Assessment Item 2: Data Breaches in Adidas and PlayStation Network

Desklib provides past papers and solved assignments for students. This report analyzes the Adidas and PlayStation Network data breaches.

MITS 5004
IT SECURITY
ASSESSMENT ITEM 2

Contentss
Part A...............................................................................................................................................3
1. Adidas -“millions” of customers records– June 2018.................................................................3
Problem Statement.......................................................................................................................3
The main cause of the data breach...............................................................................................4
Possible solutions to prevent any such data breach in future......................................................5
2. Asynchronous I/O activity: Problem with many memory protection schemes including paging
and base bound................................................................................................................................5
Part B...............................................................................................................................................7
1. 2011 Sony PlayStation Network outage case..............................................................................7
Problem Statement.......................................................................................................................7
Who was affected and why?........................................................................................................7
How the network was hacked?....................................................................................................8
Probable solutions for the attack..................................................................................................9
References......................................................................................................................................10

Part A
1. Adidas -“millions” of customers records– June 2018
The US outlet of Adidas an athletic attire company has faced the greatest security breach by the
end of June 2018, when millions of their customers were warned about their personal data
getting stolen during a breach in the security system of the company online marketing system.
The company stated that unauthorized access acquired some of the sensitive limited data of some
of its consumers. Data breach effect the integrity of the company and damages the brand image
of the company. The intensity of this effect is not yet discovered and the number of customers
affected by this attack remained hazy (Green, 2018).
Figure 1: Adidas US data Security Breach
Source: (Green, 2018)
Problem Statement
According to US IT security information’s and different reports regarding the Adidas Security
breach, the incident provided an unauthorized exposure of the customer's sensitive data that
includes the encrypted passwords, username and customers email address of its US outlet
consumers. The company informed its millions of consumers about the probability of getting

their personal information getting hacked from the US online website. The maker of the
sportswear informed that the financial data or the fitness related data of the consumers are not at
risk only the personal information’s that include the contact information’s of the consumers such
as email address and address and the passwords that are encrypted was having the probability of
getting affected by the data breach by the cybercriminals.
According to the report of the preliminary investigation, revealed that the credit card
information’s and the fitness related information’s of the customers was not affected during the
data breach, the limited data that is affected during the data breach included the encrypted
passwords, contact information’s and usernames. The company appointed experts and notified
the enforcement of law to initiate investigation and help in finding facts regarding the reasons
and the loophole in the security system of the companies US website that claimed that the breach
was reported on 26 June, 2018 by an unauthorized party when the hackers tried to sell the
information’s hacked by them. The hackers targeted certain customers by sending then phishing
emails to convince them for sharing their personal information through malicious emails. The
customers that shop through the online website of Adidas that is adidas.com/US are predicted to
be affected the most as the number of customers affected is yet not specified. Only the US
customers were affected by the data breach and the other stores including Reebok which is its
subsidiary is not affected by the data breach (Leyden, 2018).
The main cause of the data breach
The likelihood of the cause of cyber attack among the e-commerce retailers continued to increase
and it has reached up to 29 percents since 2013. A data breach can quickly transform as a crisis
for the companies. The main cause of this data breach is lacking in the defense layers of its US
website the password was encrypted yet it was broken by the hacker. Lacks in SQL protectio0n
as a result phishing email were allowed on the site that gained the rust of the customers in
providing their personal information over the site. The software system has not updated the
patches for the security issues were not updated as a result the system could easily be exploited
(Alaimo, 2018).

