Speaker 1: Brought to you by the reinvented two thousand twelve camera.
Speaker 1: It's ready. Are you get in touch with technology? With
Speaker 1: tech Stuff from how stuff works dot com. Hello again, everyone,
Speaker 1: welcome to tech Stuff. My name is Chris Poulette and
Speaker 1: I'm an editor how stuff works dot Com. Sitting across
Speaker 1: from me, as always, from Sunny South Beach senior writer
Speaker 1: Jonathan Strickland. She had actual squirrels in her pants. We
Speaker 1: got served two guys in the park. Yeah, clearly you
Speaker 1: know what episode I'm up to now, Yes, and you're right,
Speaker 1: it was awesome. And those of you there, there are
Speaker 1: several of you out there who know exactly what we're
Speaker 1: talking about and will be very excited that Jonathan has
Speaker 1: jumped on the bandwagon. And you guys are also awesome.
Speaker 1: So let's talk about something that's totally not awesome. Yeah, yeah,
Speaker 1: this is definitely not awesome. This is um. You know.
Speaker 1: From time to time in the podcast we tackle issues
Speaker 1: of privacy and internet security, partially because um, they're relevant,
Speaker 1: there are things that a lot of people want to
Speaker 1: learn more about, and partially because I think, if I
Speaker 1: may speak for you, Jonathan, I think there are issues
Speaker 1: that are are important to both of us personally that
Speaker 1: we're very interested and want to, uh to keep an
Speaker 1: eye on there's and there's still a very casual attitude
Speaker 1: among certain segments of the population that used the Internet
Speaker 1: toward privacy. And I think some of it is just
Speaker 1: a lack of information of the sort of things that
Speaker 1: can go wrong if you do not protect your privacy.
Speaker 1: So let's we'll stop dancing around this. We're specifically going
Speaker 1: to talk about the breach of security within the PlayStation
Speaker 1: Network and Curiosity, which is q R I O C
Speaker 1: I T Y since one of Sony's online services, and
Speaker 1: there was a breach that happened between April seventeenth and
Speaker 1: April nineteen eleven. Uh. And I want to stress this today,
Speaker 1: the day that we are recording this is April twenty nine.
Speaker 1: The reason why I say that is because hopefully by
Speaker 1: the time this podcast goes live, the PlayStation Network will
Speaker 1: be back up and running. It has been down since
Speaker 1: they um so uh, you know, ten days and counting
Speaker 1: of of no support from the PlayStation network, so all
Speaker 1: that online support has gone. Uh. People cannot play online games,
Speaker 1: and some some games they can't play at all, even
Speaker 1: a single player local games they aren't able to play
Speaker 1: for for certain titles because those titles rely upon the
Speaker 1: PSN network. I'm just that's redundant. But the PSN in
Speaker 1: order to uh to update information on things like trophies
Speaker 1: and things like that, and so games that that tie
Speaker 1: into that, that rely upon that network, they do not
Speaker 1: run when the networks down. So there are some single
Speaker 1: player games out there that just won't work on the
Speaker 1: ps So as a result, players are understandably upset, and
Speaker 1: they're upset for multiple reasons. One the network's down. That
Speaker 1: was the first thing that upset people because when the
Speaker 1: network went down, there was very little information from Sony
Speaker 1: about the reason for taking the network down. As a
Speaker 1: matter of fact, I remember a story just a few
Speaker 1: days ago before it came to light what was really happening,
Speaker 1: um that uh one of I only read the headline,
Speaker 1: I admit, Uh. They were saying basically that Sony's customers
Speaker 1: were actually not quite as irritated as they might have been. Now, granted,
Speaker 1: at that point, the network hasn't been down very as
Speaker 1: long as it has now it's you know, still out,
Speaker 1: it's going on more than a week now, so but
Speaker 1: you know, Sony's fans are known to be very, very
Speaker 1: loyal and outspoken, which I think is it can be
Speaker 1: a good thing. Um, And I think basically it's surprised
Speaker 1: some that people weren't more concerned at the time, but again,
Speaker 1: I think that's probably because it had had been released
Speaker 1: that hackers were involved, and they had apparently UH managed
Speaker 1: to gather up some personal information. Yeah. So let's let's
Speaker 1: talk about kind of what Sony said at the beginning.
Speaker 1: At the very beginning, when the PlayStation network went went offline, UH,
Speaker 1: Sony essentially UH issued a message that there was going
Speaker 1: to be some maintenance on the network and that it
Speaker 1: was going to be back up between twenty four and
Speaker 1: forty eight hours. Well, part of that wasn't a lie
Speaker 1: or or actually they probably didn't intend for it. Well,
Speaker 1: I'm sure they did not intend for it to be
Speaker 1: down longer than so they weren't weren't outright lying. They
Speaker 1: just didn't know, but it was due to maintenance. Yeah,
Speaker 1: but they the way it was worded, it sounded like
Speaker 1: it was a planned maintenance sort of issue. Well, of course,
Speaker 1: I mean, if you again, UM, I like to get
Speaker 1: people to think from the other side of this. If
Speaker 1: you're PR, corporate PR. You're one, and it's something that
Speaker 1: they can sort of obfuscate about, they can sort of
Speaker 1: muddy the water about. They're probably going to try to
Speaker 1: do it to make themselves look as good as possible. Yeah,
Speaker 1: you don't want to say, hey, guys, our security was
Speaker 1: breached and we don't know what the extent of the
Speaker 1: problem is yet, UH, and our network is down as
Speaker 1: a result of that. So just chill out because it
Speaker 1: may have turned out that yes, security was breached, but
Speaker 1: nothing went beyond that, right And if that were the case,
Speaker 1: if no one had had a chance to access any
Speaker 1: private information or or anything along those lines, are fiddle
Speaker 1: with the network then Sony, So it would it would
Speaker 1: benefit Sony to just leave that little bit out because
Speaker 1: if no one managed to do anything, then there was
Speaker 1: no real harm done to the end consumer apart from
Speaker 1: a couple of days of the network being offline. Right
Speaker 1: like the a few weeks ago, we were talking about
Speaker 1: the data breach that happened here in UH the United
Speaker 1: States with a number of UH loyalty marketing companies. There
Speaker 1: was one provider that they used UM that that got
Speaker 1: hacked into and Epsilon and all they got from Epsilon
Speaker 1: really was names and addresses, although there may have been
Speaker 1: there may have been some account not not like not
Speaker 1: like credit card information, but loyalty account so they know
Speaker 1: the kinds of things you buy right or or it
Speaker 1: may or a number that identifies you for that particular system,
Speaker 1: like not a not a credit card number, but say
Speaker 1: you know you are like when you join a club
Speaker 1: and it says you know you are member number four
Speaker 1: seven eight nine three, Well at four seven eight nine
Speaker 1: three is might be associated with you in that account,
Speaker 1: and they may the hackers also have access to that,
Speaker 1: but then has limited usability. Yeah, and that's not to
Speaker 1: say that it isn't serious, because it is serious, mostly
Speaker 1: because it can be used to target uh spear phishing attacks.
