Security Expert: Sony Knew Its Software Was Obsolete Months Before PSN Breach

In congressional testimony this morning, Dr. Gene Spafford of Purdue University said that Sony was using outdated software on its servers — and knew about it months in advance of the recent security breaches that allowed hackers to get private information from over 100 million user accounts.

According to Spafford, security experts monitoring open Internet forums learned months ago that Sony was using outdated versions of the Apache Web server software, which "was unpatched and had no firewall installed." The issue was "reported in an open forum monitored by Sony employees" two to three months prior to the recent security breaches, said Spafford.

[awiseman]

More repetitive news, we established this eons ago -_-

[Goatfish]

time to move on....

[JokesOnYou]

This is not repetitive, when was it ever reported Sony was using outdated software for months *even after it was reported on forums monitored by sony employees? link please? Also of course this is new with this Dr testifying to congress about it. In fact hasn't all the sony faithful been saying sony had proper security in place? I don't know but I consider a firewall one of the most basic forms of internet security.

"According to Spafford, security experts monitoring open Internet forums learned months ago that Sony was using outdated versions of the Apache Web server software, which "was unpatched and had no firewall installed." The issue was "reported in an open forum monitored by Sony employees" two to three months prior to the recent security breaches, said Spafford."
http://consumerist.com/2011...

-damm that guy is on C-Span testifying before the House Subcommittee, he must know something, do you think he would make such a accusation if he couldn't prove it? Not good sony, not good.

[tplarkin7]

Sony pinches their pennies at the wrong place and the wrong time.

[Darkfocus]

for information thats well established it certainly seems like no one on N4G knows it seeing as almost every one here thinks sony committed no faults in this whole mess....

[Philaroni]

Not sure if I would call it a fault, I mean not like I have some ADT Security system at my home or the latest and greatest locks. If anything this was a good thing since it forced Sony to upgrade all of this and they should have the most secure network after the fact. So if anything it might not hurt to look at it in a positive light.

Fact is security only matters if you are a target, I bet if they went around checking to see what the security of all the company's in the world where we would find most are much out of date. Upgrading this stuff cost lots of $$ and takes lots of time to do.

[Silly gameAr]

Isn't this the same article about him reading forum post that were months old with supposed Sony employees taking about PSN? There was one up, but It was failed earlier today because it was a dup.

[NYC_Gamer]

many of us on this site have said that sony should have had better security.

[soundslike]

...if its true that it was unpatched, then thats fairly ridiculous, isn't it?

I have a hard time believing something as simple(as simple as it is to do network wide) as a patch can go undone.

Unfortunately I don't think they'd let us know that detail, instead we get politically correct vagueness like "We understand that we hold responsibility to establish security parameters in order to move forward not unto a future of retribution, but of blah blah"

[Philaroni]

I'm always for better security, just saying that 99% of the time no company will spend the $$ to upgrade something like this till something like this happens.

My point is that its not as big of deal as people are making it out to be. There has been much much worse breaches in security in other company's that make this look silly.

That and for some reason people are making Sony out to be the bad guy and not the hacker. I'v not seen many articles about that.

If a person broke in your home and found your wallet and took all the info out you would blame them. Its not like Sony had no security and it is not like the hacker did this over night, I'm sure it took quite some time to plan. Sony should upgrade there security but should not be condemned by gamers like they have been due to the actions of another.

I feel like the point I am trying to make is not getting though....

[gamingdroid]

The amount of security is dependent on the value of the data.

Other than SSN and maybe medical information, there is nothing more worthy of protection than credit card numbers from a consumer standpoint. Certainly it ranks only 2nd to SSN for theft target.

You not having ADT at home probably means the value of the possesions isn't that much, and if it happened it most likely affect you and your immediate only.

Now, when you are protecting 77 million peoples data with valuable credit card information, I think it qualifies as high security with high probability of attempted theft.

@soundslike:

In a live environment you don't want to just patch stuff due to compatibility so there is short lead time for testing. How bad it was un-patched remain unknown, but not having a firewall is negligence.

Even a computer purchased by your mom comes with a firewall straight from the store!

[hmmmm]

@Philaroni
Your analogy isn't really correct either..
It's more like giving your friend your wallet To keep in their house, then they leave it on the night stand by an unlocked front door when they aren't home. Of course the thief is to blame but your friend could have kept your wallet somewhere safe or at least locked the door.

[nycredude]

All you guys blaming SOny are idiots. Next time when someone gets raped, you gonna say its her fault cause she didn't have a chastisy belt on? When someone gets shot you gonna say it was his fault for not having a bullet proof vest on? How about if you get robbed , is it your fault for not having adt? And if they get pass the adt will you admit it's your fault for not having a gun or a rotweiler?

Come on enough is enough a crime was committed here and it wasn't SOny who committed it. I hate to break it to you but I am sure all of you guys get spam mail and email. YOur info is already out there before this happened. cc info is useless without either expiration date and/or security numbers. And if they get that every cc card is protected from fraud and has protocol in place when you buy something expensive.

Have anyone here really loss anything besides 2 weeks of online? This is getting stupid, and it is the same old trolls at it.

[testerg35]

nycredude, so you wouldn't blame your bank if they got robbed and they didn't have any cameras, security guards, alarms, and had an open vault?

I'm guessing you wouldn't blame your credit card company if they just put your information in an open shared drive?

