SonyPictures.com hacked, personal information and passwords compromised
pastebin.com
pastebin.com
"SonyPictures.com was owned by a very simple SQL injection, one of the most primitive and common vulnerabilities, as we should all know by now. From a single injection, we accessed EVERYTHING. Why do you put such faith in a company that allows itself to become open to these simple attacks?
"What's worse is that every bit of data we took wasn't encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it's just a matter of taking it. This is disgraceful and insecure: they were asking for it.
Doubtful, 90% of people won't remember this in a year, just like barely anyone remembers about the BP oil spill or the Toyota brake incident.
Sony might drop their name from some of their tech enterprises. The next playstation will probably just be Playstation rather than Sony, but that's likely the biggest. Considering that Sony Bravia's are often sold as just 'Bravia', I don't see it as a huge change.
I for one make it my business to remember people and to point what an evil company with a totally twisted mindset Sony actually is.
Add to that their mindboggling technical ineptitude, which is so bad that I'm sure this will be remembered in a year's time.
(I'm aware that technically Sony BMG was behind the rootkit scandal. But hey: there's the SONY brand name very clearly to see, here)
You really need to get out more.
This is different though. It's not as newsworthy since Sony is getting hacked every other week at this point, and Sony probably won't shut down any services over it.
That far surpasses the Gawker hack since all of Gawker's passwords were encrypted with a somewhat easily reversible hash (for simple passwords) and only a subset of those passwords were recovered.
Imagine what governments could do with all those email/password combinations. Cross reference email addresses with a target internal database and an agency could (is) within minutes begin to systematically download an enormous amount of emails and other private data.
And the spammers...
And nobody ever uses the same password across different systems, right?
Like I said, ouch.
Sadly, governments don't need a hack like this to get at email.
Wait... if Sony fully encrypt the database, they need a way to ask the database to be decrypted from their program.
But if the hackers use SQL injection, they would be attacking the database through a SQL call that, by necessity, must decrypt the database.
Wouldn't some sort of full database encryption only protect from someone getting a DB dump? Or am I misunderstanding?
http://www.sonypictures.com/homevideo/ghostbusters/photouplo...
http://lulzsecurity.com/releases/sownage_FILE%20CONTENTS.txt
SonyPictures.com has been owned,
this is its SQLi hole:
## http://www.sonypictures.com/homevideo/ghostbusters/photoupload/view.php?id=12838 ##
TEAR THE LIVING SHIT OUT OF IT WHILE YOU CAN; TAKE FROM THEM EVERYTHING!I am fairly certain that there are some executive meetings that are seriously questioning whether or not that initial action was wise.
I never thought this type of extortion could work, but Hot Damn. This is an effective campaign.
Talk about relentless!
Edit: This is really a losing battle for Sony. They are too big, there are too many vulnerabilities. They are too exposed. I know this sounds extreme, but are we witnessing the end of Sony as we know it ? It sounds ridiculous on the surface, but think about the distraction this has become. The billions of dollars of civil liabilities they are now open to, and this is not stopping any time soon. Talk about the perfect storm created by one anonymous group. Kinda insane, but also feels kinda cool....in a weird way. There is something liberating about a small group of 'anonymous' hackers taking on a Goliath of a corporation and winning. And I am a Capitalist to the core.
Although, the likely, annoying outcome of this is that this strengthens the hand of those that want a 'censored' Internet to prevent these types of things from happening. So this could very well lead to the end of the internet as we know it today. Also very hyperbolic, I know....but I believe it to be true.
Even if they're completely clueless: "Once is happenstance. Twice is coincidence. The third time it's enemy action."
[1]: http://blogs.forbes.com/andygreenberg/2011/05/24/sony-goes-s...
What is very interesting is that all of their Web properties seem so stove-piped. No common architectural direction, no standards, no common security defenses.
It's almost as if Sony's marketing departments are leading all Web development efforts for the company. No serious enterprise ever lets that happen.
Oh, wait... :) (Tongue in cheek)
It started with the CD root kit fiasco, in which music CDs distributed by Sony infected Windows PCs with software designed to prevent the ripping of music CDs to the computer, which also contained exploitable holes used by malware to infect computers.
Sony then removed the Other OS (e.g. Linux) feature from the new version of its PS3 consoles. This wasn't too egregious, but next they retroactively removed Other OS from older consoles that originally supported it. That upset a lot of people.
Along came GeoHot, a reverse engineer determined to get Other OS back, and no doubt other less-outspoken hackers. So he and the others did, and along with it recovered Sony's private key used to sign PS3 software, allowing Linux to access all the hardware of the PS3, as well as running other homebrew software.
