The most dire scenario is that attackers gained, or tried to gain, control of the part of Sony's network that issues updates for the PlayStation 3. If that were to happen, the attackers could use the private key uncovered late last year by the fail0verflow hacker collective, and independently published around the same time by jailbreaker George Hotz, to sign malicious firmware updates offered to tens of millions of console owners.
In 2008, researchers effectively created their own rogue certificate authority by harnessing the massive computing power of just 200 PS3s to find so-called collisions in MD5, a cryptographic hash algorithm with known weaknesses. With an army of literally millions of zombie PS3s under their control, hackers would own a supercomputer at par or superior to those possessed by most nation states, and they wouldn't even have to foot the power bill.
“It's really scary,” said Marsh Ray, a researcher and software developer at two-factor authentication service PhoneFactor, who fleshed out the doomsday scenario more thoroughly on Monday. “It's justification for Sony freaking out. They could lose control of their whole PS3 network.”
