Sony takes down part of PlayStation Network after URL error
IDG News Service - Nothing comes easy to Sony these days. The company was forced to take part of its Sony PlayStation Network offline briefly on Wednesday as it fixed a Web glitch that gave hackers a way to take over users' accounts.
Sony was hacked last month, and since Saturday had been bringing its PlayStation Network (PSN), Sony Online Entertainment network and Qriocity sites back online. To lock down the networks' security, Sony has been asking users to reset their passwords, but now a Web programming error has ground that process to a halt.
According to a discussion forum posting by Sony, the company has turned off its sign-in feature for PlayStation.com, Qriocity, PlayStation blogs, forums and gaming websites as well as Music Unlimited on the Web.
Midday Wednesday the company gave a vague description of what had happened.
"We temporarily took down the PSN and Qriocity password reset page," Sony spokesman Patrick Seybold said in a posting to its PlayStation blog. "In the process of resetting of passwords there was a URL exploit that we have subsequently fixed." Contrary to some reports, the site had not been hacked, Seybold said.
Sony didn't say exactly what it meant by "URL exploit," but according to the gaming blog Nyleveia, Sony's password reset page was configured so that anyone who knew their victim's e-mail address and birth date could take over that account.
Seybold said this was due to a "vulnerability in the password reset form," but did not publish details of how the password reset could be done.
"Consumers who haven't reset their passwords for PSN are still encouraged to do so directly on their PS3," Seybold wrote. "Otherwise, they can continue to do so via the website as soon as we bring that site back up."
About 77 million gamers use the PSN.
Another of Sony's networks, the Sony Online Entertainment network, is apparently unaffected by the problem. It continued to operate online Wednesday.
- Securing Mobile App Data - Comparing Containers and App Wrappers Analysts agree that Mobile Device Management (MDM) is not enough when it comes to securing app data. Although it remains a critical component...
- PCI 3.0 Compliance In this white paper, learn how PCI-DSS 3.0 effects how you deploy and maintain PCI compliant networks using CradlePoint devices.
- Mitigating Security Risks at the Networks Edge This white paper provides strategies and best practices for distributed enterprises to protect their networks against vulnerabilities, threats, and malicious attacks.
- 5 Strategies for Modern Data Protection Read the five strategies for modern data protection that will not only help solve your current data management challenges but also ensure that...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!