Less-scrupulous individuals, not including GeoHot himself, used the aforementioned work to run pirated software on the PS3. This upset Sony.
The straw that broke the camel's back, though, was Sony suing GeoHot into oblivion (I personally suspect they also astroturfed gaming sites to get GeoHot's hack associated with cheaters at Call of Duty, which it was not). This is the final event that triggered the misguided but potent onslaught of attacks against any and all Sony properties.
References:
https://secure.wikimedia.org/wikipedia/en/wiki/Sony_BMG_copy...
https://secure.wikimedia.org/wikipedia/en/wiki/PlayStation_3...
[Edit: fixed botched pronoun after partial sentence rewrite]
I don't know about that. Remember, the vast majority of gamers only know hackers as one of two things: people who take over websites, and people who cheat in video games. GeoHot being a "PS3 hacker" would likely naturally have led these people to assume the latter, and the combination of general ignorance of the issue and an emotionally charged reaction to cheaters likely enabled that rumour to spread virally. I certainly don't think astroturfing was necessary to spread that rumour, and barring any evidence showing Sony's complicity in doing so I'm happy to apply Occam's Razor and assume it spread naturally.
Never presume malice where stupidity will suffice.
The only effect seems to be people portraying hackers negatively in general, and at best, questioning why Sony was so vulnerable. The root motivation I described above seems to get no mention.
http://www.youtube.com/watch?v=9iUvuaChDEg
I honestly think he could outdo more than a couple of their signed artists, is the funny part.
If you refused to install that firmware update, you could continue using your PS3 with that Linux installation, but you wouldn't be able to play new games or potentially play online. Basically, compute clusters that relied on that install continued working, and continue to work today.
The removal of that option incensed many PS3 purchasers, tech writers, hackers, etc. George Hotz then went on to crack the PS3's security anyway, enabling arbitrary code to run on the device (including applications that would let you run pirated PS3 games). Sony sued Hotz, ostensibly because he enabled massive piracy. This further incensed varied and sundry "hacking" organizations which began to target Sony. Eventually, Sony dropped the case against Hotz, for reasons that are difficult to discern (bad publicity for the most part). At this point, various hacking groups were able to penetrate the Playstation Network as well as many other Sony properties, resulting in hundreds of millions of dollars of lost income at this point.
http://stallman.org/cgi-bin/showpage.cgi?path=/archives/arch...
That's exactly what George Hotz does. He breaks security. iPhone security, PS3 security, etc. He's not a hacker according to the RMS definition, the pg definition, or probably most of the classical definitions. He may fit the current journalist's definition of "hacker" which is much closer to RMS' cracker. Since the web site we are on is named hacker news after the original definition, I think we should probably go with cracker for the people that primarily break security.
If he were primarily breaking security on other people's computer systems, then the distinction would likely be merited.
GeoHotz did a hard and ingenious hack to get his ps3 to do things it's not longer suposed to do. That's not cracking per se. I think cracking mostly happens with things like these folks did. Using a simple SQL injection (probably automated) to hack Sony's site.
It's all in the ingenuity level. That where the distinction should be.
It's rather safe to fire a gun into a crowd and expect no one will challenge you. It's rather different to fire a gun into an army division and not expect everyone to fire back with better guns than your shitty pistol.
Sony has secured its customer data like it's a fucking fire alarm. Sure it has the illusion of safety hidden behind that plate of glass, but when you provide people with a hammer to break the glass and pull the handle it's really rather pointless. They're going to bitch and moan in front of congress, parliament and every other government that asks them WTF about cyber security and blah. When they've installed a turn style at their revenue source and got surprised when people started stealing.
They have a huge surface area to be targeted and very few people tasked with defending them, against god knows how many hackers that take joy in doing this. And it takes only one to wreak havoc, and they can only do something with the person after the damage is done.
This is true for most corporations with online presence, but Sony gave the hackers a reason to target them specifically.
As someone who doesn't own any Sony products and doesn't know or is in the groups making this madness, I can just sit back and enjoy some popcorn.
The only thing happening in those executive meetings at Sony is a discussion of which lobbyists to hire and which laws to buy in order to punish their legitimate paying customers even further.
Well, Sony (and the rest of Japanese industry) has been on a downward spiral for the last 2 decades. This is just the final blow. Their end has been in sight for at least 5 years now.
Cracking big company stuff is more about persistence than about skill.
Skilled hackers are bored by SQL injection attacks.
What Sony has done is give thousands of bored teenagers a reason to hate them.
