Sony's PlayStation Network breach exposed 75 million users' personal data, including passwords and credit cards, with Sony delaying notification for over a week. Robert Siciliano, a McAfee identity-theft specialist, explains why corporations struggle to defend against organized, financially motivated cybercrime and what stronger password practices could prevent.
Chapters
At the Games On video game shop in San Diego, players paused from blasting and thwacking their virtual opponents to sound off about the epic security breach in Sony's PlayStation Network.
As a gamer, I kind of assume that when I confide in a game system, in a network, I kind of trust that, yeah, everything's going to be taken care of. I'm going to be secure. I'm going to be safe. But now I'm starting to second-guess that.
Sony says 75 million customers' personal information may have been compromised, including names, mailing addresses, email addresses, passwords, and possibly credit card information. Computer security experts say there is a thriving online marketplace for stolen personal data. The information can be used to purchase items with stolen credit cards, set up false identities, set up bank accounts, receive loans, public assistance, and can even provide cover for terrorists. The company waited for more than a week after hackers broke in on April 16th to warn its customers. Sony urged them to check bank accounts and credit records carefully and to beware of online scams that could take advantage of their stolen information. Customers are furious.
Sony could have done a— actually, could have and should have done a much better job in securing their customers' information.
Sony says it has alerted the FBI Cyber Crime Unit here in San Diego, but so far the agency has not had any comment. And already the first lawsuits are being filed against Sony by attorneys on behalf of their hacked clients. Rob Reynolds, Al Jazeera, San Diego.
Live to Boston now, and Robert Siciliano. He is a consultant for computer security firm McAfee and also an ID theft expert. Robert, thank you for your time. The more I read about this, the more I'm amazed at the scale of it all. But then I stop and think, we're putting so much information online these days, we are doing so much of our work and life online, something like this was always bound to happen at some point.
Yeah, we live in a, uh, database society, and our information isn't just on one database, it's on a lot of different databases, and, uh, these are big targets for cybercriminals today. While a game was hacked, cybercrime is no game.
Has Sony got to take the rap entirely for this one, or Is there any third party involved? I've seen things recently with some large retailers where they've actually let people know, we have a third party who helps us with this stuff, and they've been compromised as well. Is this entirely down to Sony?
So there are, uh, data breaches occurring, uh, just about every single day. In the news we're reading something, uh, and many of them aren't reported in the news. Uh, major corporations, government agencies, all day every day are under attack. Cyber criminals today are organized, they know what they're doing. They're not just working 9 to 5, they're working 24/7, 365. They know what they're doing, they're sophisticated, they're intelligent, and it's all about making money today. There are advanced persistent threats that occur, again, all day every day where they're sending off phishing-type emails, they are using all the hacking tools that both the good guys and the bad guys use to look for vulnerabilities in networks, and when they find those vulnerabilities, they penetrate penetrate them. They slide a worm in there, they go through the back door of a network, they take over usernames and passwords, they download data, and they use that to open up new accounts or to take over existing accounts.
So they're constantly working to break the system, then the people at Sony or any company are trying to make new secure ways of securing their data.
It's—
everyone's just chasing their tails, aren't they, on this one?
Well, you know, the internet as we know it, e-commerce and everything, we're looking at what, 15 maybe 17 years, e-commerce really came alive with broadband. And since then, criminal hackers, they used to hack for fame, now they're hacking for fortune. They realized halfway through the first decade of the millennium that with the same technologies that they've been using for so long to wreak havoc, to delete files, to crash PCs, that they can now make money. And that's exactly what they're doing today, is they're making money. And again, it's not just, you know, one criminal hacker sitting in his mom's basement. These are organized criminals from all over the world that are collaborating over the internet, and they have all the sophistication, all the tools that they need, uh, to break into major government agencies and major corporations.
What about damage to Sony? I'm not talking just the 77 million or so people who use PlayStation, but the brand here, because I guess Sony is the type of name you would want to trust with this sort of stuff.
And Sony is a brand that you can trust. Sony, like every other major corporation that's been hacked in the past 5 to 7 years, again, is under siege. You know, these companies are investing millions into information security and the IT professionals to implement the hardware and the software to put up defenses to keep those networks tight. But again, with these advanced persistent threats, you have these criminal hackers that are, again, they're all over the world, and all they do all day long is they look for those vulnerabilities. They may send off an email to an employee that looks like it's coming from another employee. You know, they'll send off an email that looks like it's coming from Human Resources, and that employee clicks a link in the body of that email. Next thing you know, they're downloading a virus onto the network that infects their PC, shuts down their defenses, and then goes ahead and infects other PCs in the network and compromises even more usernames and passwords. Robert Siciliano. It's an ongoing battle that, you know, good fighting evil.
Robert, we thank you for your time. It's a pretty scary-sounding scenario there. Robert Siciliano joining us from Boston.
