@clr84651 said:
@lundy86_4 said:
@arkephonic said:
Remember when Lems used to bash PSN and say Xbox Live was unstoppable?
Lol...
In all fairness, remember when PSN was hacked and millions of individual's information was stolen? I mean, if we're going to be petty...
Yes hackers hack both, but there were a lot of Xfans saying Xlive was unhackable and slammed Sony for letting PSN get hacked.
MS gets DDoS'ed. So some Xbox nerd misses out on a few hours of video/gaming time while a bunch of dumb fvcking cows try to make it sound as bad as the 2011 PSN hacking.
Meanwhile, over at Sony:
Shocking: Sony Learned No Password Lessons After The 2011 PSN Hack
from the sony-is-as-sony-does dept
The great Sony hack of 2014: what's it all about? Is it a subversive plot by North Koreans operating out of China in revenge for a film starring two guys from Freaks and Geeks? Or maybe it's simply fodder for stupid politicians to remind us that all the world's ills could be cured if only internet service providers took on the challenge of fixing all the things in all the places? No, my dear friends, no. The Sony hack of 2014 is a beautiful Christmas gift (your religious holiday may vary) of a wake-up call to anyone silly enough to think that Sony would bother to learn the lessons very recent history has tried to teach it.
To prove this, one need only review the latest file dump in the leak, which features the wonderful naivete of whatever bright minds are in charge of Sony's internal password conventions and storage policies.
In a small file titled "Bonus.rar," hackers included a folder named "Password." It's exactly what it sounds like: 140 files containing thousands upon thousands of private passwords, virtually all of them stored in plaintext documents without protection of any kind. Some seem personal in nature ("karrie's Passwords.xls") while others are wider in scope ("YouTube login passwords.xls"). Many are tied to financial accounts like American Express, while others provide access to corporate voicemail accounts or internal servers, and come conveniently paired with full names, addresses, phone numbers, and emails.
In case you're unfamiliar with the hack against Sony's Playstation Network a mere three years ago, the problem was -- you guessed it -- the exact same thing. In that case, the hack produced customer names, addresses, emails and login/password information because that information was stored in plain text, contrary to the advice of every competent network security person on the planet. Take, for instance, one security researcher quoted in the link above:
Passwords in plaintext? These guys are pretty bad - I don't think I've ever encountered this before. What's the point of using common password storage/hashing techniques if your staff is keeping all your passwords in plain text on open fileshares? Shit, why bother having locks on the doors at all?
The worst of all the problem's this hack revealed is that this question should have been answered in the wake of the events of three years ago. It's one thing to screw up. It's quite another to screw up in a manner that went public in a spectacular way and simply refuse to take measures to ensure it doesn't happen again. But that's Sony for you: long live plain text.
____
"Bububut that's SPE."
No shit, and the point obviously went right over your head because you're probably too busy trying to think of ways to defend their dumbassery. This is obviously a company-wide problem if it's spread to multiple divisions.
And at this point it wouldn't even come as a surprise to most if the SCE division was still holding their customers CC#s/login credentials in plain text.
It's pretty obvious that they didn't learn, but hey, you're more than welcome to give them another free pass.
Stupid customers supporting stupid companies.
Log in to comment