Feeds

PlayStation Network credit cards protected by encryption

User passwords? Not so much

Top 5 reasons to deploy VMware with Tegile

All credit card information stored on Sony's PlayStation Network was encrypted, the company said one day after warning users their user names, passwords, birth dates and home addresses were stolen in a security breach.

“The entire credit card table was encrypted and we have no evidence that credit card data was taken,” Sony representatives wrote in the update, which was posted late on Wednesday. “The personal data table, which is a separate data set, was not encrypted, but was, of course, behind a very sophisticated security system that was breached in a malicious attack.”

The update clarifies statements Sony made on Tuesday that the stolen information may have included payment-card data, purchase history, billing addresses, and security answers used to change passwords. It didn't provide details about the encryption used to protect card data, but assuming it followed standard industry practices, it was likely enough to prevent the information from being used by the hackers behind the break in.

Wednesday's update follows multiple news reports that recounted PSN users who reported credit card fraud that seemed to coincide with the breach.

Noticeably absent from Sony's update was the status of passwords used to log in to the PlayStation Network. Industry practices dictate they should never be stored in clear text, but rather should be run through a one-way cryptographic hash algorithm, which converts each string in plaintext to a unique set of characters that can never be reversed.

As we've learned from last year's mammoth website hack at Gawker and numerous other security breaches, users frequently employ the same credentials for numerous accounts, making all of them vulnerable when a single one is compromised. Sony's update strongly urged PlayStation Network users who use the same account name and password for unrelated services to change them.

The update said that Sony has sent the majority of its 77 million users an email informing them of the breach and the steps they should take to protect themselves in its aftermath. The company also said it is working to track down the perpetrators.

“We are currently conducting a thorough investigation of the situation and are working closely with a recognized technology security firm and law enforcement in order to find those responsible for this criminal act no matter where in the world they might be located,” Sony representatives wrote.

They said they expect some online PlayStation services to resume this Tuesday. The network has been inaccessible since April 20, when Sony took it offline. ®

Intelligent flash storage arrays

More from The Register

next story
PEAK APPLE: iOS 8 is least popular Cupertino mobile OS in all of HUMAN HISTORY
'Nerd release' finally staggers past 50 per cent adoption
Tim Cook: The classic iPod HAD to DIE, and this is WHY
Apple, er, couldn’t get the parts for HDD models
Apple spent just ONE DOLLAR beefing up the latest iPad Air 2
New iPads look a lot like the old one. There's a reason for that
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
Caterham Seven 160 review: The Raspberry Pi of motoring
Back to driving's basics with a joyously legal high
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.