Home    LittleBigPlanet General    News and Media
#1

PSN password reset page exploit?!

Archive: 24 posts


Noticed today that I can't sign into any Sony website or official forums yet it was up yestrday. I'm not sure if Sony are being truthful in their recent update. Reports from other sites and forums are saying that theres an exploit on the passowrd reset webpage so it's best to do it from your console:

Neogaf
Sony had an exploit on their PSN password recovery page and are now trying to hide it
http://www.neogaf.com/forum/showthread.php?t=430574

Eurogamer
Sony's PSN password page exploit
http://www.eurogamer.net/articles/2011-05-18-sonys-psn-password-page-hacked

No need to panic obviously from the the fact you can't sign in the page has been taken down and Sony are working on fixing it.
2011-05-18 15:01:00

Author:
LittleBigDes
Posts: 920


It should be okay as long as you know your on a SONY webpage, I wouldn't recommend typing any details if you werent sure. The sony servers are probably that full of people trying to get on to the network that it's crashing it slightly. I wouldn't be to worried. Not all of the services for me are up and running 100% yet anyway.2011-05-18 15:12:00

Author:
dbibby88
Posts: 378


It should be okay as long as you know your on a SONY webpage, I wouldn't recommend typing any details if you werent sure. The sony servers are probably that full of people trying to get on to the network that it's crashing it slightly. I wouldn't be to worried. Not all of the services for me are up and running 100% yet anyway.

It's an exploit that allows someone that knows your email adress and date of birth to reset the password on the account.
2011-05-18 15:48:00

Author:
Rabid-Coot
Posts: 6728


Actually I was surprised I was not asked any security questions or anything else when I started up my PS3, did the update and signed in. To verify that it was me resetting it at the time, but I'm guessing the automated email that notifys you of the reset does that.

Someone else in my household could have done it and pressed my profile to sign in.

UPDATE: Next we'll be asked to change our date of birth
2011-05-18 15:52:00

Author:
LittleBigDes
Posts: 920


Ahh right, how come everyones out to get everyone on the ps3 lately? But still, just make 100% sure your actually on the real website or as put before, do it from your ps3 so you know for definite.2011-05-18 15:58:00

Author:
dbibby88
Posts: 378


Actually I was surprised I was not asked any security questions or anything else when I started up my PS3, did the update and signed in. To verify that it was me resetting it at the time, but I'm guessing the automated email that notifys you of the reset does that.

Someone else in my household could have done it and pressed my profile to sign in.

UPDATE: Next we'll be asked to change our date of birth

I still haven't recieved the confirmation email from sony about the password change and I changed mine on Sunday/Monday when it first came back on.
2011-05-18 16:01:00

Author:
dbibby88
Posts: 378


I just clicked sign in on PS3 it said they sent an e-mail to me and the webpage link was there so im okay.2011-05-18 16:02:00

Author:
craigmond
Posts: 2426


Actually I was surprised I was not asked any security questions or anything else when I started up my PS3, did the update and signed in. To verify that it was me resetting it at the time, but I'm guessing the automated email that notifys you of the reset does that.

Someone else in my household could have done it and pressed my profile to sign in.

UPDATE: Next we'll be asked to change our date of birth

If it's the PS3 the account was activated on prior to the hack it is reset on the console if the account isn't active on the console you get sent an email and have to reset it on the internet.
2011-05-18 16:03:00

Author:
Rabid-Coot
Posts: 6728


Ahh right, how come everyones out to get everyone on the ps3 lately? But still, just make 100% sure your actually on the real website or as put before, do it from your ps3 so you know for definite.

Err I think you've missed the point. Just an exploit found that if someone has your DOB and password in light of the security breech they too can reset your password. I guess this can be done on a lot of things that are online these days. Nothing to do with me making sure I'm on a legit website as I was definitely doing it on ym PS3 console. But yes for those that are yet to do it, it's best to do it from your console rather then the website link they send you in the official email as that page has now been taken down and is being fixed.
2011-05-18 16:03:00

Author:
LittleBigDes
Posts: 920


Ahh right, how come everyones out to get everyone on the ps3 lately? But still, just make 100% sure your actually on the real website or as put before, do it from your ps3 so you know for definite.

This is on the real website please read what is going on before jumping into the topic.

http://sony.nyleveia.com/2011/05/17/warning-all-psn-users-your-accounts-are-still-not-safe/ broke the news and has the best description of what the exploit is.
2011-05-18 16:10:00

Author:
Rabid-Coot
Posts: 6728


Err I think you've missed the point. Just an exploit found that if someone has your DOB and password in light of the security breech they too can reset your password. I guess this can be done on a lot of things that are online these days. Nothing to do with me making sure I'm on a legit website as I was definitely doing it on ym PS3 console. But yes for those that are yet to do it, it's best to do it from your console rather then the website link they send you in the official email as that page has now been taken down and is being fixed.

haa to be honest I didn't read you links, I should of done really but Im on the phone and I can't do two things at once. I'll read them afterwards.

