Playstation Network Down, Hack Confirmed.

[Rydian]

Playstation Network Down, Hack Confirmed
Personal information theft confirmed.

Amid much speculation, Sony has confirmed that an attack on the Playstation Network is what prompted them to shut it down for multiple days. The attack was the work of unknown individuals, and Sony has released a statement confirming that the personal information of Playstation Network users was likely stolen.[/p]

Although we are still investigating the details of this incident, we believe that an unauthorized person has obtained the following information that you provided: name, address (city, state, zip), country, email address, birthdate, PlayStation Network/Qriocity password and login, and handle/PSN online ID.
In addition, Sony warns that credit card information may have been compromised as well, and warns PSN users to take steps to protect themselves.[/p]QUOTEWhile there is no evidence at this time that credit card data was taken, we cannot rule out the possibility. If you have provided your credit card data through PlayStation Network or Qriocity, out of an abundance of caution we are advising you that your credit card number (excluding security code) and expiration date may have been obtained.

A breach like this was not wholly unexpected.

Ever since the famous 27c3 presentation, hackers investigating the PS3 have determined that Sony's actual efforts at network security are minimal at best; Sony relies on the PS3 being secure to hide information on how the PSN operates. A "security through obscurity" approach like this shows how little effort Sony has actually put into the security of the system as a whole. Various hackers have learned much of how the Playstation Network operates by examining the inner workings of the PS3, which are often unencrypted or simply not checked server-side.

An excerpt of an IRC conversation (linked below) reveals much about the PS3 and Playstation Network's inner workings, though it should be noted that the authenticity of the conversation has not been confirmed.

Information about this incident is still coming in, things may be proven true or false in time.[/p]

Sony's Statement

Hacker IRC Discussion

On-going Discussion (Privacy)