Sony Got Hacked Hard: What We Know and Don't Know So Far
wired.com
wired.com
The same could be said of Sony: empathize a little with them. Sony Pictures pays a lot of creative people. Maybe they should have seen the hack coming, but like the PSN outage this story will be maybe a paragraph in a Wikipedia article years from now. Even one great film could be watched by people a century from now, and I respect that their priorities are around figuring out economically viable filmmaking, not I.T.
The film industry regards Sony Pictures as the major studio that still takes risks on edgy comedies and dramas. They are known to respect directors more than the other majors.
Gawker will surface their ridiculous PowerPoints which truthfully exist everywhere. Or journalists will scandalize the executive pay and severances, nevermind that Nick Denton's and Anna Wintour's paychecks and perks are probably far more offensive.
But I don't mean to engage in whataboutism. In fact I mean the opposite: Just because some tech companies care a lot about security doesn't mean everyone should.
Look, I get the creative field costs a lot of money. But Sony Pictures was paying $454,224,070 http://fusion.net/story/30850/ in total salaries as of May.
Even hiring 5 more security engineers would have gone a long way. That's $1 million if we assume a $200k salary for good security engineers. A drop in the bucket for Sony Pictures.
I personally could do a lot with 5 security engineers.
My account was included yet my password was 18 months out of date.
Or was that sarcasm?
software engineers wont magically fix executives handing over credentials to hackers.
if you were designing a network and interface to access your files, maybe you could design it without resorting to passwords, but that wasn't practical in sonys case.
maybe they could have designed their network to notice the data leaving, but again, the hackers could always find a way to win. (physical infiltration of the company and a verizon hotspot?)
and all those important files were just lying around
You can't project a film without a dedicated digital link to Sony's servers in London authorising it. For some movies they send personnel to your cinema to record the audience with IR cameras. For some movies you are not allowed to let the staff watch the film for free.
That's it. Whether a designer was comprised through a phishing attack or a physical door with access to the sensitive environment was left unlocked, there were clearly no controls in place to manage all the files just laying around like money under a mattress.
Network attacks on infrastructure and/or exfiltration by rogue (or rouge) elements within your own workforce are vastly more difficult to detect. Not impossible, but they involve both violations of trust and allegiance, and plausible cover under other activities.
Though, once you're aware of / suspect such exfiltration, there are generally a limited number of places to look for suspects / points of access.
You also have to give them a share of your ticket sales, provide sales figures and you cannot offer discounted tickets for concessions or special offers.
Much of that is effectively exercising control over the market venue though. The studio gets to specify which facilities do or don't meet the standards required to show their content. To that extent, the technical restrictions are less about keeping the content from being pirated (there are plenty of other leak channels, typically pre-release review copies, which have their own copy controls, yes), and far more about keeping cinemas beholden to the studio vassal lords.
I think you're thinking too much about UX, Passwords, and phishing links when you're forgetting all the other layers that a usable security environment can provide without the needs of passwords (e.g. authorization control, segmented file servers for each department). A security engineer can definitely create a very safe and secure environment WITHOUT negatively impacting the usability, experience, or workflow of the creatives working on their designs and art.
So how do you measure their risk and the probability of being damaged? Serious security experts are STILL trying to figure out how to calculate these things. Insurance companies still have trouble "properly" pricing cyber insurance. The insurance companies are doing it, but they are way behind their ability to price for other forms of disasters.
So how much should they spend towards cyber security? How far off are they from that amount? We don't know. (well maybe we'll know from the leaked documents).
This dump clearly shows personally identifiable information, something that would be easily classified as sensitive (e.g. SSNs). I'm very sure Sony Pictures classified their leaked movies as sensitive since it would cause massive financial loss (which happened) if it was stolen.
If anybody was doing a Risk Assessment, protecting this critical part of the infrastructure would have been number 1 on the list.
Hackers are even claiming that a physical door with access to the sensitive environment was left unlocked. That's security 101!
We are arguing here from position of knowledge that guys who make these decisions likely do not have. Should they have it? Probably not, but they definitely should listen to someone who knows and who can present solid risk/cost/benefit analysis that they can understand.
In fact, I'd argue that those big bonuses would imply that they're professionals worth the money, and should be making more robust decisions.
And that's a fucking stupid thing to say in those cases, so it's a fucking stupid thing to say here.
