This is not a post to condemn legions of Playstation followers. This is simply a post educating the frustrated gamers who have been placing the entire blame on the hackers or elites who've compromised the network and their PSN accounts. The truth is a lot of this blame must also be shared with Sony.
"This is all the hackers fault"
"Hackers are ruining everything. This is not Sony's fault"
These are the kinds of comments that have been running rampant all over the forums, comment boxes and chat rooms. Sony's fanbase is a dedicated bunch but many of them are also very ignorant of how a network works. Not in just hardware or software but as a service as well. I have been in IT since the late 1990s and I have worked on networks design, network security as well as designing and programming enterprise-level platforms over the web. In end-to-end development, I've been through it all. The Playstation Network is no different from networks like Battle.Net. The only difference comes only in the form of defined hardware (console) and defined interfaces (controller) – which misleads many to think that the Playstation Network is at its most secure simply because there is no keyboard attached to their console.
Sony was very deliberate about their strategic plan over how they would architect their network infrastructure. Sony went for a low-cost tactical network with short-term goals. When 360 debuted back in 2005, XBox Live was charging. So, Sony's strategy was to keep things low-cost not just in terms of keeping customers happy but low-cost in terms of total cost of ownership (i.e. operating costs) and return on investment (profits). And although there is a place to build low-cost tactical networks, Sony simply did not understand the difference between building a less secure Good Enough Network verses building the Next-Generation Network for millions of Playstation owners can only go so far. The network is only as reliable as its weakest link. The cost of an outage or a security hack quickly eliminates any savings and can quickly erode the trust of PSN users. It's like putting cheap oil in your car.
It's really easy to spot a Good Enough Network:
- Late patchwork of features
- Lack of transparency to PSN users (i.e. direct messages from Sony to PSN users on upcoming updates).
- No updates to UI to accomodate content usage or new releases (i.e. same cross media bar for everything)
- Lack of security to encrypt credit card info
- Security Policies
- And lastly, Unencrypted Account Info
What is Security Policy?
On a typical network, when an employee connects to the corporate network from a smartphone, the network identifies the device and the user as well as the privileges granted them. If someone is abusing the system by identifiying the number of repeated pings (potential attacks) from the same identified device, the network admin can easily see these attacks and can then lock the account and/or the device.
On PSN, Sony can only identify the user when the user logs in to their PSN account. Under their Good Enough Network philosophy, there is currently nothing in the PSN/PS3 architecture that can be used as a unique identifier for the console when it goes on PSN. Go to the System Settings of your PS3 and you'll see the IP Address and MAC address: Both of which can be easily manipulated. Head to the same similar settings on the on the XBox 360, and you will see along with the IP Address and MAC address two distinct pieces of information: Console Serial Number and Console ID – both of which can be identified over the XBox Live network and which can be moderated and locked accordingly if the console were to be used to compromise security on XBL. That is not to say that XBox 360 and XBox Live are fullproof but the onstant updates and Microsoft's emphasis to educate XBL users in protecting their accounts puts a strong emphasis on network security.
Unencrypted Account Info
When an open letter goes out to PSN customers that their full accounts and credit cards were compromised, Sony confirms that they did not have any kind of security or encryption used to protect their customers from the very beginning. This is something that has been reported as far back as February by Ars Technica and several large media sites where hackers found account info in the clear without even a simple hash technique to hide the passwords. This is the worst case scenario and is disastrous to Sony in many ways. A simple end-to-end encrypted system would be virtually difficult (if not impossible) for even for Geohotz and Anonymous to pull information from accounts. But when information gets passed via HTTP (out in the open), a 30 minute tutorial can pull unencrypted information in seconds. Sony knew this but did nothing to fix this. Data encryption would have avoided the damaging announcement to warn PSN users and put their identities on fraud alert but they had no choice. It was obvious that Sony deliberated in meetings before posting the blog.
It's understandable to see Playstation Plus users and active shoppers livid over their compromised accounts – especially if they have used credit cards to pay for the service. But PSN users who play for free need to understand that free does not give Sony a free excuse to provide an inferior level of security or long network outages. Even if you don't have CC info, there's still the potential for your login info. And if you've been using the same login info for other sites, look out. This is more serious than what the Playstation fans feel is simply bad press or overreacting from PSN users. We are talking about your personal info here. Your identity. People must be aware of the damaging effects of identity theft. So please change your usernames/passwords and (if applicable) set your credit bureaus to fraud alert. The quicker you do this, the better off you'll be. Trust me. I don't need to get into this.
Looking to the future, as more online games, movies and music become part of everyday use on PSN, the strategy, reliability and security of the next-gen network becomes more critical and I'm hoping that Sony's rebuild of PSN is a lesson that trading away capability, strategic value and especially security for price is always a risky proposition and one I have seen fail time and again.
We all know that hackers can ruin the party but Sony also has to take responsibility for securing the network and rebuilding the trust of their fans.
Here's to hoping Sony has truly learned their lesson.
Link to cleaner version of this post. :)
http://www.lazytechguys.com/commentary/what-gamers-do-not-understand-about-the-playstation-network/
Log in to comment