PSN Password Reset Exploited

[JohnnyMcKinney]

It's a hack war against Sony lately, was the PSN just hacked again? Not so, says Sony, but the password reset system was exploited somehow.

Earlier today, A group of savvy Internet users discovered an exploit loop in Sony's password reset system for PSN, thus forcing Sony to shut down PSN for a little while. The exploit follows:

1.) Navigate to : https://store.playstation.com/accoun...d.action?token (this is normally, via email, https://store.playstation.com/accoun...YYYYYYYYYYYYYY with the y's being a unique token) – do not enter the code at this point.
2.) Open a new tab in firefox, and go to fr.playstation.com (other pages will work too most likely), and click Login (Connexion)
3.) Click Recover password
4.) Enter the email and date of birth of the target account
5.) Click continue, then on the confirmation page, click "Reset using E-mail"
6.) Switch back to the original tab, and enter the code, then click continue
7.) You will now be asked to enter a new password for the target account"


UPDATE:
Sony has fixed the problem, however, so PSN users can rest easy. Patrick Seybold, Sr. Direct of Corporate Communications and Social Media for Sony, issued the following statement on the official PlayStation blog:

"We temporarily took down the PSN and Qriocity password reset page. Contrary to some reports, there was no hack involved. In the process of resetting of passwords there was a URL exploit that we have subsequently fixed.

Consumers who haven't reset their passwords for PSN are still encouraged to do so directly on their PS3. Otherwise, they can continue to do so via the website as soon as we bring that site back up."