Speaker 1: These are very directed phishing attacks where they say, hey,
Speaker 1: Jonathan Strickland member number four seven one eight three, Uh,
Speaker 1: we need to get your information. We don't have your
Speaker 1: social security number on file? Can you please just type
Speaker 1: that in this little box? I mean, or visit this website.
Speaker 1: And as it turns out, the website is not the
Speaker 1: corporate website. It's a different web. It's just there too
Speaker 1: to steal as much of your information as possible. Well,
Speaker 1: at the time, Sony wasn't sure exactly what white extent
Speaker 1: the attack had, uh, you know, how far did the
Speaker 1: attack go? So rather than cause alarm, Sony said the
Speaker 1: network was down for maintenance and that it would be
Speaker 1: back up for hours while they conducted an internal investigation.
Speaker 1: So you could argue that Sony made the wrong call
Speaker 1: and that Sony should have said that there had been
Speaker 1: a breach and that there was the possibility that there
Speaker 1: was more than just a breach of security. Uh. But
Speaker 1: on the flip side of it, Sony was you wasn't
Speaker 1: sure how bad it was. Once Sony was sure how
Speaker 1: bad it was, they did come forward and say, all right,
Speaker 1: our network is down due to a security breach, and
Speaker 1: it appears is that the hackers have accessed uh at
Speaker 1: least the personal data tables. These are the tables within
Speaker 1: the network that UH that have all the the user
Speaker 1: information things like your name, your address, UH, your m uh,
Speaker 1: the country of origin. It might be your email as well, UM,
Speaker 1: your PlayStation network password and log in information, the handle
Speaker 1: that you use on the PlayStation network. UM. It might
Speaker 1: also include your purchase history and building address. If you've
Speaker 1: used the PlayStation network to buy games or or content
Speaker 1: within games. UM. But those tables did not include the
Speaker 1: credit card information. The credit card information were stored in
Speaker 1: separate tables which may or may not have also been accessed.
Speaker 1: And here's the big difference between those two tables. Besides
Speaker 1: the content. The credit card table was encrypted, the personal
Speaker 1: data table was not. Right. So there's actually it's kind
Speaker 1: of UM. It's actually a little painful to read. But
Speaker 1: there's a a frequently asked questions document on PlayStation where
Speaker 1: they it addresses the actual outage and and what happened. UM.
Speaker 1: And there's a specific bit here. Let's see if I
Speaker 1: can find the particular question about uh whether or not
Speaker 1: the personal data was encrypted? UM, because they kind of
Speaker 1: dance around it. Let's see here. You wanna do you
Speaker 1: wanna dance while I do this? Well, UM, I could
Speaker 1: tell you that I was about to talk to uh,
Speaker 1: to you about the fact that UM just yesterday again
Speaker 1: as of the day we recorded this on the Stephen
Speaker 1: Mussel of c Net wrote that, UM, there have been
Speaker 1: messages circulating that hackers have claimed that they do in
Speaker 1: fact have credit card information and it is for sale,
Speaker 1: that they offered it back to Sony, but Sony refused
Speaker 1: to buy it. Um, And the information includes, uh, not
Speaker 1: only the credit card numbers, but the expiration dates of
Speaker 1: the cards and the cvvs, which are the numbers on
Speaker 1: the back of most credit cards or the front. Actually
Speaker 1: it's not a CBV on an AMEX American Express card,
Speaker 1: but it's the same It fulfills the same purpose security.
Speaker 1: Do you have the security number? And so they claim
Speaker 1: to have that, but it has not been established whether
Speaker 1: or not that is legitimate. I would guess I'm guessing
Speaker 1: that that's not legitimate. And the reason why I say
Speaker 1: that's not legitimate is because Sony does not collect the
Speaker 1: security numbers that and Sony collects the expiration date and
Speaker 1: the actual credit card number, but not the security number.
Speaker 1: So if someone claims to have all that information, they
Speaker 1: didn't get it from Sony. So where did they magically
Speaker 1: get these security numbers? I call shenanigans on that claim exactly. Well,
Speaker 1: you see, um, you know, if you have a couple
Speaker 1: of million dollars and you want to buy this database,
Speaker 1: I'm sure they'll sell it to you. Show Uh So, yeah,
Speaker 1: I've also got a bridge that I would like to
Speaker 1: interest you in. But I did find the the specific
Speaker 1: section and the frequently asked questions document on at PlayStation's
Speaker 1: UM supports area, and it was was my personal data encrypted?
