Security expert testifies Sony servers went unpatched

By | May 6, 2011, 11:24am PDT

Sony used outdated software on its PlayStation Network servers, according to the testimony of a security expert sitting before a congressional subcommittee.

As reported by The Consumerist, Dr. Gene Spafford, computer science professor at Purdue University, testified that Sony used versions of the open source Apache Web server software that went “unpatched and had no firewall installed.”

In recent weeks Sony’s seen its PlayStation Network, Qriocity and Sony Online Entertainment services compromised, leading to the exposure of more than 100 million user accounts. Some credit card accounts have been taken along the way.

Sony declined to participate in the subcommittee hearing. Instead, Sony Computer Entertainment America chairman Kazuo Hirai sent a letter outlining the company’s efforts and implicated someone associated with the the “hacktivist” collective known as Anonymous as the possible culprit.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

A long-time veteran of the Apple news business, Peter has also spent more than fifteen years covering games and the game industry. A self-proclaimed Alpha Nerd, Peter also professes a love for anime, sci-fi cons, gadgets of all kinds and various geek subcultures.

Disclosure

Peter Cohen

Peter Cohen does not own any stock or have any investments in any of the companies he writes about.

Biography

Peter Cohen

A resident of Cape Cod, Massachusetts, Peter has spent more than fifteen years writing about games and the game industry. For a decade Peter was senior editor for Macworld magazine, writing online news and covering the Apple game beat in Macworld's Game Room column.

Peter is currently executive editor for The Loop, an Apple news and analysis site founded by former Macworld editors. He's cohost of Angry Mac Bastards, a weekly podcast that viciously eviscerates some of what passes for Apple-related news and analysis in the tech blogosphere.

Peter is also a freelance technology journalist and reviewer whose words can be found in Macworld, Mac|Life, MacUser, MacFormat and Tap! Magazine.

53
Comments

Join the conversation!

Just In

RE: Security expert testifies Sony servers went unpatched
maurisource 5th Nov
@Economister exactly said, just the way they treat their customers, it's a big slap in their face.
creation web
0 Votes
+ -
It coulda been mesothelioma
Robert Hahn 6th May 2011
This almost makes me want to turn into a lawyer.

They took people's credit card data, stuffed it onto a server, and didn't even keep the software up to date with the security patches?
0 Votes
+ -
Agree, it is .....
Economister 6th May 2011
@Robert Hahn

the height of arrogance and reckless irresponsibility, but this is Sony, so maybe it is not surprising.
I agree with your point, please share with us more good articles.
advertise jobs
@Economister exactly said, just the way they treat their customers, it's a big slap in their face.
creation web
has dozens of security holes in it. I'd bet they've updated it now but they'll still get hacked again if whoever did it still cares...
@Johnny Vegas

LOL Do you really believe all that FUD you spew?

How do you know it'll still get hacked? Because it doesn't have a Microsoft logo on it?

more LOL...
If you asked someone to look after your child, you would expect them to keep it safe and look after it like you would.
Sony let your baby play in the middle of a busy road! Is it then a surprise that this happened? Banquetes
I was lucky to not have used a credit card and to have used a weird username. 777live
What I really want to know is when does PSN will be working again. I remember Sony saying that it will be working this week???
@Robert Hahn

corporate governance?
0 Votes
+ -
Message has been deleted.
neilpost Updated - 10th May 2011
@neilpost

Remember the DRM rootkit? Sony isn't dumb, just arrogant.
@Robert Hahn ... Better yet, they kept them on the same server as the rest of the stuff including 'net accesses? Time to abandon Sony IMO until they prove they've straightened out their act and said so publicly.
0 Votes
+ -
There is no one else to blame sony.
0 Votes
+ -
What IF
zapped70 6th May 2011
There is someoneElse to blame... How about the Hackers that did this. Sony is the victum plan and simple. You may not like them or their attitude but they did not hack themselves. I am sure the other game companies are triple checking their networks right now. It's like someone broke into to your friends house and stole a bunch of stuff but he didn't have a very good lock so it's his fault..really?????
0 Votes
+ -
House analogy is bad
Michael Alan Goff 6th May 2011
It's more like a bank analogy. Imagine your local bank had rusty locks and one barely functioning camera. Yeah, the people who stole your money are to blame... and so is the bank.
0 Votes
+ -
I blame it on us
Bill Pharaoh 6th May 2011
@goff256
we let these people get off once caught because nobody was physicaly hurt, no property was physically taken, it's just money. And for those that do get jail time, and not a suspended setence (or a job at a security form) they just go back and do it again

When my card data was stolen and used to purchase crap online I got the money back in 2 weeks, but that was two weeks I couldn't use my own money! Imagine if that was my only account, I would have been late on payments and stuff, or my credit ruined.