My advice would be to assume any data Sony has about you is already in the hands of attackers, and do whatever you can to minimize the usefulness of that to the attackers (which largely means ensure the password you used at any Sony site isn't useable anywhere else online)
Given the wildly different business sectors that Sony is involved in, it's really not so surprising that their security varies considerably amongst them. Somehow I doubt lulzsec would be anywhere nearly as successful if they were attempting to steal semiconductor manufacturing information from the Japanese offices. Although that might just make it all the more insulting to Sony's customers who just had all of their personal information stolen.
But would you find most storing passwords in plain text? in 2011?
I remain pessimistic.
I'm not sure that is true for any company with as much surface area. I would be extremely disappointed if it were true of any of Canada's five major banks, for example. Google has been under continuous hacking attack from China and so far they haven't had to 'fess up to storing passwords in plaintext.
I also agree that a big surface area (such as units with independent web strategies all over the world) increases the likelihood of there being some breach of security. What I find embarrassing here is that we aren't talking about one of the Sony properties having a breach, it's lots and lots of them.
I suggest that this is symptomatic of a problem with Sony itself, not just the surface area they present. What I'd expect from a well-managed company with a big surface area is yes, some property might have a breach, but that would be the exception. It's beginning to look like Sony's lax security with respect to customer information is the rule and not the exception.
JM2C, I am not claiming I know this for a fact.
I do see your point about Sony, and they may in fact be an outlier here. I think I've been accustomed to the story of customer information breaches from large corporations though, and so maybe I'm overly pessimistic?
My business account also has a different two layer, one password, one authentication device.
I have to disagree. Lots of big companies are not great at security, but this is just horrible!
When was the last time a website break-in wasn't news?
So how many companies who store personal information are being compromised these days? I have a feeling that Sony is not unusual in their level of insecurity.
Unless you think hurting one company you deem bad outweighs hurting a million innocent private citizens, then your priorities are a bit messed up.
Unpleasant is the word your choosing to use? Having my credit card information that links to my bank account, and the only bank account I have, and then having that fucked with is more than unpleasant. I'm thankful when the PSN network was compromised I wasn't one of those people with the claims of large sums of money being circulated out of the bank. ( Yes I know, could easily be coincidental evidence. Not the point. )
By all means the cause is more than plausible with Sony's abysmal track record. The methods are absurd and obnoxious, but by all means keep hiding behind this tired old excuse that the end result is to hurt Sony. The people you're trying to help will have no sympathy when you're caught and sentenced.
Irritating, painful, expensive? Choose your favorite word to describe your experience as a Sony customer, I guess.
but by all means keep hiding behind this tired old excuse that the end result is to hurt Sony
It's not an excuse, it's a hope. I sincerely hope that this will hurt Sony's bottom line in the near future. I hope that some time soon, the general public will associate Sony with being screwed over, and that they factor that in with the price of that shiny PS3 they want. I hope that Sony will be humbled and beg customers to come back, rather than treating them like shit. This is hardly the first time Sony's customers have been screwed by Sony's customer-hostile policies, so I don't expect it, but I certainly do hope for it.
The people you're trying to help will have no sympathy when you're caught and sentenced.
When I'm caught and sentenced? For schadenfreude, or do you think I'm behind this attack? My handle is easily associated with my meatspace ID; if anybody that mattered thought I was behind this, I'd most certainly be chatting with the FBI right now instead of with you.
Disruptive. I've been going paperless( in regards to money )since 2008, this was a flat out disruption on my day to day life.
>This is hardly the first time Sony's customers have been screwed by Sony's customer-hostile policies, so I don't expect it, but I certainly do hope for it.
Sony's abysmal history is public knowledge, that still had little choice in the limited choice I had with buying a gaming system.
>When I'm caught and sentenced? For schadenfreude, or do you think I'm behind this attack? Kudos for missing that hyperbole.
By all means keep downvoting me. How many of you disagreeing with my point about the extremity of these methods were effected by any this? That's what I thought.
1) Sony would just accuse them of lying and people (the general public) would just believe Sony over a bunch of anonymous hackers.
2) Change doesn't happen unless people get off their butts. This is a way to motivate that change.
I don't necessarily agree with it, but you're talking as if there is no logic behind this other than recklessness.
"This is disgraceful and insecure: they were asking for it."
I get it, they have poor security, as a customer, this makes me really angry. But the general tone there is kind of similar to what you get when people accuse rape victims of being complicit in the rape. "She was askin' for it!"
Not when there are hostile state actors who have presumably been enjoying that access for years without publishing it. These guys just told us about it.
Blaming victims for rape is dangerous because it discourages victims from coming forward, and adds to intense feelings of shame and guilt that come with sexual violation. It also tends to come with suggestions that women should restrict their behavior, not seeking to be attractive or acting in 'risky' stereotypically male ways.