Speaker 1: Here's Sony's answer. All of the data was protected and
Speaker 1: access was restricted both physically and through the perimeter and
Speaker 1: security of the network. The entire credit card table was encrypted,
Speaker 1: and we have no evidence that credit card data was taken.
Speaker 1: The personal data table, which is a separate data set,
Speaker 1: was not encrypted, but was of course behind a very
Speaker 1: sophisticated security system that was breached in a malicious attack.
Speaker 1: So alright, Sony, come on, guys, it doesn't help your
Speaker 1: case at all to say that your security system was
Speaker 1: incredibly sophisticated if once the stuff has already been stolen, right,
Speaker 1: I mean, that's like a bank coming out and saying
Speaker 1: we had the best security measures imp place the burglars
Speaker 1: stole everything. I mean, doesn't No one cares how sophisticated
Speaker 1: your security was if in fact it was breached, because
Speaker 1: clearly it was not secure enough. I mean, it's obvious
Speaker 1: it wasn't secure enough, because if it were secure enough,
Speaker 1: no one would have breached it. So arguing that your
Speaker 1: security was really sophisticated doesn't impress anybody once the theft
Speaker 1: has already happened. And also, you know, like I said,
Speaker 1: it kind of danced around that question. Uh you know,
Speaker 1: they didn't just come out and say no, we did
Speaker 1: not encrypt your personal data until it got pretty far
Speaker 1: into the answer. But yeah, so that personal data is
Speaker 1: all out there and it's available. And then my opinion
Speaker 1: that personal data is far more valuable than your credit
Speaker 1: card number. And and here's why. So, yeah, getting your
Speaker 1: credit card stolen stinks. I've had I've had my credit
Speaker 1: card number stolen once before. And it's a pain because
Speaker 1: it means that you you have to you have to uh,
Speaker 1: you know, you dispute the the charges, you have to
Speaker 1: change your credit card, you have to get a new card.
Speaker 1: You know, they're there may be trouble disputing some charges
Speaker 1: depending upon your credit card company and all that mess.
Speaker 1: And this stuff can affect your credit rating and it's
Speaker 1: a real pain in the neck. But ultimately you're talking
Speaker 1: about probably a few hundred dollars if you're paying attention,
Speaker 1: it may not even be that much, but you know
Speaker 1: that's there's still a lot of money to a lot
Speaker 1: of people, but it's not as much money as thousands
Speaker 1: of dollars or tens of thousands of dollars, which is
Speaker 1: what can be stolen from you or stolen within your
Speaker 1: name should someone be able to steal your identity. And
Speaker 1: when you think about it, these if a personal information
Speaker 1: includes your name and your address and your birth date
Speaker 1: and all of this sort of things, people could start
Speaker 1: to use that to try and uh and apply for
Speaker 1: credit cards in your name. And then that's where you
Speaker 1: really start seeing some nasty, nasty hits. I mean, your
Speaker 1: credit rating could plumb it as people take advantage of
Speaker 1: that and steal your identity. Yes, and speaking of someone
Speaker 1: who's had to do it, it's very very difficult to
Speaker 1: uh go in and try to clean up your past
Speaker 1: credit history, even when it's not um, you know, they're
Speaker 1: very the credit agents are very protective of their information. Um.
Speaker 1: And of course there are people who would love to
Speaker 1: go up and go no, no, it was it was
Speaker 1: it was hackers. Um. You know, so they uh, you know,
Speaker 1: I would imagine that they are just particularly concerned that
Speaker 1: people are allying to them. But it is very difficult
Speaker 1: for even for those who can offer you know, more
Speaker 1: concrete proof to go in and make changes. So um,
Speaker 1: but even though I'm getting back to Sony specifically. UM,
Speaker 1: I think in a way, they did some things right
Speaker 1: and they did some things wrong. Obviously, the way they
Speaker 1: handled it with regard to the customers, especially in the
Speaker 1: eyes of the customers, leaves a lot to be desired.
Speaker 1: I've seen many, uh complaints about that, and there's there
Speaker 1: have even been law suits filed at this point. Yeah,
Speaker 1: and we'll we'll talk. We'll need to talk a little
Speaker 1: bit about those lawsuits because there's some there's a recent
Speaker 1: Supreme Court ruling that might actually bear upon that. And
Speaker 1: there's also one other element within the terms of use
Speaker 1: that I would like to address as far as the
Speaker 1: lawsuits are concerned. Yeah, we can, we can totally do
Speaker 1: that in just a second. I just wanted to mention though,
Speaker 1: that Sony did, in fact, UH call in an external
Speaker 1: security auditor to take a look at the practices, um
Speaker 1: and and did shut the networks down as soon as
Speaker 1: they realized that there was a serious problem. And Uh,
Speaker 1: the reason it's taking Song at least according to Sony,
Speaker 1: is to get everything back up online is they're changing
Speaker 1: the security structure of the site, which and I think
Speaker 1: that that's an excellent thing and they're require They're going
Speaker 1: to require everyone as soon as they reconnect to the
Speaker 1: network to change their password. UM and that's something else
Speaker 1: we should point out. If you are, if you're practicing
Speaker 1: good security, first of all, you're in the most people
Speaker 1: out I know there's some people out there who are
Speaker 1: our listeners who claim that they do, and that's great,
Speaker 1: I'm glad, fantastic. The rest of you are probably doing
Speaker 1: the same thing that almost everyone is doing, which is
Speaker 1: that you use maybe maybe a handful of passwords. Some
Speaker 1: people just use one and they use it across everything,
Speaker 1: and they might even use the same user name across everything,
Speaker 1: in which case, if someone has access to your name,
Speaker 1: your email address, your user name, and your password, and
Speaker 1: you're using that same password across multiple platforms, all of
Speaker 1: those platforms are now at risk. UH. That means the
Speaker 1: hackers who stole that information could, in theory, access your
Speaker 1: accounts across multiple platforms that might include emails, social networks,
Speaker 1: other services. So you want to make sure that you're
Speaker 1: using multiple passwords, make them difficult to guess. Don't just
Speaker 1: make it a variation off a password that you're using
Speaker 1: over and over again. Use a strong password generator. If
Speaker 1: you need to, um, yeah, those are those are excellent.
