Sony in trouble again? Posted by Zach | at 12:09 PM

Ok, so it seems it couldn't get worse for Sony. They had their servers hacked and put offline while hundreds of thousands of customer's info like CC numbers were obtained. With the servers back online, and PSN users greeted to a 'Welcome Back' package, it seems all is well for Sony at the moment. Well except for this:

PSN website sign-ins disabled after users identify potential exploit

So apparently there was a sign-in exploit which let users recover other users password. I first saw this on a gaming forum called NeoGAF. Here was the post:


Now to the whole story:

This guy on twitter ( http://twitter.com/#!/Nyleveia ) was claiming there was an exploit on the password recovery page that allowed anyone with a matching PSN login address and Date of Birth could change your password without you confirming it. Personally I didn't believe him so I gave him my login and dob. He didn't reply for a long time so I went to sleep.

So this guy sent an email claiming an exploit on twitter, the user not believing him sent a message back into the morning.

The first one is saying that someone had requested to change my password, and that I needed to click the confirmation link to continue. All normal for now, supposedly only people with access to the login address can change it then. HOWEVER the second email is a confirmation that the password was changed and I never clicked the confirmation link... So yeah... my password was successfully changed by someone else.

Apparently Sony then tried to cover up by just pulling down the site without giving any maintenance.  I mean, cmon Sony, really?

Here's the NeoGAF thread: http://www.neogaf.com/forum/showthread.php?t=430574