe looked like, sorry about that. But i have read different comments online from other people who seems to really hate Sony, so it would not surprise me that much if someone actually thinks that one of these security companies might do this to Sony on purpose.

I dont read much of the comments on this site, so this is not aimed towards what you have said earlier just to underline that. I am only generally speaking when it comes to the comments i have read online from people who seems to really hate Sony.

:)

# James Soileau 2011-05-19 21:01

Well I may think they hold the dollar closer to big CEO's rather than security, make bad decisions in cutting intended features from items, try to label people who have a keen sense of knowledge as leaders in piracy and compensate in odd and remorseless fashion. There is one thing I do know, I do not hate the company as a whole. I believe there are misguided and perhaps uneducated "leaders" who make bad choices on top of bad choices.

You cannot intend to have success if your choices are to piss away your most abundant resource, Users.

Now take those users no matter what happens no one will forget the atrocities Sony has caused and continue to do so. I only hope one day they wise up and remember the fundamentals.

All too serious note....

# Yes Yep 2011-05-20 11:22

I dont think that anyone tried to label Geohot or graf_chokolo (which i assume you're reffering to?) as leaders in piracy, but that what they did (especially Geohot when he released the PS3 decryption keys) could easily lead to piracy, which is true. Some people have different opinions about this, if it was right or wrong.

Which compenstaion in odd and remorseless fashion do you mean by the way?

Personally, i also dont think that any company tries to make their consumers angry, but unfortunately sometimes though decitions have to be made, and these decitions can't always make everyone happy.

I think that people who "forget" these things either don't care much about it or they have understanding for it. But again, people have different opinions about these things =)

# jamar623 2011-05-20 12:24

nkb.kkjjb/lb

# sxyleexx 2011-05-20 15:47

heres a good one if anyone's up for it a video stream recorder i.e lovefilm or bittorent

# Ralkage 2011-05-21 00:28

Even a Zombie could hack Sony's servers and exploit them at the same time.

Tsk tsk.

# Guest 2011-10-13 01:08

Dubai SEO

Web Design Dubai

Is Sony still using the password 1234 on all their servers, Cause they need to change that shit C'mon!

Refresh comments list

Add comment

JComments


	CREATE ACCOUNT NOW TO POST COMMENTS! Why create an account on the Dashhacks network? Because being logged in has its privileges! • COMMENTS! Only logged in users comments go live without waiting for moderator approval! • No video! The video ad in the upper right doesn't interrupt you on all pages! • Customize your profile! Flaunt your xBox Live & PSN gamertags! • It's FREE and it's EASY! And one login works for all of the Dashhacks review sites! So what are you waiting for? Go to the TOP RIGHT of the page and LOGIN or click REGISTER!


	Would you like to get all the new buzz from Dashhacks in your email each day? Subscribe to our Daily Digest! Want to learn more about the team bringing the news to Dash Hacks? Click here to read about them

Web-based PSN Login / Password Recovery Exploited

Related Stories:

Comments

Add comment