Speaker 1: There's there's a couple out there that you do things like,
Speaker 1: for instance, you want to create a password, you put
Speaker 1: in the u r L for the the website that
Speaker 1: you're going to use. You can actually download code that
Speaker 1: will allow you to do this, and you can even
Speaker 1: turn your computer offline so that you know, you don't
Speaker 1: have to worry about it broadcasting this anywhere. But you
Speaker 1: put in the u r L for the website you
Speaker 1: plan to visit. You put in a master password that
Speaker 1: this is the same password you're going to use for
Speaker 1: every single site. But using the master password and the
Speaker 1: u r L, it creates a hash of that and
Speaker 1: creates a strong password based on that. So then all
Speaker 1: you do is put in different u r l's with
Speaker 1: the same master password and it will generate its strong
Speaker 1: password for you. You create your accounts that way using
Speaker 1: that strong password, and if you ever forget it, all
Speaker 1: you have to do is go back into that program.
Speaker 1: You know, again disconnect yourself from all the networks if
Speaker 1: you want to, but go back into that program, type
Speaker 1: in the u r L and your master password again
Speaker 1: and it will the same strong password will pop up again. Yeah, yeah,
Speaker 1: and I have a I have a password wallet that
Speaker 1: I use that will generate passwords, and uh, I have
Speaker 1: the app on my phone and iPod and there's a
Speaker 1: plug in for my browser. So it's that that actually
Speaker 1: goes into the database and everything is encrypted. And if I,
Speaker 1: if I do happen to lose my phone, the uh
Speaker 1: uh and somebody else gets it and and breaks into it,
Speaker 1: they have to they won't find out specifically what is
Speaker 1: in there because they would have to actually get into
Speaker 1: the password app two, which requires a separate and more
Speaker 1: complex password. Um. So yeah, I mean it's uh, these
Speaker 1: are these are good ideas, but uh, it doesn't change
Speaker 1: the fact that that Sony customers are very upset not
Speaker 1: only that they got that they weren't told about this,
Speaker 1: but that they're on top of that, you know, that's
Speaker 1: really insult to injury having their information taken. And a
Speaker 1: lot of people are upset that they can't go back
Speaker 1: in and change their user name and password on the
Speaker 1: network because the network is down. Of course, if no
Speaker 1: one else can get in, I would argue that that's
Speaker 1: not quite as big as at this point, you should
Speaker 1: really be concentrating on changing your password everywhere else. Yes,
Speaker 1: like all the different emails and and social networks and
Speaker 1: all the other services you use. If you use that
Speaker 1: same password, you need to change it. Um, I want
Speaker 1: to put a fraud alert on your credit report? Yeah. Yeah,
Speaker 1: those can be a real pain too, just because if
Speaker 1: you start using your credit card and you're you know,
Speaker 1: you're out of town, then you may end up getting
Speaker 1: a call from your your bank or credit union every
Speaker 1: time you Yeah. Compared that compared to yeah, that it's
Speaker 1: it's inconvenient, and it's a pain in the butt, but
Speaker 1: it's less of a pain in the butt than dealing
Speaker 1: with the fact that someone has stolen your information and
Speaker 1: is using your card without your approval. Just as an aside, Yeah,
Speaker 1: I've I've heard recently, very recently that the people who
Speaker 1: steal credit card numbers now are not And you know,
Speaker 1: if I were stealing credit card numbers, I would think
Speaker 1: that I would want to do things as quickly as
Speaker 1: possible to avoid, uh, you know, the person I stole
Speaker 1: it from. Changing, Yeah, to call in and say, hey,
Speaker 1: my credit card, my credit card has been stolen. Um.
Speaker 1: But in a lot of cases, when when, apparently, when
Speaker 1: this kind of thing happens. They don't run out and
Speaker 1: buy lots of big screen TVs and designer genes and
Speaker 1: all sorts of other cool fun stuff computers, video games.
Speaker 1: They go and they buy stuff for twenty dollars or
Speaker 1: thirty dollars because it doesn't go noticed. People let that
Speaker 1: kind of thing slide on their card. They go, wait
Speaker 1: a minute, I don't remember going to Best Buy and
Speaker 1: spending twenty five times. I probably bought a movie or something. Oh, well,
Speaker 1: you know, I'm sure it's it's just twenty bucks. It's
Speaker 1: no big deal. That's the thing that they've started to do.
Speaker 1: And that's very insidious because they could continue to do
Speaker 1: that and continue to hold on your information and take
Speaker 1: money from you for years. Well, like we said, though,
Speaker 1: credit cards, that's cheap. In the long run, the long game,
Speaker 1: credit card is nothing. In fact, we had a security
Speaker 1: expert come and talk to the editorial department at House
Speaker 1: Stuff Works just as part of our we have this
Speaker 1: ongoing lecture series where we get to listen to various
Speaker 1: experts in different fields. And the security expert was talking
Speaker 1: about how credit card information is cheap. It's it's you know,
Speaker 1: it's like fifteen cents for a credit card number, and
Speaker 1: it's because it's because there is no guarantee that credit
Speaker 1: card number is going to be good for very much longer. Um.
Speaker 1: What's valuable is the personal information, because that's where you
Speaker 1: can start to you know, you you create your own
Speaker 1: credit card based upon this person's identity, on that person's
Speaker 1: credit rating, and you have all the billing go to
Speaker 1: information go to a different place. You don't have to
Speaker 1: worry about paying for it. You're just gonna run that
Speaker 1: up as much as you can, and that's where you
Speaker 1: make the big purchases, right So, and and ultimately the
Speaker 1: person whose name is attached to that number that's their
Speaker 1: credit rating, is going to suffer as a result, and
Speaker 1: that's where you really have to worry. So again, even
Speaker 1: if the credit card information wasn't touched, that personal data
Speaker 1: is very important now they the hackers would lack certain
Speaker 1: information that would really make it useful, like your Social
Speaker 1: Security number. That part is not in your ps N profile,
Speaker 1: So he does not ask for that. So for that reason,
Speaker 1: Sony has alerted users that they should be on the
Speaker 1: lookout for any spear phishing attempts. Sony has said it
Speaker 1: will not ask for personal information through email. Just like
Speaker 1: most retailers and organizations will say the same thing. They
Speaker 1: will never ask for your personal identifiable information to be
Speaker 1: sent over email. So if you get an email from
Speaker 1: apparently Sony that says, all right, we're ready to reinstate
Speaker 1: your ps N profile, but we need your Social Security
Speaker 1: number in order to do it, that's a red flag.
Speaker 1: That's a that's a sign of spear fishing, and that
Speaker 1: the person who sent that is probably just trying to
Speaker 1: gather as much user information as possible to sell it
Speaker 1: off to whomever. So um we we said this a
Speaker 1: few weeks ago, but basically, any reputable company who values
Speaker 1: your business and and may actually need some of this
Speaker 1: information for legitimate purposes, legitimate real world companies are not
Speaker 1: going to ask for you to mail that in or
Speaker 1: to send it in over um A network because basically,
Speaker 1: at this point they all know that these kinds of
Speaker 1: things are going on. It's always better if you have
Speaker 1: any questions to give the company a call at the
Speaker 1: number listed on its legitimate website. Go to the website yourself,
Speaker 1: don't click on any links and those emails, and h
Speaker 1: get the phone number, use the one on your bill
Speaker 1: or whatever to I to call and say, hey, did
Speaker 1: you do you actually need this information? Talk to a
Speaker 1: customer service representative and say, you know, I'm happy to
Speaker 1: you know, hopefully I'm happy to give you the information
Speaker 1: you need if you need it. But I believe this
Speaker 1: might be an attempt to get my information. And if so,
Speaker 1: you guys need to be aware of it so that
Speaker 1: you know, you can maybe message out to people that
Speaker 1: there are these kinds of attacks. Um and yeah, I've
Speaker 1: I've actually had my information soul and wasn't actually related
Speaker 1: to a tech thing. Somebody else that I did business with,
Speaker 1: um had a person on the inside who was uh
Speaker 1: selling information. Yeah, yeah, that can happen. That's essentially you know,
Speaker 1: sabotage is really what that comes down to. Yeah. Yeah.
Speaker 1: And so you know, if you were if you were
Speaker 1: in a situation like this, either through the PlayStation network
Speaker 1: or some other company, you want to make sure you
Speaker 1: keep an eye in your your credit reports. And in
Speaker 1: the United States you can do that. Um. You know,
Speaker 1: I believe there's there's a law and effect now for
Speaker 1: everybody that you can get one reporter year free, one
Speaker 1: free credit report from each of the credit Yeah and um,
Speaker 1: and those would be Equifax, trans Union, and Experience UM
Speaker 1: and you you would definitely want to keep an eye
Speaker 1: on that. UM. Some states like the one we live
Speaker 1: and allow you, I believe, to reports per year. You
Speaker 1: can sign up for services that will allow you to
Speaker 1: check it as many times as you want to. I
Speaker 1: I you know, there's usually a pretty decent fee associated
Speaker 1: with that. UM. And I've talked, I've I've heard information
Speaker 1: from some of the UH consumer protect your folks. I
Speaker 1: can't think of what you call them, like consumer watchdogs
Speaker 1: and say, yeah, you know, you do need to keep
Speaker 1: an eye on your credit, but you might not need
Speaker 1: to spend twenty dollars a month to keep an eye
Speaker 1: on your credit every day. UM. So you know, just
Speaker 1: just be wary of that. Certainly, UH, if I were
Speaker 1: affected by the PlayStation network fiasco, I would I would
Speaker 1: certainly change that credit card number immediately if you haven't
Speaker 1: already hopefully you already have. Yeah, and um I changing
Speaker 1: credit card numbers today is even a bigger pain than
Speaker 1: it used to be. The reason for that is things
Speaker 1: like when you set up recurring payments for stuff. Yes,
Speaker 1: I mean, as we make these systems simpler to do
Speaker 1: all your your payments online. Then we have to remember, oh,
Speaker 1: I changed my credit card number. I have to go
Speaker 1: through every single building service I use and change my
Speaker 1: information there or else I'm going to default on a bill. Yeah. Yeah,
Speaker 1: pain in the butt, but still still better than having
Speaker 1: your identity still in For Sony, though, this is gonna
Speaker 1: be a real headache for sometime. Sony has got This
Speaker 1: is gonna be costs Sony big time. And it's gonna
Speaker 1: cost it because there are between seventy and seventy seven
Speaker 1: million users of PSN. That's a lot of people. And
Speaker 1: to UH to update the security information is it's this
Speaker 1: is a major investment to to fix this problem. It's
Speaker 1: almost like creating the network over from scratch. And they
Speaker 1: have a huge blow to their reputation because not all
Speaker 1: of those users are necessarily going to be willing to
Speaker 1: come back after having their information stolen like this. They aren't,
Speaker 1: and new users might rethink joining because of this breach,
Speaker 1: and so they may say, I don't want to put
Speaker 1: my information in the hands of a company that has
Speaker 1: shown itself incapable of keeping it protected. Well, I would, uh,
Speaker 1: I would go out on a limb. We It's a
Speaker 1: long ways away now from our prediction episode, I would
Speaker 1: go out on a limb and say that's Sony. The
Speaker 1: thing that saves Sony in this case, if anything does,
Speaker 1: is that amazing loyalty that PlayStation customers have. But I
Speaker 1: still think a lot of people are going to be
Speaker 1: extremely upset and quite a few will probably drop out. Yeah,
Speaker 1: and this is again, by the time this podcast goes live,
Speaker 1: there may very well be many more developments. Maybe you
Speaker 1: will know exactly who was responsible for these attacks. As
Speaker 1: of this moment, we don't. We can't say Sony may
Speaker 1: have an idea, but Sony's not letting everyone know, which
Speaker 1: makes sense, rightification Right, So by the time this goes live,
Speaker 1: we may have more information. I might have to come
Speaker 1: in with a breaking news segment at the end and
Speaker 1: kind of update. But but as of the twenty ninth
Speaker 1: of April, we should also mention you you talked about
Speaker 1: the fact that there's a class action suit or some
Speaker 1: lawsuits being levied against Sony. Have seen one right so far?
Speaker 1: There was an interesting news report I saw that said
Speaker 1: that um, because of a different UH suit that was
Speaker 1: brought forth to the Supreme Court. UM, there was a
Speaker 1: class action lawsuit that was brought against a phone company UM.
Speaker 1: A Southern California couple uh levied a lawsuit, began a
Speaker 1: class action lawsuit against the phone company because they were
Speaker 1: they had a fee of around thirty dollars tacked onto
Speaker 1: their cell phone UM bill or cell phone purchase, and
Speaker 1: they said that that that was an unfair bill and
Speaker 1: that it wasn't communicated to them, and that they were
Speaker 1: essentially that the company had stolen that money from them.
Speaker 1: So I started a class action lawsuit. A class action lawsuit,
Speaker 1: it's like a when you get a whole bunch of
Speaker 1: people who all have been affected by the same well
Speaker 1: if the if the court decides at the same crime,
Speaker 1: and they all are seeking damages against a company for
Speaker 1: that crime. Now, normally the money in a class action
Speaker 1: lawsuit for each individual consumer is pretty low, uh. And
Speaker 1: that that's why you want a class action lawsuit. You
Speaker 1: want a lot of people banded together for this because
Speaker 1: it doesn't make any financial sense to pursue this in
Speaker 1: a small claims court because you're gonna spend way more
Speaker 1: money in court than you would reclaiming whatever it was
Speaker 1: was stolen from you. Right, But together you can pull
Speaker 1: the costs and and actually bring a suit and and
Speaker 1: lawyers love them because they get a little bit off
Speaker 1: of each and every transaction. And if there are if
Speaker 1: there are millions of people in the in the lawsuit,
Speaker 1: that that's big bucks. It's It's very weird though, when
Speaker 1: you're somebody who didn't actually bring the suit and you
Speaker 1: get the letter in the mail and says, hey, you're
Speaker 1: so sure, so and so customer, you're part of this
Speaker 1: class action lawsuit. Here's your five dollars, yeah, dollar forty nine.
Speaker 1: Here you um And they're like, hey, I won five
Speaker 1: dollars and you don't even think. You don't even think
Speaker 1: of whatever it was that was the purpose of the
Speaker 1: suit in the first place. But the in this case,
Speaker 1: the cell phone company or they said that they ad
Speaker 1: within their terms of use a a statement that prevented
Speaker 1: people from bringing a class action lawsuit against them. And
Speaker 1: that's what was being taken to court, the challenge of
Speaker 1: can you have something in your terms of service that
Speaker 1: that will prevent the the ability of class action lawsuit
Speaker 1: being levied against you? And the Supreme Court upheld that
Speaker 1: five to four. So if you are a company and
Speaker 1: you put in your terms of service that you do
Speaker 1: not allow class action lawsuits to be levied against you
Speaker 1: for whatever reason. Apparently that can be Um, that's upheld
Speaker 1: by the Supreme Court. That doesn't mean that that's permanent.
Speaker 1: And of course that's just the United States. Not every
Speaker 1: uh country does this. Not every country allows class action lawsuits. Actually,
Speaker 1: so UM, it's not it's not a done deal. But
Speaker 1: also there was I saw someone mentioned that Sony has
Speaker 1: a statement called the limitation of liability and uh, if
Speaker 1: you read that paragraph in their terms of use, uh,
Speaker 1: it says, I'll just read the part that pertains to this.
Speaker 1: We have to throw in some more legal language. We
Speaker 1: need to protect us so that we can provide you
Speaker 1: the benefits of the sites. In no event will s
Speaker 1: c e A, Its officers, directors, employees, shareholders, representatives, or
Speaker 1: agents be liable to you for any direct, indirect, incidental, special, punitive,
Speaker 1: or consequential damages whatsoever resulting from any and then there's
Speaker 1: a list of of criteria, but the one that pertains
Speaker 1: to our discussion is c any unauthorized access to or
Speaker 1: use of our secure servers or any and all non
Speaker 1: secured personal information. I saw someone suggest that maybe that
Speaker 1: would give Sony an out in this case. I don't
Speaker 1: think so. And the reason why I don't think so, now,
Speaker 1: granted I am not a lawyer, so this is just
Speaker 1: basically this is based upon my understanding of the English language. Right, So,
Speaker 1: they said all non secured personal information, but this is secured, Yes,
Speaker 1: this information was, well, the credit card is encrypted, but
Speaker 1: the personal data they don't know that the credit card
Speaker 1: information was taken in the first place, but the personal
Speaker 1: data they do know that someone that was that was
Speaker 1: one of the targets of the attack. The argument might
Speaker 1: be that it wasn't secured, right, So, well, they would
Speaker 1: argue that maybe they might argue that they're that information,
Speaker 1: that the liability means that they're free to go. But
Speaker 1: because it says non secured personal data, you know, they
Speaker 1: specifically said in uh in that in that fact that
Speaker 1: I mentioned that the the that it was restricted both
Speaker 1: physically and through the perimeter and security of the network.
Speaker 1: They were very specific to say that this information was
Speaker 1: behind state of the art, sophisticated security system. So I
Speaker 1: don't think they could argue that it was non secured
Speaker 1: personal data. No, probably not, because in their own statements
Speaker 1: out to the customer they said no, no, no, no,
Speaker 1: no, no no, this information was cure. It's just these people
Speaker 1: were really good and they managed to breach the system.
Speaker 1: So I don't think Sony can avoid a lawsuit based
Speaker 1: upon that criteria. Now there may be that there's other
Speaker 1: information buried within the terms of use that would would
Speaker 1: protect Sony from that, but in that particular paragraph, I
Speaker 1: don't think it applies. Yeah, it sounds like it, but
Speaker 1: I don't. It's certainly going to uh too. This is
Speaker 1: going to dog them for some time, I belive, especially
Speaker 1: on the heels of other missteps they've made over the
Speaker 1: past few years well, and and that, and the fact
Speaker 1: that it came on the heels of the Epsilon breach,
Speaker 1: so people's attention to security online security has already been heightened,
Speaker 1: and to see this happened shortly after that that breach
Speaker 1: became public was really bad news for Sony. And also
Speaker 1: I have to say, you know, Sony's strategy of not
Speaker 1: coming forward and saying that there was a breach early
Speaker 1: on that probably has hurt them quite a bit as well.
Speaker 1: But there was no way of knowing at the time
Speaker 1: that it was going to hurt them. It's just that
Speaker 1: in retrospect, you sit there and you you come forward
Speaker 1: and say, oh, it's just down for maintenance, and then
Speaker 1: a couple of days literally say all right, there was
Speaker 1: a breach. Then people say, well, we how how can
Speaker 1: we trust you as a company if you're going to um,
Speaker 1: you know, lie to your users. Now, you could argue
Speaker 1: that Sony had to do that in order to conduct
Speaker 1: its investigation and as uh effective a way as possible,
Speaker 1: because all the more information Sony gives out, the more
Speaker 1: firepower they give to the attackers. So there's there's a
Speaker 1: scale there. When I meant miss when I was saying missteps,
Speaker 1: I was specifically thinking of the root kit situation from
Speaker 1: a few years ago, which we mentioned on an podcast,
Speaker 1: and they were very um, oh no, nothing's wrong. Okay,
Speaker 1: So yeah, there was this root Kit. Sorry, Yeah, I've
Speaker 1: seen I've seen kind of the same thing. I've seen
Speaker 1: some journalists out there say that Sony should at least
Speaker 1: actually offer an apology to users. Uh, there's a lot
Speaker 1: of we regret that this information was stolen, but not
Speaker 1: an outright we're sorry, right, and that we're sorry might
Speaker 1: go a long way. I'm not or what Sony's thought,
Speaker 1: what the the executives at Sonny, what their thought processes.
Speaker 1: I know that if I were an executive at Sony,
Speaker 1: I would probably if I were not issuing an apology,
Speaker 1: it would probably be because in my mind, that would
Speaker 1: be accepting even more responsibility for the breach, and there
Speaker 1: that might in turn look bad to shareholders because we
Speaker 1: have to remember that for companies, they have multiple kinds
Speaker 1: of customers. Right, there's the customer like I mean myself,
Speaker 1: you know, or Chris there. We're customers of various companies
Speaker 1: where you know, we're purchasing goods or services. But then
Speaker 1: there are customers like the shareholders who own a stake
Speaker 1: within that company and to serve them, you know, you
Speaker 1: have this delicate balancing act. There's only so much responsibility
Speaker 1: you're going to be able to lay claim to without
Speaker 1: making the shareholders say, you know, maybe this isn't the
Speaker 1: right company for me to invest in. So yeah, it's um,
Speaker 1: it's a dirty world there. It's a dirty, dirty world
Speaker 1: out there in the in the financial sector. So uh, guys,
Speaker 1: be careful with your personal information. You may need to
Speaker 1: keep an eye on your accounts. Like we said, change
Speaker 1: your password if you're using the same password everywhere. Really
Speaker 1: try to consider using multiple passwords. I know it's a
Speaker 1: pain in the butt, but it it it death does
Speaker 1: pay off. I mean, it's it's much better than finding
Speaker 1: out that all of your accounts have been compromised. Um,
Speaker 1: and yeah, just be careful and we hope that the
Speaker 1: PSN system is back running by the time this podcast
Speaker 1: goes live and that everyone's having fun with Portal Too.
Speaker 1: That was a big bummer. Portal Too launched, has this
Speaker 1: awesome online gaming component and then the network goes down. Yikes.
