Re: PlayStation 4 Discussion

[Phobia]

Re: PlayStation 4 Discussion

Then how did they get the 2 factor auth code? It would be impossible to fake that. Once they go to log in, it sends a text. If you didn't get the text, then your phone is cloned.

That makes zero sense, I still get my 2 factor codes for everything else twitter, twitch, bank, etc. So if that was the case I wouldn't be getting those. I didn't get 1 code and that was last night during PSN downtime, sounds fishy to me on Sony side.

[ExtremeGamer]

Re: PlayStation 4 Discussion

That assumes their two factor endpoint has no exploits. You're assuming that their implementation is 100% secure.

I guess, if it has that big of an exploit already, then it's doomed. From what I understand it's using Google's SMS 2FA, so then that's a big issue.

[Chiefsfan881129]

Re: PlayStation 4 Discussion

Yes PSN will ban your account if you go forward with this I have had friends that did this and they were banned from access to the psn and only way there account was unbanned was to reimburse Sony the money. Otherwise your account will stay banned until it's paid..

So if you never pay u never get online access to the account again

I've seen this happen to meny people friends including people who posted about this on playstation fourms

I would not Recommend doing this even Microsoft does the Same thing from my understanding because these companies consider it fraud.

I hate it like you do and talking to customer service is like talking to a brick wall the lack of English and all is crap I've giving there surveys bad ratings countless times due to the bad English making it hard to understand that I have to repeat myself

So I know what you mean hopefully with 4.0 update Sony servers will be upgraded too since it's including the new ui and all.

We will see though n good luck hope u get ur situation resolved.. Talk to u later..

Sent from my SM-G920T using Tapatalk

[sbauer318]

Re: PlayStation 4 Discussion

I guess, if it has that big of an exploit already, then it's doomed. From what I understand it's using Google's SMS 2FA, so then that's a big issue.

Might not be a problem with the underlying service. Maybe something in the hand-off between Sony's services and Google's. At this point, though, I'm just making crazy assumptions with no facts.

[ExtremeGamer]

Re: PlayStation 4 Discussion

That makes zero sense, I still get my 2 factor codes for everything else twitter, twitch, bank, etc. So if that was the case I wouldn't be getting those. I didn't get 1 code and that was last night during PSN downtime, sounds fishy to me on Sony side.

Very weird. It annoys me that Sony doesn't use Authy to begin with as they are the only one that sends SMS for me at this point.

[DieHardYankee26]

Re: PlayStation 4 Discussion

Wasn't one of the services affected sign on? How did they log into your account at all?

[ExtremeGamer]

Re: PlayStation 4 Discussion

Might not be a problem with the underlying service. Maybe something in the hand-off between Sony's services and Google's. At this point, though, I'm just making crazy assumptions with no facts.

No, I get it. Just seems crazy that I've not heard of any other mass hackings, seems if it was that big of an exploit, many people would have gotten hit last night.

[Phobia]

Re: PlayStation 4 Discussion

Well I guess this will be the final nail in the coffin for me. **** Sony and I'll be selling my Console 09/2017 when my paid 1 year PSN service expires. I will not support this kind of customer support or I should say lack there of.

[ExtremeGamer]

Re: PlayStation 4 Discussion

Wasn't one of the services affected sign on? How did they log into your account at all?

Yeah, if you were already logged in, you could get on PSN, but if not, then you couldn't sign on.

So whoever did that, was already logged into the account somewhere, could explain the 2FA issue. I also have a password auth before I finalize any purchase just as one final step of security.

[Phobia]

Re: PlayStation 4 Discussion

Wasn't one of the services affected sign on? How did they log into your account at all?

Exactly was my first thought, only thing I could think is can't you do all that stuff from the web browser?

[ExtremeGamer]

Re: PlayStation 4 Discussion

Exactly was my first thought, only thing I could think is can't you do all that stuff from the web browser?

Yes, you can, so whoever did it already has had your account.

[sbauer318]

Re: PlayStation 4 Discussion

No, I get it. Just seems crazy that I've not heard of any other mass hackings, seems if it was that big of an exploit, many people would have gotten hit last night.

Right, but I think it's very unlikely that someone would have cloned his phone for $70-80. It takes some effort and it doesn't sound like any of his other services were exploited either.

[Phobia]

Re: PlayStation 4 Discussion

Yeah, if you were already logged in, you could get on PSN, but if not, then you couldn't sign on.

So whoever did that, was already logged into the account somewhere, could explain the 2FA issue. I also have a password auth before I finalize any purchase just as one final step of security.

This whole thing is just bizarre and messed up and opens my eyes a little bit even about 2 factor which I always figured was steel wall strong. I guess holes can be found in other ways.

[Phobia]

Re: PlayStation 4 Discussion

So I guess now I'm waiting on PSN phone number to open up at 10am my time so I can call and see what else can be done before I drive down to my bank. Banning my account should not happen, that's some bull**** if they do that.

Side note, they added also like 75 episodes of free media shows also. WHYYYYYYYY

Edit: I know the 2 factor auth is crazy but even bypassing my account pass seems crazy to me. If you would see this pass its crazy long, caps, symbols, etc. Impossible to be brute forced in my opinion, at least in a short amount of time a program would require.

[ExtremeGamer]

Re: PlayStation 4 Discussion

This whole thing is just bizarre and messed up and opens my eyes a little bit even about 2 factor which I always figured was steel wall strong. I guess holes can be found in other ways.

It generally is. I know when I set up my 2FA, it asked me to log out of any already logged in device and that logged out of every browser. But I did read on reddit that it didn't seem to work for everyone.

Sony unfortunately is using the poorest form of 2FA with SMS. The first thing I would ask is if one of your back up codes was used to log in. There's 10 back up codes that you got when you set up 2FA. If they used one of those, it would explain the lack of a text and then you can start to narrow down how you got hacked.

Sorry man, I know this sucks.