11 ms·
SonyPictures.com hacked, personal information and passwords compromised
- ary 15y agoAt first it was embarrassing, now it's just absurd.
- kevindication 15y agoDisagree on absurdity. I'm certain that if you focused enough eyes on any company with as much surface area exposed to the internet you'd poke just as many holes.
- MediaBehavior 15y ago>...as many holes. But would you find most storing passwords in plain text? in 2011?
- kevindication 15y agoI had to stop a previous employer from doing just that in 2003. It was bad practice then, too. Big companies are just more susceptible to these kinds of short-cuts. Especially shortcuts with no clear benefit except to a lazy programmer. I remain pessimistic.
- rosser 15y agoFailing to encrypt user passwords isn't a short-cut; it's an inexcusable and egregious failure — especially when it's done by a company that has the resources to do it right in the first place.
- ary 15y agoGiven how much bad publicity and legal exposure costs a corporation of Sony's size I'd say that getting their affairs in order across the board should have been a bigger priority. As it is wildly unreasonable not to have taken a good hard look at every piece of infrastructure after the fist major breach I'd say absurd describes this situation pretty well.
- spydum 15y agoEven if they had hired all of the top ranked security firms the first day PSN was hacked, they would still be open to attacks like this. The amount of public properties Sony hosts internationally is huge -- it would take a long time securing it all.
- raganwald 15y agoWhat's worse is that every bit of data we took wasn't encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it's just a matter of taking it. This is disgraceful and insecure: they were asking for it. I'm not sure that is true for any company with as much surface area. I would be extremely disappointed if it were true of any of Canada's five major banks, for example. Google has been under continuous hacking attack from China and so far they haven't had to 'fess up to storing passwords in plaintext.
- kevindication 15y ago"Any" is probably an exaggeration. I'd cede that and accept "most." We can hope that Google is an exception because of the caliber of employee they hire, since obviously they also have a lot of domain knowledge. But, I think that only means we're quibbling about the embarrassment level of these breaches.
- raganwald 15y agoSorry for the delay... Parenting! Any ways, I agree we shouldn't quibble about any/most. I also agree that a big surface area (such as units with independent web strategies all over the world) increases the likelihood of there being some breach of security. What I find embarrassing here is that we aren't talking about one of the Sony properties having a breach, it's lots and lots of them. I suggest that this is symptomatic of a problem with Sony itself, not just the surface area they present. What I'd expect from a well-managed company with a big surface area is yes, some property might have a breach, but that would be the exception. It's beginning to look like Sony's lax security with respect to customer information is the rule and not the exception. JM2C, I am not claiming I know this for a fact.
- kevindication 15y agoUnderstand regarding parenting. I do that myself. :-) I do see your point about Sony, and they may in fact be an outlier here. I think I've been accustomed to the story of customer information breaches from large corporations though, and so maybe I'm overly pessimistic?
- bh42222 15y agoSonyPictures.com was owned by a very simple SQL injection... From a single injection, we accessed EVERYTHING ... every bit of data we took wasn't encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext... I have to disagree. Lots of big companies are not great at security, but this is just horrible!
- sp332 15y agoSony didn't even have a CISO before they shut PSN down.
- alanh 15y agoI think it gets more embarrassing each time an announcement is made, actually.
- beaumartinez 15y agoAnd yet, all the media coverage and discussion further encourages this kind of behaviour. When was the last time a website break-in wasn't news?
- ary 15y agoI'm talking about how it keeps happening to Sony.
- shii 15y ago11 times in the last 2 months or so. 11, very high-profile cases with tons of customers' and employees' details. And always the same trivial things; SQLi, no encryption/plaintext databases, lack of first-line security like firewalls, etc.
- smackfu 15y agoThe question is whether Sony is really an outlier in terms of security, or if most big corps are getting by with security by obscurity (or no one cares about hacking them).
- illumin8 15y agoMost big corps are probably just as bad. I work for a bigcorp, and our security ranges from barely competent to completely ridiculous.
- code_duck 15y agoThey're probably getting away with the appearance of security: if the crackers didn't publicize this, and Sony didn't, we would ever know. So how many companies who store personal information are being compromised these days? I have a feeling that Sony is not unusual in their level of insecurity.
- r00fus 15y agoWhat's embarrassing is the complete lack of even basic security policy.
- nborgo 15y agoFor those put off by the first 40 lines, here's the good part: "SonyPictures.com was owned by a very simple SQL injection, one of the most primitive and common vulnerabilities, as we should all know by now. From a single injection, we accessed EVERYTHING. Why do you put such faith in a company that allows itself to become open to these simple attacks? "What's worse is that every bit of data we took wasn't encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it's just a matter of taking it. This is disgraceful and insecure: they were asking for it.
- dholowiski 15y agoYikes - I believe in the PSN hack there was some question as to whether the passwords were encrypted or not. I'm glad it's out in the open for this one. Think we'll see Sony changing their name any time soon?
- electromagnetic 15y ago> Think we'll see Sony changing their name any time soon? Doubtful, 90% of people won't remember this in a year, just like barely anyone remembers about the BP oil spill or the Toyota brake incident. Sony might drop their name from some of their tech enterprises. The next playstation will probably just be Playstation rather than Sony, but that's likely the biggest. Considering that Sony Bravia's are often sold as just 'Bravia', I don't see it as a huge change.