We're the blame here because we don't treat it like something that could affect our lives moving forward (for many it does hinder or destroy their lives down the road.

Well, I say "catch and kill" so they're no longer around to do it again, maybe the next guyt would like the thought of living more then the thought of getting caught and counting the hours to his death.
@goff256 ... Duhhh, I think that was his point.
@zapped70 They still share some responsibility. They should have at least taken reasonable measures to protect sensitive data. I don't think that installing critical security patches and using simple encryption is too much to ask for.

And yes, if someone broke into my friends house and stole a bunch of stuff I was letting him borrow, and I learned he left the windows and doors wide open, I'd punch him. Sure, I'd realize that its not completely his fault, but he could have gone through simple measures to prevent it from happening.
@vel0city

A friend asked to borrow my truck At the time he didn't have a valid driver's license. I told him my insurance probably wouldn't pay if i let an unlicensed driver drive the truck and he had an accident.

He said "I've never had an accident."

And i replied: "Bill, there's a reason they don't call them 'purposes."

Contributory negligence is a very real legal concept.
@zapped70

Sorry, but US laws are very clear on requirements for ANYONE to house credit card data and Sony breached these laws by not having proper protections in place. Not only that, this is commone sense IT kinda stuff, so Sony is absolutely to blame here.
@zapped70

which galaxy are you on friend.

there is a baby duty-of-care involved. No?
@desilvav
No PCI-DSS obligations are global.

If you ignore them you are a dumb-fcuk and should lose your rights to process card payments.
@zapped70
Do you lock your house when you leave for work ?

If not, your are as dumb as Sony.

What's your address, I'll come round and rob you.
0 Votes
+ -
RE: Security expert testifies Sony servers went unpatched
nickdangerthirdi@... Updated - 9th May 2011
@zapped70 short answer... YES its sony's fault, its no different than leaving you car unlocked at the football game, when you left your work provided laptop in it, people are going to go through trying all the doors, when yours opens because it wasnt locked, your laptop is gone, and its your fault, because you didnt lock the door, The place you work trusted you with that laptop, and you violated that trust, just like people trusted sony with their CC numbers and sony left the back door open, and someone stole all that data we trusted them with, This is absolutely sony's fault for not patching their servers.. thats not to say having it patched wouldnt have prevented it, but it would have helped if Sony could at least say "we did everything we could" but they didnt and they cant....

guess that wasnt so short
If it was that easy why was it classifed as an extremely complicated attack...using "cover" from another hacker group. Sure Sony could have done more... but I could have done more to protect myself too. Sony is the easy target; that is all I am saying. besides I like my Analogy better... happy Hackers are still the reason I am not playing Mortal Kombat on line right now
0 Votes
+ -
I still say Sony is more to blame than you do. People are trusting them, though likely not anymore, with their credit card information. This could, and likely has, ruined people's entire financial lives.
0 Votes
+ -
WARNING to PSN users
Animus et Illuminat 6th May 2011
A third attack (and subsequently a fourth and fifth) are being planned as we speak (with the third planned this weekend, OR upon initial restoration of PSN services). Those who have stuck with Sony through this mess will have a decision to make soon. Sony was warned. The Ops will continue indefinitely...
@Animus et Illuminat
0 Votes
+ -
RE: Security expert testifies Sony servers went unpatched
Animus et Illuminat Updated - 6th May 2011
@zapped70-I dont play video games, I make them. Jacksonville fan huh? Why not the Panthers?
0 Votes
+ -
Get a life
Michael Alan Goff 6th May 2011
That is all.
0 Votes
+ -
A CS Professor?
vel0city 6th May 2011
Why does it take a CS professor to figure out that they didn't use the latest patches?
0 Votes
+ -
testifying before congress...
shryko 6th May 2011
@vel0city