Possible solutions to prevent any such data breach in future
Adidas was aware of the data breach earlier on 26 June but the company chooses not to disclose
about the breach until it occurred and affected millions of its US customers within 72 hours of its
prediction. Adidas is very committed to the security and privacy of its customer’s personal and
sensitive data so it started taking decisions regarding the scope of the data breach issue and
alerting their customers. Adidas initiated working with the firms for strengthening the data
security policies of its e-commerce site. Forensic investigation department is also involved by the
company for the investigations regarding the loopholes in the security system of the e-commerce
site. Within 72 hours the company implemented and generated a response to the data breach that
included the cautioning system for the customers those who are affected by the data breach and
advising and alerting them for checking the card statement related to the online payment and to
change their login passwords. The following can be the solution s to address the issue of the data
breach experience by Adidas:
Multilayer protection on the site can be an effective method for protecting the sensitive
information of the customer.
The redundancy of the data should be employed for the protection of the data.
A proper mitigation plan should be maintained and prepared to address DDOS
(Distributed Denial of Service).
Avoiding the involvement of the third part on the e-commerce site and keeping the site
updated with security patches (Leyden, 2018).
2. Asynchronous I/O activity: Problem with many memory protection
schemes including paging and base bound
The continuation of any other process before the finishing of transmission of any process is
permitted by asynchronous I/O activity in a type of output/ input processing. In an operational
environment where multiuser is involved in the operating system that has the ability of fence
registration add a huge advantage with the characteristics of relocating. The problem that is
related to the relocation of the users is solved with the help of starting base and address provided.
The loading of the program that is required for execution in case of more than one user is totally

unpredictable. The addresses of the base provide the offset of the entire program that is present
inside. A bound that is lower is provided by fence registration of an operating system and the
base registered is explained as fence registrations that are variable. The flaws in the areas that are
forbidden are checked by the upper bound. The space allocation is also verified and determined
with the help of the upper bound. The problem is addressed by the addition of a second register.
The content that is related to base address is required to address and for this, all the programs are
obligatory to be placed on the base address and the bound register which is the 2nd register is a
limit for upper address. The content related to the bound register and the base register is required
to be changed during the interval of changing of execution changing from one operator to other
such that true space for the address is reflected for the operator or the user. The problem of the
modification of addresses is protected with the help of this technique. A context switch is a
method of common preparation and this technique is a portion of this common preparation. A
throughout protection is ensured for the users from other users with the help of the base register
or bound register (Microsoft, 2018).
The bound checking and the base checking only addresses the problem that is within the user
address so the flawed address that is inside the user space is still, not secured from the attack of
outer users. This problem can be addressed with the help of some different base register and
bound register pairs. The first pair will be for the program instruction and the second pair will be
for the data space. The two pairs of registers related to base or bound are not enough to end the
errors that are related to the programs but it can somehow limit the manipulation effect of the
instruction of the data space. The fetches related with the instruction are checked and relocated
with the 1st base or bound pair and the access of the data are checked and relocated with the 2bnd
base or bound pair. The registration pairs related to bound or base provides one more protection
advantage to the program user that is the ability to split a program into two different parts for
separate relocation. The practical designs of the computers are limited by these pairs of bound
register or base register. The data related to reading only, code and the value of the data that are
modifiable can be called off by the two pairs of the registers. More than one space of the data is
specified by more than one pair of registers. For addressing the operands of the instructions, the
machine code related to the instruction indicates the correct use of the relocation pair.

Part B
1. 2011 Sony PlayStation Network outage case
Problem Statement
2011 Sony PlayStation Network outage is basically an external form of intrusion on the network
of Sony Play station and the services of Qriocity that compromised the personal and sensitive
details from accounts of 77 million users and also prevented the access of the users to the
PlayStation Portable consoles and PlayStation 3. The launch of the online market place allowed
the users for purchasing of films and video games through the consoles of their play stations and
the attack put this new online marketplace launch out of action. The attack on the Sony play
station network occurred around April 17, 2011, to April 19, 2011. Due to the stack, Sony was
forced to turn off the network of play station on 20th of April, 2011. The duration of the network
out sage lasted for almost 23 days and it has been found that on 4th of May the information’s that
are personally identifiable that is obtained from the 77 million users of Sony play station
Network had been exposed. It is found to be one of the biggest data breaches that have occurred
in the history with a count of 77 million account6s that are registered with Sony play station
Network. It proved to suppress the TJX hack, 2007 that had affected almost 45 million
consumers. Different Government officials in several countries raised a concern about this issue
related to the largest theft and the delay that is caused by Sony regarding informing its
consumers about the breach or data theft (Anthony, 2019).
Who was affected and why?
Around 77 million customers were affected by the network theft that occurred with the Sony
Play Station Network. The theft affected the personal data and information including their
names, email address and address of 777 millions user of Sony Play station network who was
having a registered account with the Sony PSN (Play Station network). All these personal data of
the 77 million people were stolen but it was reported that the theft did not affect the financial
information of the people that includes the credit card information’s, only the personal data were
affected. The company suspended the network system once they were informed about the theft

