I mean if you're still putting your credit card on PSN after that hack shit in 2011, I don't know what to tell you. There's a reason PSN cards are the best selling video game item of amazon consistently.
-
Ever wanted an RSS feed of all your favorite gaming news sites? Go check out our new Gaming Headlines feed! Read more about it here.
PlayStation Security Exploit Allows Hackers With Access To An Account To Use Credit Card Info w/o Needing the CVV [UPDATE:It's probably nothing]
- Thread starter Cranster
- Start date
If Sony knew this, they deserve to get sued. Would this explain why so many people get charged without their knowledge
Like how is this still a problem. I don't want to be told "well this is what you get for putting in information to make a transaction." Like come on.
I mean if someone hacks my amazon account they could make purchases without my security code as well. This is such a non issue story.
If this needs a hacked account with a credit card registered, what's the big security exploit if the hacker will already have access to the credit card data anyway?
I know everyone here is saying just put on 2FA and everything is ok but the more severe implication is that this exploit has been known for 5 years and Sony has most certainly not had 2FA that whole time. Also the other concerning aspect is that Sony has been made aware of this at some point and basically seems to see it as a non-issue or at least not an issue that they are responsible to fix.
The person who accesses a compromised account does not have access to any CC data, just as you would not if you try to access the stored CC data of your own account (Except for a few digits that are there to tell you which card is stored).
As stated normal protocol is when you log in to a new PS4/computer with your PSN and attempt to purchase something with a stored CC, it should ask for the CCV number before using said card for the purchase. This article is saying that there is an exploit for the past 5 years where if an account is compromised with a stored CC, there was a way to log in to a PS4 and purchase something without being prompted by the security layer asking to verify the CCV.
The person who accesses a compromised account does not have access to any CC data, just as you would not if you try to access the stored CC data of your own account (Except for a few digits that are there to tell you which card is stored).
As stated normal protocol is when you log in to a new PS4/computer with your PSN and attempt to purchase something with a stored CC, it should ask for the CCV number before using said card for the purchase. This article is saying that there is an exploit for the past 5 years where if an account is compromised with a stored CC, there was a way to log in to a PS4 and purchase something without being prompted by the security layer asking to verify the CCV.
Last edited:
This. Never again with Sony. The continued issues with taking care of their security is mind boggling.
So this needs a hacked account to work anyway? I have the 2 step verification thing on my account
Yea so the issue seems to be that when purchasing something on the console itself with a linked credit card, you are never asked for the security code to the card. Just the password, which if someone had your info, they would know.
Oddly enough, the web store does ask for the code when making a purchase with a linked card.
This is a big oversight on Sony's part.
Oddly enough, the web store does ask for the code when making a purchase with a linked card.
This is a big oversight on Sony's part.
Same. I still don't know why people still give the credit card info on PSN. After all the things that have happened over the years you would think people would learn and be smarter.
Yea. Im a little confused here. Read thread title, than the OP, than followed the link and read that.
So they have to know your PSN login info? That is the problem in the first place.
Since no one but me knows this info Im assuming Im safe? This feels like someone hitting the panic button for the wrong reason unless I am misunderstanding.
Edit. I understand now after looking at post history..
Last edited:
The problem isn't the hacker already having access to your account, it's the fact that if the information is there, this exploit can bypass another layer of security that would've been in place even if they did have account access.
Sony got a big problem on its hands!!! I can tell you a lot of NBA 2K content creators have been hack.The hackers call Sony and give info to get those accounts.So many are switching to XB1 for NBA 2K20.
Sure if you want hackers to access you paypal account. No Credit cards or online accounts of any kind if you value your money. Use PSN cards!
I would bet that Sony is not doing a check on a family account purchases using the primary account's payment method.
Don't have a PS4 to test it out, but most likely scenario is something like the following:
- Get account username/password.
- Verify payment method is on account.
- Create linked sub account(s).
- Log on to new machine with sub account.
- Max out purchases.
If you treat your psn account like you should with Fucking any online account these days, and have two factor authentication, then this is irrelevant.
People reacting to this like this is a way bigger deal than it is, it's kinda dumb, yes, but it's not some huge security gap... They would have had to already completely compromised your account.
2fa squashes this from ever being an issue.
People reacting to this like this is a way bigger deal than it is, it's kinda dumb, yes, but it's not some huge security gap... They would have had to already completely compromised your account.
2fa squashes this from ever being an issue.
After 2011, why would anyone ever store any important info on a Sony related service? At this point Sony's ineptitude when it comes to security on their console is legendary.
This continues to be a huge problem from Sony. I mentioned this in another thread one time but was accused of concern trolling.
2011 was just the year of hacks. I'm guessing the PSN hack just overshadowed the Steam one since nobody ever seems to talk about it despite it affecting 35 million people. Regardless, I can't believe Sony doesn't think this is a problem.
I never forgot
It is why i never save my.paypal nor any of my cc details on psn or even steam.
" However due to a very easy exploit, if a thief was to get their hands on another PlayStation user's account, they could potentially rack up victim's credit cards without even knowing their CVV number as the bug bypasses the requirement, allowing users to buy content from another account. "
I don't quite get it. So they have to gain access to your account but then how do they access your CC details to purchase things from another account?
Also at this point everyone should be using 2FA on ALL of their accounts across all platforms. Account theft is seriously way too common to risk not using the added protection provided and it only takes a few minutes to set up.
I don't quite get it. So they have to gain access to your account but then how do they access your CC details to purchase things from another account?
Also at this point everyone should be using 2FA on ALL of their accounts across all platforms. Account theft is seriously way too common to risk not using the added protection provided and it only takes a few minutes to set up.
Well fuck, getting up out of bed and deleting that shit now. Figure out what I'll do about it in the morning
That might explain how some kids spend a thousand bucks on FIFA and Fortnite sometimes.
Considering you need to have access to a person's account, this is being misrepresented.
It isn't an exploit, it's there by design to allow fewer barriers for legit users to make purchases.
It's the same as on Amazon and many other websites that let you use your credit card. In fact very few will ask you to input your CVV number for EVERY transaction.
I'm not sure what is being reported here.
It isn't an exploit, it's there by design to allow fewer barriers for legit users to make purchases.
It's the same as on Amazon and many other websites that let you use your credit card. In fact very few will ask you to input your CVV number for EVERY transaction.
I'm not sure what is being reported here.
That's not true. You cannot do that.
You use a card to make purchases on the account tied to YOUR PS4. For someone to do it, they either need your PSN account details or to log-on to an account on your physical PS4 -- in your own home... at which point you have bigger problems if strangers are doing that.
Good point about Amazon not asking for CVV. Shit, I can't recall the last time I put my CVV in there! But my guess is that people think Sony should ask for it on more transactions if not every one of them because of their history with lax security.
And then remember that it took Sony another five years to implement 2FA.
Everyone saying "but they still need to hack into your account first, no big deal." While technically correct, it'd be a bit like living in a castle and saying "well, the front gates fallen off, but they've still got to jump the moat." It's an expected layer of additional security that is expected, especially since people had to start paying for PSPlus. You don't ignore the failure of one layer just because you've got a backup.
I mean if you're gonna harp on Sony for this a whole bunch of online retailers don't require you to enter the cvv again once your card info is initially entered and saved no?
As an aside is Sony the one who will ban your account if you do a chargeback/dispute a cc charge? 🤔
As an aside is Sony the one who will ban your account if you do a chargeback/dispute a cc charge? 🤔
