Article: Sony reveals how hackers infiltrated PSN security

[Zeus]

You can view the page at http://www.maxconsole.net/content.ph...d-PSN-security

[xxsnipexx]

Wow cool! What would Sony's application server be? Also, how was the exploit discovered?

[nestortoy@hotma]

"click the respective thumbnail".... Zeus is dumb.

[RzmmDX]

That... is just really really basic outline... so all the hackers did to the PSN is what any trojan does. So I could only conclude from that diagram, PSN has as much protection as a normal PC.

Compared to that PS3 Hack Team's presentation on the system architecture. That diagram is just failsauce.

[iceman1234]

That's it!! What a nooby setup.

[dvhh]

This figure has no real informations about the PSN hack, look like your typical OMFG hackers P0WNED my server

[Robotron]

I had read that they were running PSN using Linux on the cheap with very lax security (probably on PS3 clusters with the other-OS feature still there). Really a sad day for people who trusted them with their info. Never again Sony.

[iLLNESS]

Sony makes it look like it was some sophisticated attack. From what I read, the attacker just hacked into a remote computer that had remote access to the servers itself (aka, Sony didn't cover all bases).

Odds are, Sony doesn't have a secure internal network to begin with. Their servers were likely blocked from the outside world unless you were on their whitelist, but the remote computers with access probably never had any white/blacklists at all. I'm going to bet the computer was not behind a corporate firewall or anything like a good VPN setup between remote machines and servers would have.

Regardless, doesn't matter how it happened Sony got fucked.

[gooki]

So going by that image it was an inside job?

[realshompa]

I had read that they were running PSN using Linux on the cheap with very lax security (probably on PS3 clusters with the other-OS feature still there). Really a sad day for people who trusted them with their info. Never again Sony.

Since hackers got into the management console, it does not matter what kind of OS they used on the servers.

The problem here is that they used a windows machine as management console.

The whitelist described in another post in this thread is exactly how I have set up security. To get into these systems you need to know the hostname, IP address and somehow get into one of the servers thru a trusted console. When you are SU on one of the servers you can access all other whitelisted servers. The reason why we use this kind of security is that the servers can communicate with each other without sending password. Even if we encrypt the TCP/IP traffic, if someone can snoop the traffic they can extract the password.

[mattias800]

That's it!! What a nooby setup.

In what way?

[mattias800]

Sony makes it look like it was some sophisticated attack.

Oh really? In what way does that look sophisticated?

[cloporte]

Jesus ,

those Chinese sellers have absolutely no limit ...

I don't even think they are bots ...

[Asgaro]

Oh really? In what way does that look sophisticated?

Indeed.
You can actually use the descriptions used here for most intrusions.

They should show which security measures were bypassed. But of course they won't do this or we would all be raging even more.

Nonetheless I'll stay with Sony, nothing can beat their exclusives.

[danight]

Oh really? In what way does that look sophisticated?

Yeah really they just kinda drew a line through their servers... Like okkkkkk. That sure explains alot. (not really though)