Yeah I think your right about people being able to get in to different accounts. I remember when I was a teenager and you could quite easily get in to other peoples hotmail accounts just by guessing one of their security questions, which was normally 'what is the name of my cat', it does sound wrong to do it, but my friends always used to change each others passwords. When theirs a will, theirs a way.
2011-05-18 16:11:00

Author:
dbibby88
Posts: 378


This has got to be the hackers just testing out Sony's new security....and then effing it up again.2011-05-18 17:06:00

Author:
BasketSnake
Posts: 2391


Well someone on the Neogaf forums tested it out and notified Sony about it, apparently. So I'm keeping an open mind about it.2011-05-18 17:22:00

Author:
LittleBigDes
Posts: 920


http://blog.us.playstation.com/2011/05/18/update-on-psn-password-reset-process/


We temporarily took down the PSN and Qriocity password reset page. Contrary to some reports, there was no hack involved. In the process of resetting of passwords there was a URL exploit that we have subsequently fixed.

Consumers who haven?t reset their passwords for PSN are still encouraged to do so directly on their PS3. Otherwise, they can continue to do so via the website as soon as we bring that site back up.
2011-05-18 19:30:00

Author:
Rabid-Coot
Posts: 6728


Sorry for misreading this before. Reading the link you gave me originally, isn't it common sense anyway to have two emails for EVERYTHING that you do? I already have two emails and have done for years. One email for spam and hobbies, another for my life (e.g. bank, jobs, contacts, uni emails). I've always used my spam folder for EVERYTHING besides important stuff.2011-05-18 23:05:00

Author:
dbibby88
Posts: 378


GREAT. Sony is screwing it up a lot for me. While my brother was able to restore his account on the PS3 without much fuzz, BECAUSE HIS ACCOUNT IS AMERICAN, when I try to reset my password it sends an e-mail with a link THAT DOESN'T WORK. Really? If they don't want me in PSN, they might as well have warned me in the EULA. 2011-05-19 00:04:00

Author:
gdn001
Posts: 5891


Sorry for misreading this before. Reading the link you gave me originally, isn't it common sense anyway to have two emails for EVERYTHING that you do? I already have two emails and have done for years. One email for spam and hobbies, another for my life (e.g. bank, jobs, contacts, uni emails). I've always used my spam folder for EVERYTHING besides important stuff.

No need to say sorry, it's ok. Actually it's quite common for people to have 2 or more email addresses, like you said. A friend of mine used his 'spam junk hardly ever used email address' to link to his PSN. It may be a coincidence but since PSN went down friends have been telling him that he's been sending them dodgy emails. Yet he never uses that account.
2011-05-19 00:28:00

Author:
LittleBigDes
Posts: 920


I don't get the whole email thing. Is it for people who aren't able to reset their password through their console?2011-05-19 01:14:00

Author:
Ayneh
Posts: 2454


If you want to keep up to date all of PlayStation's announcements easily, follow them on twitter.
http://twitter.com/#!/PlayStation
2011-05-19 01:20:00

Author:
Unknown User


I don't get the whole email thing. Is it for people who aren't able to reset their password through their console?

The email address is used when registering with the PSN, it's so that they can confirm it's actually you and not anybody else. But as you can see, people have found a way around this to get into other users accounts.
2011-05-19 17:04:00

Author:
dbibby88
Posts: 378


If you want to keep up to date all of PlayStation's announcements easily, follow them on twitter.
http://twitter.com/#!/PlayStation

Or just go to the Playstation Blog (http://blog.us.playstation.com/), which has the exact same thing, but just a bit longer than 140 characters.
2011-05-19 17:11:00

Author:
schm0
Posts: 1239


I don't get the whole email thing. Is it for people who aren't able to reset their password through their console?

People resetting password direct from their PS3 console are ok and PSN is up and runnning console wise. BUT Those using the link sent to them in an official email from Sony are not ok, as this page has been taken down as well as sign in to websites using your PSN sign in like the official Sony forums, that I cannot log into. So if you're changing your password on the website link they emailed you, all it takes is someone else that has your email address and date of birth to reset your password and gain access to your PSN account. In other words, exactly the same details that the hackers may already have. Because of this they are forced to take down signing in on websites rather then PSN from your console. May be they should have limited the password change to just be able to do it from your console.

Check Sonys blog or google it.
2011-05-19 17:21:00

Author:
LittleBigDes
Posts: 920


May be they should have limited the password change to just be able to do it from your console.



That would mean that anyone in a situation where they're on an new console (YLOD replacement for example) wouldn't be able to do the password change.
2011-05-19 17:31:00

Author:
Rabid-Coot
Posts: 6728


How is it that everyone is trying to attack the playstation community at the minute? I really don't understand how most of this started? I've read bits and bobs, that it originally started because someone was showing sony how easy it was to get information, but then to many other theories appeared.

Did anyone else notice this to? It isn't related to the password reset, but when I first downloaded the new update, I googled it to see how big the file size was, and already people had made modified versions of it. You can probably still get them up on google, but it allowed people to jailbrake their ps3 systems again.
2011-05-19 17:34:00

Author:
dbibby88
Posts: 378


LBPCentral Archive Statistics
Posts: 1077139    Threads: 69970    Members: 9661    Archive-Date: 2019-01-19

Datenschutz
Aus dem Archiv wurden alle persönlichen Daten wie Name, Anschrift, Email etc. - aber auch sämtliche Inhalte wie z.B. persönliche Nachrichten - entfernt.
Die Nutzung dieser Webseite erfolgt ohne Speicherung personenbezogener Daten. Es werden keinerlei Cookies, Logs, 3rd-Party-Plugins etc. verwendet.