News that Sony has brought in external investigators after the personal information of more than 100 million Sony online gamers was compromised in hacker attacks highlights a sombre reality: not even one of the world’s most sophisticated technology companies can outwit the hackers in 2011.
Online gamers’ disappointment at being denied access to Sony’s PlayStation Network and Qriocity service while the hacks were investigated – robbing them of the privilege of being able to blast each other to bits in cyberspace – quickly turned to anger as Sony announced just what sort of information the hackers are thought to have gained access to. As the company put it:
We believe that an unauthorised person has obtained the following information that you provided: name, address (city, state/province, zip or postal code), country, email address, birthdate, PlayStation Network/Qriocity passwords and login and handle/PSN online ID. It is also possible that your profile data, including purchase history and billing address (city, state, zip), and your PlayStation Network/Qriocity password security answers may have been obtained. If you have authorised a sub-account for your dependent, the same data with respect to your dependent may have been obtained. While there is no evidence that credit card data was taken at this time, we cannot rule out the possibility.
At least one lawsuit has already been launched in the US by a PSN user who claims Sony did not do enough to protect the private data of its customers, and the attorney generals for four US states have begun looking into the attack.
Here in the UK, the Information Commissioner, Christopher Graham, appears to be taking a strong stance for a change. He told BBC Radio 4’s You and Yours programme that the matter looked like “a very significant breach of data protection law”, though he will only be able to hit Sony with his potential fines of up to £500,000 if at least some of the compromised PSN data was stored in the UK.
Even then, while fines are all well and good, locked stable doors and bolting horses come to mind. Fining Sony will do nothing to reduce the risk of identity theft or fraud now faced by users of the PSN or Qriocity services, who Sony has kindly suggested should “remain vigilant to review your account statements and to monitor your credit or similar types of reports”.
Missing and action
Identity theft is a real and growing problem. According to CIFAS, the UK’s fraud prevention service, identity fraud increased by almost 10 per cent in the first nine months of 2010 compared to the same period in 2009. The number of victims of impersonation rose by 18.4 per cent.
It’s easy to blame corporations like Sony for not investing in adequate security measures. But the hacking of servers run by the security firm RSA in March showx just how capable the bad guys – the hackers – are today.
RSA is not just a security specialist. Its authentication technology is specifically geared towards keeping the bad guys out of corporate networks, yet it still had to own up to a severe breach of its defences which could have compromised the security of authentication systems used by 40 million employees to access sensitive networks, both corporate and government.
The UK government has by no means an unblemished security record. In November 2007 two disks holding the personal details of all families in the UK with a child under the age of 16 went missing. The Child Benefit data on them included name, address, date of birth, National Insurance number and, where relevant, bank details of 25 million people. The then chancellor, Alistair Darling, said there was no evidence that the data had gone to criminals, but urged people to monitor their bank accounts for unusual activity.
In September 2008, the Insolvency Service said the names, addresses and bank details of up to 400 directors of 122 firms were lost after four laptops were stolen. That same month, the Service Personnel and Veterans Agency lost three USB portable hard drives with details of 50,500 staff. A month later, the Ministry of Defence said that a hard drive being held by a contractor, containing 1.7 million records, was missing.
Hacked off
Insider threats and good old-fashioned carelessness are nothing new, and won’t stop until people stop being human. Encryption and data loss prevention (DLP) technologies have come a long way, but there is no such thing as “100 per cent secure”, and no technology in the world can prevent a malicious insider with the right level of access privileges from helping himself to a little sensitive data.
Yet the Sony and RSA hacks are more worrying, if anything, than a lost or stolen memory stick or laptop. These are the ominous signs that the bad guys – increasingly so, it seems – are outsmarting what should be some of the most secure defences.
As Andy Cordial, managing director of the secure storage systems firm Origin Storage, puts it: “There have been hacks of several corporates in recent weeks. Regardless of what caused these incursions, it is now clear that the database security systems in active use on both sides of the Atlantic are no longer sufficient.”
Or, to put it another way: right now, the bad guys are winning.
Jason Stamper is technology correspondent of NS and editor of Computer Business Review.
Content from our partners
Related