not just anyone will be allowed to speak in front of a congressional hearing... They only want people who are experts, not common workers. In turn, we get professors telling us that it was something any freshman could identify.
0 Votes
+ -
Where?
Qbt 6th May 2011
Hey where is that guy that always posts comments here on ZDNet that if they used Linux that stuff like this would never happen?
0 Votes
+ -
@Qbt-If they only used Linux this wouldn't have happened!
If you asked someone to look after your child, you would expect them to keep it safe and look after it like you would.
Sony let your baby play in the middle of a busy road! Is it then a surprise that this happened?
0 Votes
+ -
Witness the danger of open source
Tim Acheson 7th May 2011
The key vulnerability in this attack was Asterisk, a popular open source telephony system, which was exposed to the Internet at LastPass as it is by many organisations.

Being open source, hackers know the system in intimate detail.

The myth of open source economics is still being perpetuated, like a malignant superstition or religionus ideology. Whenever the total cost of ownership of open source (TCO) proves to be much higher, the proponents of open source rally together to make excuses -- none more so than those resonsible for the bad decisions.
0 Votes
+ -
@Tim Acheson
It was not Asterisk, it was an Apache Web server that was not updated and no firewall. This can happen to all un-patched servers.
My God, the American consumer has certainly moved form ignorance into the sewer..Why do the cable companies, cellphone providers , superstores, manufacturers etc get away with it ?? YOU..Dumbest consumers on the planet..Just go buy some more crap form them all,,that will teach them !!
If we up the penalties imposed on hackers, they will just move to Pakhistan. But, then we would know right where to look...
Wow, for a moment I thought this was going to be another Windows / IIS thing with the usual responses, then I saw "open source Apache Web server software" in the article. More proof that the security of your platform is really primarily dependent on the persons who administer it, not the software involved.
0 Votes
+ -
Locks? What are locks?
Dr_Zinj 9th May 2011
My house is protected by a druid, two attack cats, 4 treants, a number of very large, sabertoothed rodents, black ice, a pair of non-default firewalls, and a pair of well-armed teenage mutant ninjas.

Not to mention being surrounded by concentric thorn and poison ivy moats.
SONY isn't the only one to blame in this, I agree. However, this shows a huge amount of disservice and consideration of its customer base, so I hope they lose enough business/$$ that they either wise up or get out of the business entirely.
This is bad enough to keep me from having anything further to do with them.

The question I really have is: What do their policies say (if anything) about this kind of a situation? Did they violate their own policies? WAS there even a policy to cover it? I'm not going to go researching such a thing, but anyone who spent money there or used any of their services should have already read them; right?
Who, in there right mind would trust Sony with their data? After all, Sony did load your machine with a root kit so you could watch that shiny new DVD you purchased.

"Trust everyone, remember nothing", the mantra of the average computer user
This is also not some mom and pop store down the street, this is a huge multi-billion dollar COMPUTER making corporation with thousands of employees, they know better.
anon had nothing to do with it...just a scape-goat to cover their arrogance and stupidity...
I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate! nccma cooler
I used to be more than happy to seek out this internet-site.I wanted to thanks in your time for this glorious read!! I positively enjoying each little bit of it and I have you bookmarked to check out new stuff you weblog post. this thread is amazing i like your work and i appreciate you that you have share a useful stuff thanks for sharing the i shop abatwa
I used to be more than happy to seek out this internet-site.I wanted to thanks in your time for this glorious read!! I positively enjoying each little bit of it and I have you bookmarked to check out new stuff you weblog post.Bookmarking now thanks please consider a follow up post. power sa shop
I think the representation of this article is actually superb one. This is my first visit to your site. Thanks a lot and keep sharing the information. Keep updating the information for all of us. Thanks ZDNet Government was launched as the brand's first industry vertical, with a mission to cater to IT professionals in the public secto I agree with your post. However, do you have any sources I can cite for my paper wheel car com bury
Well welcome, hopefully you can become a vital member of the community and really help to push far ahead of google. Which Im sure the development team would love. This will of course earn you alot points too and get you on the leaders board. z d n e t t h a n k Im not sure i come to an agreement with you on every level, howevor it absolutely was a good posting, many thanks for taking the time to put up your ideas.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix