Coren wrote:
Xequecal wrote:
More info on this has come out, apparently SOE was running really old versions of Apache (2.2.17) from 2005 with known vulnerabilities and that let people get in and access their databases.
Heh, it turns out the running "really old versions" rumor was untrue...and the source for it was "something a security expert read on a messageboard somewhere", something the security expert admitted in his letter to Congress.
Google caches have shown Sony using Apache 2.2.17 (the most recent version) for some time now.
1) You should read your sources more closely. The logs claimed that one auth server -- auth.np.ac.playstation.net -- was running 2.2.15. The logs were being passed around in public channels sometime around February 17, which means they probably originated at least slightly earlier than that. The google cache showing 2.2.17 was for March 23, over a full month afterward for the latest possible date of the logs. Google's cache of March 23 does not repudiate a claim that they were running 2.2.15 no later than Feb. 17.
2) You should also read
my post again. Whether or not the PSN auth servers, let alone the rest of the web servers that make up the entirety of the PSN network were running 2.2.17, it is a matter of fact that the soe.com servers (SOE was recently breached, remember?) were and STILL ARE running an extremely old version of Apache (2.2.3).
This is from about 2 minutes ago. Feel free to try it yourself:
Code:
stathol@raimi:~$ telnet soe.com 80
Trying 199.108.0.133...
Connected to soe.com.
Escape character is '^]'.
GET / HTTP/1.1
Host:soe.com
HTTP/1.1 302 Found
Date: Sun, 08 May 2011 20:07:49 GMT
Server: Apache/2.2.3
Location: http://www.soe.com/
Content-Length: 266
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://www.soe.com/">here</a>.</p>
<hr>
<address>Apache/2.2.3 Server at soe.com Port 80</address>
</body></html>