Things like security and performance should be given. This is akin to arguing that small restaurants shouldn't care about food safety, or that small construction firms shouldn't worry about building codes. If you ignore these things, you'll fuck it up and people will get hurt.
When it comes to a company with hundreds of millions in revenues, however, they have clearly underestimated the risks and have been irresponsible.
It just means there's a minimum, a bar, that they shouldn't go below. Everyone has a different bar, but most people generally agree on things like don't pick up food off the floor, don't leave things open or out, put things in the right places, make sure you wash your hands, etc. (I am not a food safety expert).
Of course, for a startup, it depends on the product or service they're offering. A startup payment processor should be very security conscious, as the stakes are high. A movie logger should have the bare minimum that all startups should have, i.e. strong encryption, basic security protocols, etc.
I think it's NOT appropriate. Of course, in the end, it's a matter of value: Do you value your health equally with your digital privacy, your money, etc.? If 'yes' then the analogy yes, if 'no' then it doesn't. I don't so, to me, it doesn't.
What is the expense associated with, for example, not concatenating user-supplied input in SQL queries?
Developers are developers. If you're going out of your way to hire extremely untalented people, because they're cheap, you're going to get owned.
If you're hiring people who understand their own craft, you can get a junior developer for under $70k and a senior for under $100k. Unless you're in SF in which case multiply everything by 2 or 3.
A start up is like a restaurant with 2 doors into the kitchen. 1 door from the outside, 1 door for servers to enter/exit.
In a restaurant the workers can easily spot problems. And if someone walks in usually you kick them out, or lose a batch of food. The cost is much smaller than hiring 2 full-time bouncers.
If, however, you now have a giant catering hall with 50 entrances to the kitchen and hundreds of people there, security / bouncers are necessary.
The problem is how to go from one to the other, and not realize you need security when it is too late.
On a 100Mbit/s pipe that would take something like 3 months of full saturation to get that amount of data out. Realistically, we're probably talking about a hack spanning nearly every one of their systems for upwards of a year.
No, it's completely different. Food safety and building codes is akin to good software engineering; on the other hand, security against hacks is more like a restaurant protecting you from a third party poisoning your food, or a building withstanding planes crashing into it. Most building and most restaurants don't offer such protection.
Secondly - Did you see the words over optimize? There is certainly such a thing as too much optimization in terms of security. Would you hire police men to patrol your kid's lemonade stand startup? No.
1) 100Tb of storage on presumably short notice
2) The bandwidth required to move all of that before sony noticed
This [likely] wasn't some script kiddie that exploited some obvious security hole. Of course their security was under optimized. Every single theft in the history of time has been a result of "under optimized" security.
Ocean's 11 is about "under optimized" security.
Alternatively the first newegg hit for a 6T hard drive is $300 even. That's 17 of them so $5k plus shipping. Either add in a chassis with enough slots or enough smaller machines to distribute it so say double to $10k or less than $1k per person.
Or even lazier, to store all 100T on S3 for a month and pull it back out is ~$12k, again maybe plus a bit for an EC2 instance to do the shuffling. Again, ~$1k per person.
And of course if you're a hacking group the chances that you've got root on some small business servers scattered around the world are probably a bit better than zero.
Like literally the first rule of Security is that as the person trying to defend, protect, secure something you are always at a disadvantage. Of course Sony has money to hire top notch Security Engineers to protect their interests and I'm sure they do but like anyone else they can be beat.
This is all not even accounting for the security black hole that is user idiocy, or the fact that the article makes several references to potential inside help.
In short Sony's past exploits don't give them a ton of credit but it's also a bit ridiculous to go from they could have done better to where this whole thread went.
Maybe they do; I don't know. That's not really relevant to the point which I'm making, which is more along the lines of:
"Disregarding security as a startup because it's not a 'core competency' is ill-advised. History suggests that you're likely to be compromised, and it causes harm not only to your business, but also to your users, and is absolutely irresponsible."
I'm not in touch with the film industry, so could you link me to a discussion about this somewhere? I find the idea of Sony taking risks hard to reconcile with the mess that was "The Amazing Spider-Man 2", but as I only know the comic book fan side of things I could use some extra background.
And remember too that while the sequels of both SM film series have been largely crap, the originals were big risks in some respect. The first Spider-Man gave a massive budget to a director largely known only for low-budget shlock, and the ASM reboot meant deciding only a few scant years after the last one to completely dump and start over a franchise that was circling the drain.