and the gamers those were having an account with the play station network had been logged out
of the network. It was discovered by the company that around 17 to 19 April 2011 an
unauthorized personal got illegal access to the addresses, names, birthdates, email address,
passwords, usernames, security questions, logins and many more personal informations of the
gamers registered with the play station network. The company also published an alert for the
children’s who were registered with the play station network with the account of their parents
also have the risk of having their parent's personal information’s to be stolen. The company was
sure that the credit card information’s were not affected yet there were some instances that the
company was having regarding stealing of the credit card number and the date of the expiration
of the credit card. It was Distributed Denial of Service attack (DDoS) that was experienced by
the company that affected the gamers who were registered with the play station console (Quinn
and Arthur, 2019).
How the network was hacked?
It was an external intrusion that affected the play station network which is much more brutal than
a denial of service attack. It was reported by the company that the data security system
mechanism of the play station network was fully circumvented and this lead to the breach and
accesses of a database that one most sensitive among the databases. The exact vector of the
attack was not identified as the security system of the Sony was always been tight. But according
to the anonymous attack that was faced by the company the attacks somehow relate to the
database breach. The anonymous unauthorized person found out the weakness in the data
security system of the play station network and passed the data related to the loophole onto the
hackers. The hackers then took control of the system through a SQL injection. The release of the
customized Play station 3 firmware which is called the Rebug, and through this Rebug the users
got an excess trusted through the play station console to the network of the internal developers
and this access to the internal developer network gives an access to wide range of hackers and
increases the possibilities of hacking that includes faking the credit card information on play
station network. With the installation of the custom firmware, the database of the customers is
easily accessible to the hackers (Eurogamer, 2019).

Probable solutions for the attack
It is impossible to ensure the complete privacy and security of data yet data encryption in a
manner that ensures the privacy of the users and making it valueless for the hackers can prevent
the unauthorized access of the hackers the personal information of its consumers. Sony hired
firms for investigating the security issues with the system and about the data breach that has
occurred in the company. Once the company is aware of the probability of the attack it has
informed its customers to review the account details that were provided including the credit card
information’s, email updates, etc. The entire system of the play station network required to be
rebuilt with increased security layers and with strong data encryption for passwords, email
addresses and credit card details (Kotaku, 2018).

References
Anthony, S. (2019). How the PlayStation Network was Hacked - ExtremeTech. Retrieved from
https://www.extremetech.com/gaming/84218-how-the-playstation-network-was-hacked
Global impact of Sony security breach. (2019). Retrieved from https://www.pri.org/stories/2011-
04-27/global-impact-sony-security-breach
Quinn, B., & Arthur, C. (2019). PlayStation Network hackers access data of 77 million users.
Retrieved from https://www.theguardian.com/technology/2011/apr/26/playstation-network-
hackers-data
Five years ago today, Sony admitted the great PSN hack • Eurogamer.net. (2008). Retrieved
from https://www.eurogamer.net/articles/2016-04-26-sony-admitted-the-great-psn-hack-five-
years-ago-today
The PlayStation Network Breach: How, Why, And By Whom?. (2018). Retrieved from
https://www.kotaku.com.au/2011/04/the-playstation-network-breach-how-why-and-by-whom/
Synchronous and Asynchronous I/O - Windows applications. (2019). Retrieved from
https://docs.microsoft.com/en-us/windows/desktop/fileio/synchronous-and-asynchronous-i-o
Leyden, J. (2018). Adidas US breach may have exposed millions of customers' personal info.
Retrieved from https://www.theregister.co.uk/2018/06/29/adidas_breach/
Alaimo, D. (2018). Data thieves go after Adidas, other sports and fitness sites. Retrieved from
https://www.retaildive.com/news/data-thieves-go-after-adidas-other-sports-and-fitness-sites/
527018/
GREEN, D. (2018). Adidas is warning customers that their data may have been leaked in a
security breach. Retrieved from https://www.businessinsider.in/Adidas-is-warning-customers-
that-their-data-may-have-been-leaked-in-a-security-breach/articleshow/64785288.cms