Sony's Servers: outdated software, unpatched and no firewall

Toggle sidebar Toggle sidebar
J

JockoJohnson

Golden Member
May 20, 2009
1,417
60
91
BladeVenom said:
Even after it was publicly disclosed that their systems were vulnerable, they never fixed them. So Sony left the door wide open, and didn't even care. Talk about criminally negligent.
http://consumerist.com/2011/05/secu...re-was-obsolete-months-before-psn-breach.html
Click to expand...

After reading the comments in the link, and if even half are true, I hope Sony gets sued for everything. That is truly pathetic if they were aware of it all for months. One of the comments even mentioned that the PSN was shut down NOT due to the breach but that people could download everything for free.
 
B

bfdd

Lifer
Feb 3, 2007
13,312
1
0
Sony is done. After the DRM bullshit they pulled a few years ago, I told myself I'll be extremely cautious buying Sony products. After this... yeah, never again. So glad I skipped on buying a PS3 for myself last Christmas.
 
J

jackschmittusa

Diamond Member
Apr 16, 2003
5,972
1
0
I have been boycotting Sony since the since their rootkit fiasco. The keep finding new ways to make me think it is the right choice.

They have never cared about their customers, and prove it over and over again.
 
Schadenfroh

Schadenfroh

Elite Member
Mar 8, 2003
38,416
4
0
My word, that is some pretty pitiful incompetence, they are going to get their asses handed to them in court.

After the DRM bullshit they pulled a few years ago, I told myself I'll be extremely cautious buying Sony products.
Click to expand...
You mean the SonyBMG music rootkit? To be fair, that music company was a joint venture that Sony did not hold a majority stake in at the time.

If you are referring to SecuROM in video games, then yes, that is their crappy software.
 
BrunoPuntzJones

BrunoPuntzJones

Lifer
Feb 24, 2001
14,513
4
81
freegeeks said:
must be crappy sys admins maintaining these systems
Click to expand...

IT is a source of expense, not revenue. Usually low on the totem pole when IT asks for money to fix stuff.

Could be negligent or incompetent system admins, or it could be they were doing the best with what they had available.
 
B

bfdd

Lifer
Feb 3, 2007
13,312
1
0
Schadenfroh said:
My word, that is some pretty pitiful incompetence, they are going to get their asses handed to them in court.


You mean the SonyBMG music rootkit? To be fair, that music company was a joint venture that Sony did not hold a majority stake in at the time.

If you are referring to SecuROM in video games, then yes, that is their crappy software.
Click to expand...

I was talking the rootkit fiasco, but SecuROM is terrible as well. So we'll just say I was talking about both. I don't really care if SonyBMG was a subsidiary of the larger Sony Corp, it held their name and their money behind it.
 
lord_emperor

lord_emperor

Golden Member
Nov 4, 2009
1,380
1
0
BrunoPuntzJones said:
IT is a source of expense, not revenue. Usually low on the totem pole when IT asks for money to fix stuff.

Could be negligent or incompetent system admins, or it could be they were doing the best with what they had available.
Click to expand...

sudo update apache doesn't take a lot of resources.
 
Jaskalas

Jaskalas

Lifer
Jun 23, 2004
35,569
9,813
136
lord_emperor said:
sudo update apache doesn't take a lot of resources.
Click to expand...

If the server doesn't function or boot after that update? Wouldn't be the first time. Can't just throw that command around on a live production machine. You have to have verified and reproducible results.
 
D

dmcowen674

No Lifer
Oct 13, 1999
54,889
47
91
www.alienbabeltech.com
BladeVenom said:
Sony's Servers: outdated software, unpatched and no firewall

Even after it was publicly disclosed that their systems were vulnerable, they never fixed them. So Sony left the door wide open, and didn't even care. Talk about criminally negligent.
http://consumerist.com/2011/05/secu...re-was-obsolete-months-before-psn-breach.html
Click to expand...


freegeeks said:
must be crappy sys admins maintaining these systems
Click to expand...

Someone there should be facing 120 years prison time and $800,000 in fines
 
S

shurato

Platinum Member
Sep 24, 2000
2,398
0
76
Jaskalas said:
If the server doesn't function or boot after that update? Wouldn't be the first time. Can't just throw that command around on a live production machine. You have to have verified and reproducible results.
Click to expand...