If the 100 TB figure is correct, this has been going on for some time - it takes time to steal that much data in a way that does not raise a bunch of red flags. If the red flags weren't there to be raised or they were and were ignored, well... at least their executives got their bonuses.
Also, in the interest of fairness, while this malware attack seemed to be directed to Windows machines, a dedicated enough intruder would have developed attack strategies for any platform.
A "fraction" of a bonus. Let's assume their bonus is a paltry 100k. A good infosec pro expects on average to be making at least 200k, so you have already blown out your budget. You can take a swing at hiring a consultant, but that gets you 5 weeks at around 70k, so you are eating a huge chunk of your fractional bonus budget.
Consultants don't really work for systemic problems like this though. Sony has cancer. They need empowered specialists to come in and tear out and then replace. These are both technical and managerial problems that exceed the capabilities of your average defcon attendee.
I disagree with both the approach you have taken here in envoking executive pay envy, as well as the substance. Security is hard. Practicing good security is expensive. You don't get to throw a couple of hundred grand around once and call it good. It is an ongoing and expensive investment.
In any case, thanks to the leaked information, it should be easy to tell exactly how much Sony paid the people who are responsible for this mess.
Security is hard, but this looks like a lot of low hanging fruit being picked effortlessly. My bet is that just a tiny bit of effort would have made the intruders work much harder.
I agree with your overall point, but the first page of the leaked salary list alone has something like $35M worth of bonuses. Say the high-level execs are the only ones sacrificing their pay, and the 'fraction' of bonuses was 20%, you'd have $7M annually to spend on infosec -- in addition to all of the money they're already spending (and apparently wasting). This would pay the salaries of ~30 top-notch security people.
In any case, it was just a comparative point, they clearly have the cash flows to hire competent security staff without impacting others' pay if they so desire.
How so? The whole point of saying it about startups is that they are startups.. they have severely limited capital and resources and need to optimize for growth/revenue/continuing to exist.
This does not apply to Sony. If you are storing medical records and SSNs and you are multi-billion dollar company; there is no viable excuse that looks anything like, "uhh.. yeah well we are really just an entertainment company."
It's a great time to be working in the security field today.
It's not obvious to me that the $250 lock actually performs better in any relevant way. You might trust the guy, but when I'm hearing an anecdote second-hand I want to hear something more convincing than "trust the price".
Which is very much the problem -- it's quite hard for security non-experts to distinguish between good security and security theatre.
It doesn't matter how much time a startup spends on security and performance if they never find product-market fit and get to the explosive growth phase. Once they do however, this is when they need to raise real money and start addressing these "non-core" issues as well.
Sony is not a startup, is not resource constrained, etc. There's absolutely no reason to empathize with them.
"It's changing our business," says one producer of its impact on Hollywood. "From now on, money and time will be allocated by studios to deal with this full-time."
...as it should have been already, given how big and how valuable a target these companies are.
Shame that most of Sony's Finance and HR are blaming the IT department - so bloody typical!
"Everyone’s looking to the IT department to say, ‘How did you let this happen?'" said one employee in Sony Pictures’ finance department." http://fusion.net/story/31116/inside-sony-pictures-employees...
It got ignored.
If they ever get hacked, I won't be surprised.
Unless Sony has shown to be doing something malicious (which I don't think it has - other than some horrific Adam Sandler movies recently), then the angle of mining the data just to create click-bait headlines is particularly infuriating.
Yes, it is right to report such a large cyber intrusion in the public interest, especially if people's data has been taken (and Sony already had this problem occur before - so it is worth pointing out that they had a chance to tighten up security) but trawling through the internal data of an innocent private company and exposing it online, just to gossip, is particularly poor journalism. Having worked with a lot of media, you can be sure they rightly wouldn't be too happy if people did that to them - just for kicks.
But when it's a company -- it's apparently OK to just look through all their shit. It's already publicly available anyway, so what's the big deal?
> Who knew that Sony’s top brass, a line-up of mostly white male executives, earn $1 million and more a year?
is just take advantage of a difficult moment and increase the `hate`.
I don't get why this could happen on magazine like Wired...
Reading comments on the article seems that statement is pretty unfair.
