Security Expert Testifies That Sony Knew Its Security Was Out of Date for 'Months'

During yesterday's hearings held by the Congressional House Subcommittee on Commerce, Manufacturing, and Trade on the subject of data theft--and, largely, the current situation with Sony and the PlayStation Network--the committee heard testimony from Dr. Gene Spafford, the executive director at Purdue University's Center For Education and Research in Information Assurance and Security. During his testimony, Spafford dropped a potentially damning piece of info regarding the Sony breach.

Specifically, Spafford claims that Sony employees were well aware that the company's security measures were out of date and vulnerable to attack. Spafford's claims come from an open Internet forum used by security experts, including several Sony employees. According to him, several people on those forums realized that Sony's systems were using "very old versions of Apache software that were unpatched and had no firewall installed." The issue was reported "two or three months" prior to the attack that brought down the PSN service. In that time frame, no acknowledgment of the report nor any visible updates to the systems came about from Sony.

Spafford himself was not a part of these original forum discussions. Rather, he cited reports from others reportedly involved in these security forum discussions. While that can lead to a bit of speculation on exactly how accurate his time line is, a statement like that under oath is still likely to add a great deal of fuel to the federal government's investigation, not to mention the various civil suits that have begun to spring up like wildfire since the scope and severity of the Sony attack became public.