You would just blame the people who stole the information?

[Legion]

@Philaroni

Lets correct your scenario. If you were at a hotel and put your valuables in the hotel safe. A robber came in and took your valuables because he new the hotel safe was rarely locked at night. Did the hotel not have fault in the scenario? They gathered your valuables from you to secure it and yet did not properly secure it. Yes the thieves took your info... but the hotel was responsible to secure the valuables.

[blackmagic]

@philaroni "If a person broke in your home and found your wallet and took all the info out you would blame them"

You seem to be assuming that Sony "wasn't home" when the servers were broken into but they WERE home. If someone broke into my house and picked up my wallet while I was home they would find themselves staring down the long black steel barrel of my shotgun and that would be the end of that. Wallet secure.

[the_kutaragi_baka]

i hope Sony learned their lesson from this failure and to make sure it doesn't happen again.

[BeAGamer]

i am disappointed dawg

[iliimaster]

and this gives someone the right to hack into it and steal credit card and other data? ur killin me smalls... just because a window is broken in a house doesnt give you the right to jump thru the window and steal everything...... if they can find this bin layden homo in a forign country they will find all these hackers or for the most part a few who will plea a deal only to rat on the others and hello 3 meals a day and concret walls!

[gamingdroid]

Nobody contested the guilt of the thieves. Isn't it obvious?

The issue is just don't shift the blame to the thieves alone.

I mean if your window is broken and you leave a gold diamond on the table within reach, you can't say you weren't partly to blame for your negligence?

[Legion]

Exactly... if it was a banks window and they didn't fix it then they also were to blame for not securing the facility.

[Fulensenca]

"Security Expert: Sony Knew Its Software Was Obsolete Months Before PSN Breach"

But why we are informed just now by those experts? If it was so obvious months ago why don 't tell it earlier?

I mean with all the tons of informations and articles every day we see on N4G ( from very important ones to the most silly articles you can imagine ) it is a little strange that no one never talked about something so evident. I mean, come on, a lot of people knows about this for months and no one talks ... hmmm.

I don' t know where the truth exactly is and maybe I' m wrong but this is ambiguous. And I don' t believe it.

[4Sh0w]

uhm, "experts" work for somebody they dont just patrol the internet searching for possible security breaches and reporting them to random companies, No companies are responsible for managing their own security, these guys are simply pointing out that after investigating sonys network according to this guy there were reports of obsolete security months ago. Seems this situation is going to get worst before it gets better.

[Fulensenca]

I see, but the fact we had to wait almost two weeks to hear this from an expert without any leaks before when some people knew about it for months ... well, it' s hard to believe to me honestly.

Why no one, no experts said this the day it was clear the PSN was turned off because of security problems? Again, I' m not an expert, but in the internet age it sounds wierd to me.

[ironwolf]

When one bothers to look for and read news some place other than game forums and blogs, they often find things that they won't otherwise see.
For example, Wired.com carried, about 3 days ago, an in depth article on who first discovered these flaws and when they began reporting and discussing them online. But of course, paying attention to the world at large is probably to much to ask of most of the people here.

[MrBeatdown]

I'd like to see where gramps is getting his information.

[ironwolf]

It's called "reading IRC chat logs and Usenet posts". Something often done by people that actually know something about network systems. Like major University professors.

[gamingdroid]

... and not fanboi gamers!

[MrBeatdown]

Wow, people give thumbs down now when you tell people you'd like to see something firsthand.

So are people just angered that I don't immediately accept what this guy says as absolute fact, and am not ready to burn Sony at the stake over it? Or is there a large elderly readership on this site that would take offense to my use of the term "gramps"?

[death2smoochie]

Oh crap...Sony...expect even more lawsuits now...

[slavish3]

lol i graduated from Purdue University yeah@@@@@@@@@@@@ purdue@!!!!!!!!!!!!!!!!!

[UP]

Oh they were in the process of moving their main servers to a more secure area. Remember that guys.

[UP]

It takes time to upgrade security. there is not just a button that wil suddenly give supper amazing security for a huge system.

[testerg35]

So what does that mean?

[Darkfocus]

that's why networks undergo regular maintenance....sony was aware of this issue months in advance and yet they didn't act on it until after it was too late, that's negligence my friend...

[gamingdroid]

that and you don't egg the public into hacking you. If you do, be prepared for the onslaught as well as for the outcome.

Nothing is un-hackable, other than an non-networked computer. However, you can probably social engineer your way into that too.

[DWOM]

I hate to say that but it's kinda true... Sony use outdated security systems... but hell they are upgrading it and hopefully they will be more secured than ever before!

[gypsygib]

PS3 is going to cost Sony A LOT of money, just when they got out of the red they'll be fighting law suits for billions.

Oh well, at least they built a great library of games for PS4.

[DWOM]

That stiupid lawsuit is retarded, and I think most of us know that mofos won't win... Sony should learn from their mistakes, but they won't loose money.... they have tons of game, tons of consoles that sale a lot, and other electronics.... So don't worry about their money lol

[drsnobby]

Sony knows better than that,there is no excuse.as the old saying goes"you play pussy,you get fucked" Sony deserves what it,s hand called for.treat your customers with respect next time you morons.

[mummra08]

you must love sony they just keep on giving i found a use for blueray you can fit all 77 million users details on one disk for the hackers gooooooooooooo sony and bow down you little Penguins