PSN takes sites down after log-in exploit found

Just two days after the PlayStation Network was restored after a near month-long outage, the PSN password page has apparently been exploited. According to reports, the exploit allows other users to reset your account password using only your e-mail address and date of birth. This personal data was made available to hackers during the initial PSN attack.

The issue was first reported by Nyleveia, which was contacted by an unnamed source who reportedly performed the hack on a dummy account, prompting an e-mail message confirming that the password had been changed. Similar reports on gaming forum NeoGAF show an identical situation, in which the user provided the necessary information only to receive two subsequent e-mails: one claiming that someone was attempting to change the account's password and requesting the user click on a confirmation link, and another confirming that the password had been changed.

Nyleveia’s unnamed source demoed this breach to the staff to prove that it is a real threat, and Eurogamer has also seen video evidence that corroborates with Nylevia’s claims. Nyleveia has also passed what it discovered to Sony Computer Entertainment Europe. Since then, a number of sites have become inaccessible for login including:

PlayStation.com

PlayStation forums

all PlayStation game titles

PlayStation Blog

Qriocity.com

Music Unlimited via the web client

site where users are directed to to reset their passwords

In a brief statement confirming that the PSN has been taken offline, Sony said, “Unfortunately this also means that those who are still trying to change their password via Playstation.com or Qriocity.com will be unable to do so for the time being. This is due to essential maintenance and at present it is unclear how long this will take.

The report comes from gaming blog Nyleveia, which posted a warning to PSN users that their passwords might not be safe and contacted Sony about it.

Another blog, Eurogamer, says it confirmed the exploit, which allows someone to reset your password by knowing your e-mail address used for the account and date of birth. That information is known to be among the data belonging to 100 million users of Sony's gaming services that was exposed between April 17 and 19 in the second-largest security breach in U.S. history.

Eurogamer says users that changed the e-mail address connected to the PSN account after PSN was restored this weekend should not be at risk.

Yesterday, speaking to a handful of reporters, Sony CEO Howard Stringer admitted that while the company had rebuilt the security for PSN during the three weeks it was unavailable, no system could be guaranteed "100 percent secure.

Sony begins partial PlayStation Network operation

TOKYO—Sony began restoring its PlayStation Network service in the United States and Europe on Sunday after shutting down the service almost a month ago due to a massive security breach affecting over 100 million online accounts.

Restored operations are mainly limited to online gaming, chat and music streaming services. Sony said it aimed to fully restore the PlayStation Network by the end of May.

Sony also began Sunday a phased restoration of its Qriocity movie and music services which share the PlayStation Network's server, said Sony Computer Entertainment Inc. spokesman Satoshi Fukuoka.

The first phase of the restoration of services for North America and Europe will include sign-in for PlayStation Network and Qriocity services, including the resetting of passwords, the restoration of online gameplay across PlayStation 3 and PSP, playback rental video content if within rental period of PlayStation Store Video Store on PS3, PSP and Media Go, the restoration of Q Music Unlimited, for current subscribers, on PS3 and PC, access to third party services such as VidZone and MUBI, restoration of the 'Friends' category on PS3, including Friends List, Chat Functionality, Trophy Comparison and the restoration of PlayStation Home.

Sony has warned that the restoration of services on a global scale may take some time and said on Saturday that it would take hours to restore the PlayStation Network across the US.

The company has been working with outside contractors to ensure Sony PlayStation Network, Qriocity and Sony Online Entertainment are far more secure then before the hack that saw millions if users data stolen.

Network security breaches are part of a trend that saw the costs of such invasions jump 48 percent, to an average of $318 per compromised record last year, according to a March report by the Ponemon Institute.

Malicious attacks in the U.S. are on the rise. They climbed 7 percentage points in 2010, with data breaches costing U.S. businesses an average of $7.2 million per incident, according to the Ponemon Institute report. The study found that about 85 percent of all U.S. companies have experienced one or more attacks.

The use of a hijacked or rented server to launch attacks is typical for sophisticated hackers. The proliferation of server farms around the globe has made such misdirection easier, said E.J. Hilbert, president of the security company Online Intelligence and a former FBI cyber-crime investigator.