Speaker 1: So I'm just gonna go and plan my xbox alright, guys, Well,
Speaker 1: if you want to know about other news stories within
Speaker 1: the tech world, you'd kind of like to hear some
Speaker 1: more context around it, or you just have a particular
Speaker 1: subject do you think that we should tackle Let us know. Oh,
Speaker 1: you can contact us on Facebook and Twitter. That handle
Speaker 1: is tech Stuff h s W. Or you can send
Speaker 1: us an email that addresses tech stuff at how stuff
Speaker 1: worth dot com and Chris and I will talk to
Speaker 1: you again really soon. Breaking news everyone, So this is
Speaker 1: Jonathan Strickland, just coming back with some stuff that's developed
Speaker 1: since we recorded this podcast. Actually lots happened. First of all,
Speaker 1: the problem was bigger than anyone thought it was at
Speaker 1: the time. The Sony online entertainment accounts were also compromised,
Speaker 1: which added another million or so accounts to the seventy
Speaker 1: to seventy seven million accounts that have been compromised, So
Speaker 1: that makes about a hundred million accounts total. Of course,
Speaker 1: there's probably some overlap there, so that was a big problem.
Speaker 1: Then around the beginning of May, Sony said that they
Speaker 1: were going to roll out an identity theft protection program
Speaker 1: to all ps N and Curiosity customers, which would involve
Speaker 1: having a a year long program that would allow this
Speaker 1: company called all Clear i D Actually that's a program
Speaker 1: name to cyber monitor your information and if your information
Speaker 1: was being used for nefarious purposes, they would alert you
Speaker 1: to it. You could also have some ready access to
Speaker 1: private investigators as well as some identity restoration specialists to
Speaker 1: try and fix things once they go wrong, and there
Speaker 1: would be a one million dollar identity theft insurance policy
Speaker 1: on all accounts and this was complimentary. Uh PSN players
Speaker 1: would have to enroll in the program, but it was
Speaker 1: completely free. Then a little later in May, Sony announced
Speaker 1: that the new ps N rollout was going to take place.
Speaker 1: This around May fourteen, and that at this point you
Speaker 1: would start to see restored services in online play, online video,
Speaker 1: online music. All of these services were starting to come back,
Speaker 1: not everything under the PSN network. Sony said that that
Speaker 1: stuff would be rolled out by the end of May,
Speaker 1: but we'd at least start to see some of the
Speaker 1: the service return, and sure enough, it started to get
Speaker 1: rolled out across North America. So then Sony announced a
Speaker 1: welcome back program for North American customers. Uh P S
Speaker 1: three owners would be allowed to select two titles from
Speaker 1: the following Dead Nation, Infamous, Little Big Planet, Superstar, Dust
Speaker 1: h D and wipe Out the HD plus Fury. Now
Speaker 1: PSP owners would be able to select two titles from
Speaker 1: the following Little Big Planet, moder Nation, Racers, Pursuit, Force Kill,
Speaker 1: Zone Liberation, and that this offer would last for thirty days.
Speaker 1: UH since the PSN UH service was restored and it
Speaker 1: was completely free and you get to keep the games
Speaker 1: forever UH the you would also get a thirty day
Speaker 1: ps N Plus membership if you were not a PSN
Speaker 1: Plus member before. If you were a ps N Plus member,
Speaker 1: you got an extra sixty days free of that service.
Speaker 1: So Sony was really trying to do a lot to
Speaker 1: apologize and make up for the lost service during the
Speaker 1: whole hacking incident. However, on May seventeen, Nilivia website reported
Speaker 1: that there's a possible problem with sony solution. Now. Part
Speaker 1: of that solution was that Sony wanted everyone to go
Speaker 1: in and reset their passwords for their accounts to make
Speaker 1: them safe. But Nilivia reported that there was a nasty
Speaker 1: hack going around that would allow hackers who had access
Speaker 1: to your email and your date of birth to reset
Speaker 1: your password for you, thus effectively stealing your PSN account,
Speaker 1: and they they had some detailed information about this that
Speaker 1: they later went back and removed and dumbed down so
Speaker 1: that to to help cut back on actual stiff thefts.
Speaker 1: They did point out that if the hackers did not
Speaker 1: have your email or date of birth, could not perform
Speaker 1: this hack, but since that information was hacked in the
Speaker 1: initial attack on Sony, there's a good bet that a
Speaker 1: lot of hackers out there had access to that information.
Speaker 1: So what Nilvia suggests is that people who are PSN
Speaker 1: users go in and change their email address, create a
Speaker 1: new email address just for the PSN network, and use
Speaker 1: that update their information through PSN so that the hackers
Speaker 1: would not have the right email address and could not
Speaker 1: steal your account. Meanwhile, Sony actually took down the web
Speaker 1: based service to change your password so that hackers could
Speaker 1: not access that and and and change it for you.
Speaker 1: So it's still a big mess. Even at the recording
Speaker 1: of this update, Sony has not yet returned that web
Speaker 1: based system to reset your password to full service, so
Speaker 1: we'll keep an eye on it see if things develop further.
Speaker 1: This has just been an enormous headache for Sony. They've
Speaker 1: been trying to do the right thing, trying to to
Speaker 1: make it up to users, but it's definitely a blow
Speaker 1: against online security in general, identity, theft fears, all of
Speaker 1: that has really taken a big hit as a result
Speaker 1: of this hacking program. We'll keep an eye on it,
Speaker 1: will update anything that happens from this point forward. Well,
Speaker 1: you can check it out on the blogs, you can
Speaker 1: check it out on our Facebook and Twitter feeds, and
Speaker 1: we may even do another podcast about a similar topic
Speaker 1: in the future, just because this has become such a
Speaker 1: huge story. So thanks a lot, guys, and we'll talk
Speaker 1: to you again soon for more on this and thousands
Speaker 1: of other topics. Is it how stuff works dot com.
Speaker 1: So learn more about the podcast, click on the podcast
Speaker 1: icon in the upper right corner of our homepage. The
Speaker 1: House Stuff Works iPhone app has arrived. Download it today
Speaker 1: on iTunes. Brought to you by the reinvented two thousand
Speaker 1: twelve camera. It's ready, are you