Sony’s way of plugging the security hole by taking down the password reset page while they fix the innards before putting it back online and login flaw exposed, certain pages down. Not even two days after Sony restored its embattled PlayStation Network for most users worldwide, cyber criminals have once again launched an attack and this time going for a vulnerability with the system’s password reset……..
Sony‘s PlayStation Network may have been compromised yet again and just days after Sony announced the PlayStation Network was back online, reports are coming in that the network has been hit once again by hackers. This time an exploit has been discovered that lets hackers change your password using only your account email and date of birth. An exploit that allows people to change users’ passwords via the PSN password reset page using only an account email and date of birth has been discovered. It appears Sony has already begun responding to the problem and the PSN login is now unavialble across various Sony sites. The PlayStation Network was taken offline in recent weeks following a devastating cyber attack on Sony’s servers that saw hackers access information on over 77m users. The Sony Online Network (SOE) was also hit in an attack and a further 25m users’ details were accessed, including 24,000 credit and debit card details.
The latest exploit of Sony’s PlayStation Network:
Nyleveia wrote: “A new hack is currently doing the rounds in dark corners of the internet that allows the attacker the ability to change your password using only your account’s email and date of birth. It has been proven to me through direct demonstration on a test account, so I am without any shadow of a doubt that this is real.
“I would suggest that you secure your accounts now by creating a completely new email that you will not use ANYWHERE ELSE, and switching your PSN account to use this new email. You risk having your account stolen, when this hack becomes more public, if you do not make sure that your PSN account’s email is one that cannot be affiliated with or otherwise traced to you.
“While we originally assumed this was a poor hoax designed only to stir the community into another frenzy, the individual who we are in contact with requested just two pieces of information from us: this being an account email and the date of birth used for that account. We promptly created a new account via us.playstation.com and provided the individual with the email address and date of birth used.”
A new moments later Nyleveia received an email from Sony confirming the password had been changed successfully.Without explaining how the exploit happens, Nyleveia said that the exploit involves a vulnerability in the password reset form currently implemented, not properly verifying tokens.
[ttjad keyword=”ps3″]