Criticizing a cooperation for failing to follow security best practice, and speculating about the effect of outsourcing or technology is completely different. I'd say that as a lot of people here run websites, it's probably a good idea too.
Sony has been targeted for several major intrusions lately and I'm certain they have lost a great deal of money because of it.
Now if hackers want to damage Sony, how about finding a way that doesn't also involve millions of regular people in the process.
I got my one and only Sony product (PS3) because I use it for something. Not because I support Sony in every decision they make, and I definitely think they should do something about that joke for security they have going on.
But why should the user be punished and shat on by some idiot hackers just because he/she decided they wanted a cheap system to play games on, for example?
They could do a million things to hurt Sony financially instead of fucking over millions of end users who aren't connected to the company at all. (I'm counting all the affected users of all the latest Sony attacks, in case someone has a problem with the figures.)
Also, I think they chose to release the stolen data out of ill-will towards Sony rather than it being an attempt to point out security flaws. Because if security flaws where the real issue they attack Sony, then they wouldn't release the info to everyone since that seems quite counter intuitive.
These companies are fucking stupid and the only way to make them change their ways is to kick them in the balls and piss on them while they're down. Otherwise, nothing happens and others who were less kind don't tell them and harvest the data unbeknownst to anybody. How's that for "real issues"? The real issue is the companies fucking suck and it pisses us off when they don't do a goddamn thing when we report it to them.
I agree that Sony should be taken to task here, but even the simple step of randomizing the password field would be a good idea.
If someone takes them to court and a huge, ridiculous, judgement is handed out, then maybe these companies will think twice about securing their customers data. Seriously, unencrypted password fields? A SQL injection?
Of course, I'm just dreaming.
Software is still more alchemy than chemistry today. There are no objective measures or well-trusted authorities which can be used to ensure that any given developer or any given piece of software meets a certain degree of competence or quality. Only the subjective judgment of fellow alchemists can reliably gauge the quality of another alchemist, and then often only with a rather lot of effort. The most fundamental consequence of this is that no organization can easily produce high quality software merely by throwing enough money at it. This is a competitive advantage for small high-talent shops but it has some rather negative consequences for the rest of the world.
Like an old friend of mine used to say, "you pay peanuts, you buy monkeys"
The main issue is that the advertising agency handled the development very poorly. Expectations and specifications were not well defined, budgets were not set appropriately, and project management was largely absent. This leads to my fellow developer and I, who were brought in because the agency lacked developer talent, having to scramble to get all the features in before the deadline.
I would blame some of this on lack of technical project management as well, not just on the coders.
Yet, I can understand a bit of this mindset. Far too many websites are to be discarded by the end of the campaign. When so many products are supposed to last a month or so, people often forget about how sausages should be made.
Bitcoin is just another imaginary currency. But now its technofreaks imagining it, what a difference. A real adventure into economics and currencies would be to strive for a society with no currency, where people do things for the lulz. Not for the coins man.
I don't get this anti-Bitcoin thing at all. I'm not for or against it, it's interesting tech for sure - fascinating even - and obviously polarizing to some. But I just don't get this attitude at all, at least amongst HN'ers.
Edit: Typo.
What is to stop a competitor of Sony from trying to take them down under the guise of disenfranchised youth.
Not sure if I buy the "as a kid would write" bit, but it is surprising to see this. Maybe the hacker just took 10 mins and proofread his own text?
Cracking often has a playful tone to it.
Sony is getting owned on all fronts several times a week for the last month or so.
edit: Nevermind, looks like they haven't actually sued any jailbreakers.
Yes, you did.
Second, Apple hasn't sued any jailbreakers.
Looking at the URLs that iTunes and friends use behind the scenes it doesn't seem like the apple web-stuff was built by competent programmers either.
Try a few random clicks on https://iforgot.apple.com and look at the url-bar and firebug to get an idea.
A major feature, removed by automatic patching, as a non-legal reaction to a previous jail beak attempt, was the ability to run a second OS such as linux. You might recall stories about people using networks of play-stations running linux, with their unusual cell processor architecture, to crack wpa, or model the weather.
This wasn't to sony's benefit. The playstation was a cheap way of getting the cell chip rather than buying blades full of them from IBM, absolutely because sony sold the consoles below cost and hoped to make the money back from game royalties.
The ability to run pirate, or unlicensed home-brew games threatened sonys ability to recoup this money from normal users, so they pulled second OS.
A lot of users chose the playstation over alternatives because it would run linux. It was a nice dual use 'TV media PC' and console. Sony removed the feature that they paid money for. The users were upset, probably more upset than they were by the hotz thing which was a bit abstract.
But I don't think these hackers cared, personally.