Sony suspends thousands of accounts after another PSN attack

JAPANESE HARDWARE GIANT Sony has locked down 93,000 accounts on its Playstation Network (PSN), Sony Entertainment Network (SEN) and Sony Online Entertainment (SOE) service after they were compromised during a recent brute force attack.

The incident was announced by Sony's chief information security officer Philip Reitinger, who explained that the company detected an attempt to test a massive number of credentials against its user database.

Because the attack had a very small success rate, Sony believes that the sets of usernames and passwords were stolen from other companies and were just being checked for validity on its own services.

"Given that the data tested against our network consisted of sign-in ID-password pairs, and that the overwhelming majority of the pairs resulted in failed matching attempts, it is likely the data came from another source and not from our Networks," Reitinger explained.

It's not clear how the attack was executed, since live authentication systems usually have restrictions in place that prevent many login attempts from the same IP address over short periods of time. That's why brute force attacks are usually performed against local database copies.

Botnets can sometimes be used to bypass authentication restrictions, but given that in this case the attackers managed to validate 93,000 accounts despite a poor success rate, either the botnet must have either been huge or Sony's systems must have lacked proper protections.

According to Reitinger, 60,000 of the affected accounts are from the PSN and SEN networks, while the other 33,000 are on SOE. All of them have been locked down and are being reviewed for unauthorized access.

In order to regain control over the accounts, their legitimate owners will need to change their passwords. The company will notify those affected via email and will instruct them on how to proceed.

"Please note, if you have a credit card associated with your account, your credit card number is not at risk. We will work with any users whom we confirm have had unauthorized purchases made to restore amounts in the PSN/SEN or SOE wallet," Reitinger said.

The company advises users to choose username and password combinations that are not associated with other web sites and are hard to guess. Users should also review all their online accounts for suspicious activity on a regular basis. µ