I didn't check myself because I think reading those informations is bad as the hack itself, however the author who did that can also feel free to judge others.
I used to be this author's editor and that lede is very Wired.
Sad to see this "tone policing" comment is the top-voted comment on this thread.
But, yeah, it's definitely silly that the top comment is just complaining about that sentence.
Sad to see how easy is for "media" to jump from a trend to another even out of context.
Sad to see once again "you" pointing to "me" while "you/crew" had fun reading gender, ssn numbers, stipends and felt free to report your vision.
But them I am kind of biased since the whole ghotz debacle. Suck fony and all that. (yes I know this is sony pic, not sony)
One difficulty is that people who are not affected by it do not notice it and they don't think it's a big deal. It doesn't register that the star of almost every movie is a white male.
It's human nature to be lost in our own perspectives; it's why it's so important to make an effort to imagine walking around in other people's shoes: If you are a minority or a woman, you are faced with this discrimination everywhere. Every time you turn on the TV, walk down the street, at work, in social situations, dating, at the restaurant; when you read a history book, in the news (e.g., recent police discrimination issues), when you look at our government, when the camera at the football game picks out the young hot white women in the crowd, etc.
If bringing it up all the time makes you uncomfortable, maybe that's a good thing. If it seems like the issue comes up a lot, maybe that speaks to the enormity of the problem.
> If bringing it up all the time makes you uncomfortable, maybe that's a good thing.
It doesn't make me uncomfortable. I know it's an attack on a perceived villain, but in a "subtle" way. It's not subtle, it's completely transparent.
It's all about dollars. The industry thinks it'll make more money pushing white male/female stars. The racists are the movie going crowd voting with their dollar bills, and not the industry.
It doesn't make me uncomfortable that the majority of popular music is geared towards teenage white girls, because that's the market they want to capture. That's where the money is. Is that racist or ageist? No. It's marketing.
Often times these folks in charge are not only white males, but Jewish white males, which makes them a minority group as well. But that's not always pointed out.
People can, I suppose, miss the days when "white", as a term for a race, had almost exclusivey positive connotations when used by anyone with any influence in society and pine for the days when white privilege was so strong as to be virtually unquestioned, but you shouldn't mistake missing that for missing "white" not being a race.
That's not much. Is Wired trying to make me think that is a lot? Or are they trying to play it against the salary figures? Considering they spent valuable words in the first sentence to make it clear that the top brass is "mostly" white males I get the impression the comparison was supposed to mean something.
How can "news" call themselves news if all they do is speculate. Granted it wouldn't be entertaining if all they said was "Sony got hacked and we don't have any details" but that is why news is called news.
http://online.wsj.com/articles/more-signs-north-korea-may-be...
But I think most of the media pretty much just reads the news, press releases, and their social media feeds to write their articles.
In the end, I doubt there was any hacking involved at all: a disgruntled employee leaked documents. Perhaps Sony forgot to disable someone's password after giving them the axe.
Or does DPRK have a shit-hot education system in spite of literally other thing about the country being godawful and totally backwards? If so it's the first I've heard that.
The current leader went to boarding school in europe - and enjoyed the privileges awarded in that social circle. Corruption doesn't always make logical sense, nor is it limited by morality!
A very simple idea. Find bright kids. Send them overseas to the US primary education system. Their parents stay behind in NK and are bound to the society in NK - the kids need to perform well in school in order for the government to keep giving the parents a reasonable life.
Upon graduation from primary and secondary school in say, California, the kids enroll and try as hard as they can to get into Stanford. Graduate from the CS department, get a phd doing original work in encryption algorithms, and then when they are adults, they return to NK knowing that their parents had a good life b/c of their hard work.
Now you get some nice black hat hackers!
Basically this is how Kim Jong Il created a new young dictator willing to threaten nuclear war. I don't doubt their cyberwarfare division is run in a similar way.
North Korea, like South Korea and many of its neighbors a have tradition of putting a lot of weight on basic education and kids there compete for top grades and positions in special advanced schools.
As to the cyber warfare divisions. According to reports, kids as young as 12 who show aptitude for mathematics are selected for rigorous advanced computer schools. Those that pass go on to study computer science at special universities. The top graduates each year then get selected for a 5 year intense military training course, which includes studies in Russia or China. Getting selected for the cyber warfare unit is apparently one of the most prestigious military postings in NK and comes with lots of perks, so the competition to get in is fierce.
