The 2011 PlayStation Network Hack: How It Happened

The **April 2011 PSN breach** compromised ~77 million accounts. It was a **multi-vector attack** exploiting layered failures:

Attack Chain

1. SQL Injection (Entry Point): Attackers found a vulnerable web application (likely a developer/partner portal or "Welcome Back" campaign page) that accepted unsanitized input. Injected SQL commands extracted **database credentials** and schema info.
2. Lateral Movement: Using harvested creds, attackers pivoted into **internal database servers** hosting account data (PSN, Qriocity, SOE).
3. Privilege Escalation / Zero-Day: Evidence suggests a **Linux kernel privilege escalation (CVE-2010-3081 or similar unpatched exploit)** gave root on app servers, allowing deployment of custom backdoors.
4. Data Exfiltration: Over several days (Apr 17–19), attackers dumped tables containing:
   • Usernames, emails, DOB, addresses
   • **Password hashes (SHA-1, unsalted — trivially crackable)**
   • Security questions/answers
   • Purchase history, billing addresses
   • **Credit card data (encrypted, but keys potentially accessible)** — Sony claimed no CC theft; experts disputed.
5. Persistence: Backdoors remained until Sony took the entire network offline (Apr 20).

Root Causes (Sony's Failures)

• **No Web App Firewall (WAF)** / Input validation on public endpoints.
• **Unpatched Servers:** Known kernel exploits unmitigated for months.
• **Weak Crypto:** SHA-1 unsalted password hashes (industry standard was bcrypt/scrypt/PBKDF2).
• **Network Segmentation Failure:** Web tier could reach core DB tier.
• **No 2FA:** Single-factor auth everywhere.
• Slow Detection/Response: Intrusion undetected for days; public disclosure took 6 days.

Aftermath & Legacy

• 23-day outage. $171M+ cost (remediation, legal, identity theft protection, "Welcome Back" free games).
• Class-action lawsuits, FTC consent decree, UK ICO £250k fine.
• **Industry Catalyst:** Forced gaming & tech sector to adopt: mandatory 2FA, salted hashes (bcrypt/Argon2), WAFs, network micro-segmentation, incident response plans, bug bounties.

Exact exploit code/actors never fully disclosed (attributed to "Anonymous" affiliates / LulzSec). The lesson: **defense in depth** — no single layer should protect crown jewels.