Leaked Letter from Sony Reveals More Details About PlayStation Network Hack
We have had a lot of news over the past 23 days about the hack and closure of Sony's PlayStation Network, but there are still a lot of questions over what exactly happened. Sony said in its letter to Congress that the attack was a "very carefully planned, very professional, highly sophisticated criminal cyber attack". And it certainly has set Sony back on its heels, with the network still down, and Sony still struggling to clean up the mess the hack has caused, and losing the trust of its users. Now, a letter sent from Sony to publishers of the PlayStation Network and Qriocity yesterday has been leaked, and we have a few more details about what happened.
Evidence indicates that the letter was recieved yesterday, and it does not say when services will be resumed, but it does explain how the hack was discovered. First, Sony says that it will only restore service "when we can ensure that the network can operate safely and securely". Then, under the heading "What Happened", Sony reveals that on Tuesday, April 19th, four PlayStation Network servers unexpectedly rebooted themselves, and that there was "unplanned and unusual activity" on the network.
Sony had an internal team investigate the four suspect servers, and the team discovered indications that an intruder had gotten access to the PlayStation Network system. Then, six more servers were identified as being compromised. That is when Sony shut down the network to prevent additional damage. The intruders used "sophisticated and aggressive techniques to obtain unauthorized access, hide their presence from system administrators and escalate privileges inside the servers." They deleted log files to hide the extent of what they had done within the network.
On May 1st, with the information from the forensic teams investigating the matter, engineers at Sony Online Entertainment found out that data had also been stolen from their servers, so on they also shut down operations and announced the discovery on May 2nd.
Sony then goes on to state again that they do not have evidence that credit card information has been stolen, and that major credit card providers have not seen an increase in fraudulent activity. This is despite the fact that security experts have warned that credit card data from PSN members was found for sale online. Sony again details the steps they have taken to compensate members, offering data theft protection.
They also detail the steps they are taking to repair the network and ensure its security, and state that they are working with the FBI to discover who is behind the attack. They also let their partners know that they cannot yet say when the network will be back online again.
There are still a lot of unanswered questions about this situation, and we will be following it closely. You can see our complete coverage of the PSN story here. The full text of the letter, originally posted on Industry Gamers is below.
Dear Partner:
As you know, certain PlayStation Network, Qriocity and Sony Online Entertainment service user account information was compromised in criminal attacks against our networks. I want to assure you, as a PlayStation partner, that it is Sony's top priority to restore our network operations and see that business is returned to usual as soon as possible. We are working around the clock to restore service, but will do so only when we can ensure that the network can operate safely and securely. In the meantime, we greatly appreciate your patience, understanding and goodwill.
What Happened?
• On Tuesday, April 19, 2011, Sony discovered that several PlayStation Network servers unexpectedly rebooted themselves and that unplanned and unusual activity was taking place on the network. This activity triggered an immediate response.
• Sony mobilized a larger internal team to assist the investigation of the four suspect servers. That team discovered the first credible indications that an intruder had been in the PlayStation Network system, and six more servers were identified as possibly being compromised. Sony immediately decided to shut down all of the PlayStation Network services in order to prevent any additional damage.
• The scope and complexity of the investigation grew substantially as additional evidence about the attack developed.
• The forensic teams were able to confirm that intruders had used very sophisticated and aggressive techniques to obtain unauthorized access, hide their presence from system administrators and escalate privileges inside the servers. Among other things, the intruders deleted log files in order to hide the extent of their work and activity within the network.
• On Sunday May 1, using information uncovered by the forensic teams, engineers at Sony Online Entertainment (SOE) discovered that data had also been taken from their servers. They, too, shut down operations and on Monday, May 2, announced the discovery.
What Data Are Affected?
As you may know, personal data was stolen from approximately 77 million PlayStation network and Qriocity service accounts.
As of this writing, there remains no evidence that the credit card information was stolen and the major credit card companies are still reporting that they have not seen an increase in fraudulent transactions due to this event.
What Steps Are Being Taken?
We have taken aggressive action to give consumers peace of mind, protect them against the abuse of their data, and enhance our security systems moving forward.
We have already advised our consumers in the U.S. that we will offer complimentary identity theft protection services through a leading provider, including an insurance program of up to $1 million. Similar programs are being developed in other markets around the world.
In addition, Sony is taking a series of steps to enhance security of our network infrastructure. They include but are not limited to:
• adding additional automated software monitoring and configuration management to help defend against new attacks;
• enhanced levels of data protection and encryption, as well as additional penetration and vulnerability testing;
• enhanced capabilities to detect software intrusions within the network, unauthorized access and unusual activity patterns;
• implementation of additional firewalls;
• expediting a planned move of the system to a new data center in a different location with enhanced security; and
• appointment of a new Chief Information Security Officer.
Finally, to thank our customers for their patience and loyalty, we are offering them "welcome back" packages as soon as the networks are restored, including free downloads of selected PlayStation entertainment, 30 days of free service as well as service extensions for the number of days PSN and Qriocity services were unavailable, with similar benefits for Music Unlimited subscribers.
Looking Ahead
We of course deeply regret that this incident has occurred. We are working closely with the FBI to identify and apprehend the culprits who committed this crime against our consumers, our partners and our company. I know you can appreciate how widespread the problem of cybercrime is in society today. Although no company is immune, we are confident our consumer data will be protected by some of the best security measures available today.
As a valued partner we aim to keep the lines of communication open so that you are aware of our progress. Our focus has been to confirm the security of the networks, protect customer data and get the services back on line as quickly as possible. We will do our best to respond to all of your inquiries and we will do everything we possibly can to support you.
We are doing everything we can to bring these services back online as soon as possible. We will update you with more information as soon as we can, but please call your account executive if you have further questions. We thank you for your patience and look forward to moving ahead together in the months and years to come.
Very truly yours,
Rob Dyer
SVP, Publisher Relations
[via Industry Gamers]