It focuses more on cyber warfare, but does cover quite a bit about CS education in North Korea.
Doubtful. Several still-in-theater or unreleased movies are apparently up on torrent sites from this hack. I don't think that they would do this just to promote another film...
Unfortunately we'll probably be left guessing as to how this hack happened and how long it went on, since Sony is not likely to ever release that information even if they figure out the cause.
The story went that each of the Sony subsidiaries[1] had their own security division that was largely autonomous for reasons of politics and budget, of course. Each part of the company had different vendors, different policies and procedures, and different philosophies on how security should be implemented.
When they would all send their representatives to have a global security pow wow, however often it happened, it ended up like an episode of game of thrones.
[1] http://en.wikipedia.org/wiki/Sony_Corporation_shareholders_a...
And they could centralize all of that and ... it still wouldn't solve the problem. You'd have a single point of failure that might still leave them with their pants down at the end of the day.
Some days, you just can't win. You can have the smartest people (they probably didn't), the best hardware and software (ditto) and you're still gonna get punched in the junk.
http://recode.net/2014/12/03/sony-to-officially-name-north-k...
Sony Pictures will officially name North Korea as the source of a hacking attack that has exposed sensitive files and brought down its corporate network last week, two sources close to the investigation tell Re/code. An announcement could come as soon as today.
Details of what Sony and the security firm Mandiant will announce are still being finalized. But the sources confirm that North Korea will be named as the source of the attack.
A Sony spokeswoman declined to comment on the timing or the news, but said “The investigation continues into this very sophisticated cyber attack.”
None of the "leaked" data is that interesting. Some executive pay info is in SEC filings. Talent pay is usually known in Hollywood. Leaking the script of Annie? That's a remake; we know how it comes out.
The real question is, what did the attackers change? Did they add some phony businesses to accounts payable, or initiate financial transactions?
There's a lot to be said for making backups to write-once media.
Are they referring to "http://pastebin.com/" ? if so is it really "the unoffical cloud repository of hackers everywhere" ? Is it really used often by hackers?
I thought reddit and 4chan are the more popular places to dump illegally gained information.
I suspect this is just because it'a a highly-visible, non-sketchy domain name that provides free, scalable hosting of text that can be used anonymously without much effort.
All the "hackers" have to do is copy the date in a matter that does not cause obvious problems. For example, as you said, do it slowly, or do it at night when "nobody's" using the network anyway.
But yes, that's true—the investors would be mad at SCE. But would that, in turn, make them think of pulling aside SPE to give them the same talk? SPE isn't even doing anything involving running a public-facing web service; why would the investors presume they'd be at risk? It'd be like YCombinator calling in all their current batch of startups to give them a lesson on finances because one of them screwed up their bookkeeping.
If they "screw up" was criminally negligent and had a cost of the order of $100s of millions I could certainly see YC doing that, couldn't you?
PSN computers hosted leak torrent, so PSN was also hacked
We created a security environment that prioritizes surveillance over security, especially in creating a market for zero-day exploits. That's a market that might exist without the US as a buyer, but the size and value of that market is dominated by US spending.
We would not tolerate the development and auctioning of weaponized disease microbes. But we funded a similar market that threatens our technology infrastructure.
Sony -- Script to Screen: http://youtu.be/4P4Wl1Ogg_g
Sony is a very large conglomerate: while it would be incorrect to say that, say, Sony Computer Entertainment (the subsidiary that runs Sony's video games operations) got hacked, Sony Pictures Entertainment is a wholly-owned subsidiary of Sony Entertainment, Inc., which is itself a wholly-owned subsidiary of Sony Corporation.[1] It's as much "Sony" as any of its other subsidiaries.
[1]: http://www.sonypictures.com/corp/aboutsonypictures.html
http://www.theregister.co.uk/2014/12/03/strange_things_afoot...
in the article it says "and the computer that did the compiling was set up to display its text in Korean characters."
i have a problem digesting this, because as per my experience, the compiler doesn't leave a trace the native host's display language or does it?
what do you people have to say about it?
What's the point in such a statement?
In-group signalling.
This is how we get artificially low market rates for developers and ridiculous amounts of money paid to incompetent execs.
edit: the downvotes are an indication that you deserve your bullshit laws/status quo
From the article, a few sentences in.