http://www.ps3hax.net/2011/05/psn-and-soe-attacks-an-inside-job/ According to online reports, Sony had fired ~200 employees from SOE a few days before the PSN massive attack which led to the compromise of user personal information. A 2 week notice was handed out on March 31st, 2011 which gave whomever enough time to think, plan and act on the PSN attack – and would have all the clearance to easily to do it . Whats even worse is that if it DID turn out to be a inside job then the ex-employee could potentially have the tools to un-hash the stolen passwords and possibly even have the tools/resources to decrypt the important information such as your credit card numbers. 根据网路新闻报导，SONY在 PSN与 SOE被骇造成大量个资外泄的前几天一口气炒 了一盘 200人左右的大盘鱿鱼。SONY在三月底发出资遣通知，刚好给了这些人一 段思考的时间，也许他们就趁这段时间决定拿攻击 PSN作为被资遣的报复，而且 这些人在职位或是技术上都是没问题的。若以上推论属实，则事态可能更进一步 恶化因为这些人很可能有能够对杂凑过的密码资料进行「反杂凑(*1)」的工具， 也许他们还能把SONY声称有加密过的信用卡资料进行解码。 ****** *1 杂凑函数(hash function) 通常是多对一函数，所以没有确切的反函数，但 这边没有人看过SONY是怎麽实做他们家的杂凑函数，也许跟他们的乱数函数 一样简单也说不定，比如说： 输入资料 → 跟某个金钥进行 XOR运算 → 杂凑後的资料 那 XOR运算是一对一运算，反函数也是使用同一把金钥的 XOR运算，所以有 杂凑後的资料 → 跟同一个金钥进行 XOR运算 → 杂凑前的资料 XOR 布林运算逻辑如下： true XOR true = false false XOR true = true true XOR false = true false XOR false = false -- ○ ____ _ _ _ _ ____ _ _ ____ _____ ____ 。 ★(_ _)( \( )( \/ )( ___)( \( )(_ _)( _ )( _ \ ｏ _)(_ ) ( \ / )__) ) ( )( )(_)( ) / ● ‧ (____)(_)\_) \/ (____)(_)\_) (__) (_____)(_)\_) ★ ｏ --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 122.117.54.160