That's why there are trained IT professionals that deal with things like that. There's always a chance any server may not function or boot after an update/reboot. Sony should have the resources to maintain a top notch IT staff. If it is really true there wasn't even a firewall, that's pretty much criminal negligence. I can't believe this is really the case... When I used to be a consultant, we had 1 man operations even running business class firewalls on their servers.

On an unrelated note, I've had 2 playstation 3's die on me. I don't even use one for gaming but for Blu-ray movies and a media center.
Don't think I'll be buying anymore Sony products for a while.
 
Last edited:
wuliheron

wuliheron

Diamond Member
Feb 8, 2011
3,536
0
0
BladeVenom said:
Even after it was publicly disclosed that their systems were vulnerable, they never fixed them. So Sony left the door wide open, and didn't even care. Talk about criminally negligent.
http://consumerist.com/2011/05/secu...re-was-obsolete-months-before-psn-breach.html
Click to expand...


Sony didn't just leave the door wide open, they left it open after stirring the hornet's nest. First they took Geohot to court and pressured him into settling out of court when he did nothing illegal, then they went after every little kid and hacker that pirated one of their games without first making sure their asses were covered. Even after Anonymous hacked their servers they still didn't bother to cover their fat asses. That's not criminal neglect, but outright sadism and masochism.
 
F

freegeeks

Diamond Member
May 7, 2001
5,460
1
81
BrunoPuntzJones said:
IT is a source of expense, not revenue. Usually low on the totem pole when IT asks for money to fix stuff.

Could be negligent or incompetent system admins, or it could be they were doing the best with what they had available.
Click to expand...

yeah but running unpatched apache webservers with known vulnerabilities?
keeping the basic stuff up to date is not a million dollar investment, it's the day to day responsibility of the sys admin
 
F

freegeeks

Diamond Member
May 7, 2001
5,460
1
81
Jaskalas said:
If the server doesn't function or boot after that update? Wouldn't be the first time. Can't just throw that command around on a live production machine. You have to have verified and reproducible results.
Click to expand...

if they don't have some kind of test setup that is a mirror of the live, then they are the most incompetent morons. We are talking here about a system that serves millions of customers

seriously, not patching known security issues in stuff like apache is just beyond stupid
 
A

Ancalagon44

Diamond Member
Feb 17, 2010
3,274
202
106
Yeah its hard to believe that they wouldnt have a staging or UAT system for stability testing.

I dont think Sony's give away will be enough to repair damage to its brand image either, especially if knowledge of why the attack happened (ie negligence) gets out. How many consumers will never trust Sony with their credit card information again? I know I wouldnt.
 
Dr. Zaus

Dr. Zaus

Lifer
Oct 16, 2008
11,764
347
126
Sony's got a principle they live by: Lead, don't follow.

Which is great... except in technology, where following means industry standards.

Fuck Sony.
 
P

PokerGuy

Lifer
Jul 2, 2005
13,650
201
101
Sony has always shown disdain for their customers' interests. The rootkit and their use of DRM etc is pretty damning, and this is all just icing on the cake. I hope it ends up with people around the world suing Sony into oblivion, they certainly deserve it. No impact to me though, I own no sony products (including movies, music, games), and have no intention of doing so.
 
Cerb

Cerb

Elite Member
Aug 26, 2000
17,484
33
86
Marlin1975 said:
Contact Jack, President and CEO Sony Computer Entertainment America, and tell him what ya think. ;)

http://consumerist.com/2010/02/reach-playstations-ceo.html
Click to expand...
"Dear Jack,

I haven't been buying anything with the Sony label on it since around 2003, and don't plan to do so again. Anything you do now will be too little, too late. Even if you reinvented your company, like IBM did, and copied Nintendo's customer-loving ways in that process, I would hesitate for many years, before I would again be willing to buy a Sony product."

Um...yeah, maybe not.
 
E

Exterous

Super Moderator
Jun 20, 2006
20,568
3,760
126
freegeeks said:
yeah but running unpatched apache webservers with known vulnerabilities?
keeping the basic stuff up to date is not a million dollar investment, it's the day to day responsibility of the sys admin
Click to expand...

Until more comes out I am not going to immediately jump on the sys admins. I have seen too much bureaucratic bullshit get in the way of good (hell - even basic) security practices. I wouldn't surprise me to find out that they wanted to patch them but some dumbass and/or stupid policy kept them from doing so
 
You must log in or register to reply here.

TRENDING THREADS

COMPANY
RESOURCES
FOLLOW
Top Bottom