- CaptainZapp 15y agoI'm not so sure. A lot of people still remember the fact that Sony smuggled a malware payload on to Audio CD's and that was in 2005 (http://en.wikipedia.org/wiki/Sony_rootkit http://en.wikipedia.org/wiki/Sony_rootkit). I for one make it my business to remember people and to point what an evil company with a totally twisted mindset Sony actually is. Add to that their mindboggling technical ineptitude, which is so bad that I'm sure this will be remembered in a year's time. (I'm aware that technically Sony BMG was behind the rootkit scandal. But hey: there's the SONY brand name very clearly to see, here)
- shii 15y agoThis is the #sownage promised by Lulzsec a couple of days ago during the PBS fiasco a couple of days ago[1] by the same group. Sony is getting owned on all fronts several times a week for the last month or so. [1]: http://apps.ycombinator.com/item?id=2598798 http://apps.ycombinator.com/item?id=2598798
- clistctrl 15y agoIs there a particular reason people are focused on revenging Sony?
- henrikschroder 15y agohttp://en.wikipedia.org/wiki/Sony_Computer_Entertainment_America_v._George_Hotz http://en.wikipedia.org/wiki/Sony_Computer_Entertainment_Ame...
- mtw 15y agoso why isn't there anything done against Apple? Apple's lawyers are on the back of anyone who makes white iPhone cases, jailbreakers, etc.
- abronte 15y agoApple has gone after jailbreakers? Thats news to me. Geohot has hacked (as far as I know) almost every iDevice Apple has put out, but Apple didn't take him to court because of it.
- mtw 15y agoI didn't say that Apple took them to court. http://www.wired.com/threatlevel/2009/07/jailbreak/ http://www.wired.com/threatlevel/2009/07/jailbreak/ I am just saying that Apple is using every means available to them to prevent other people using their software or hardware in a different way.
- bigiain 15y agoDo you really think that's true? My impression is more like they're doing just enough to convince groups like the RIAA and MPAA that they're "followinusingusty best practice" until such a time that they are in a powerful enough position to admit "actually, we don't care much about your DRM and your failing business model, it's upsetting our users so it's gone." like they did with the DRM on iTunes music. Maybe Jobs's Pixar relationship will make Apple's movie industry support stronger than their music industry support turned out to be, but long term who knows?
- sucuri2 15y agoAll the info here: http://lulzsecurity.com/releases/ http://lulzsecurity.com/releases/
- jrockway 15y agoDear megacorps: don't make the Internets mad.
- dholowiski 15y agoMore specifically, don't make Anonymous mad.
- Joakim 15y agoIt is just sad that all these hackers think they're doing everybody a favor by attacking "evil corporations" like Sony. But while they may be right in exposing Sony's lousy security, meanwhile they hurt one million people by releasing their information out into the public in a way that can never be taken back. Unless you think hurting one company you deem bad outweighs hurting a million innocent private citizens, then your priorities are a bit messed up.
- citricsquid 15y agoAlso they're ignoring the employees of Sony they're hurting too. If Sony loses money, it's not the management who get hurt, it's the low level employees. It's such a shame we now parade these people as heros, when a few years ago they would have been berated for not disclosing this information properly.
- tsuraan 15y agoEvery Sony customer is an inadvertent supporter of Sony's abuses, and most of them don't care about Sony's morality, they just love the products. If hackers make being a Sony customer unpleasant, then they may be able to hurt Sony's bottom line. It seems far more likely to work than an online petition or boycott...
- Pooter 15y agoYeah! Who gives a fuck about people and how this affects them! The important part is the ongoing battle against Sony for the atrocities they commit. Each and every person who suffers as the result of these kinds of attacks has whatever happens to them coming for not being part of The Cause. They must pay!
- Wickk 15y ago>If hackers make being a Sony customer unpleasant Unpleasant is the word your choosing to use? Having my credit card information that links to my bank account, and the only bank account I have, and then having that fucked with is more than unpleasant. I'm thankful when the PSN network was compromised I wasn't one of those people with the claims of large sums of money being circulated out of the bank. ( Yes I know, could easily be coincidental evidence. Not the point. ) By all means the cause is more than plausible with Sony's abysmal track record. The methods are absurd and obnoxious, but by all means keep hiding behind this tired old excuse that the end result is to hurt Sony. The people you're trying to help will have no sympathy when you're caught and sentenced.
- brad22 15y agook i will make sure that my next startup will store encrypted passwords and no even use sql. can you stop posting this hacking bullshit to this site ? a boring sql injection is not what i want to see on the frontpage of hacker news. the word hacker means something different here. create a new site and post that link here. thats good. copy pasting from your twitter feed is just fucking dumb.
- citricsquid 15y agohttp://twitter.com/#!/LulzSec/status/76388576832651265 http://twitter.com/#!/LulzSec/status/76388576832651265 Stay classy
- DrCatbox 15y agoAnother imaginary currency. Very bad. Bitcoin is just another imaginary currency. But now its technofreaks imagining it, what a difference. A real adventure into economics and currencies would be to strive for a society with no currency, where people do things for the lulz. Not for the coins man.
- evo_9 15y agoMan are you a spook? I don't get this anti-Bitcoin thing at all. I'm not for or against it, it's interesting tech for sure - fascinating even - and obviously polarizing to some. But I just don't get this attitude at all, at least amongst HN'ers.
- duairc 15y agoFor what it's worth, I completely agree with you. This site is depressingly full of capitalist apologists.
- ronnoch 15y agoWell, that's certainly the last thing Bitcoin needed right now.
- 9999 15y agoI know someone that briefly worked for a third party company that Sony had outsourced a fairly large project to (building some social networking features into the web based side of PSN). I found it really surprising at the time that Sony had outsourced that sort of thing, but I'm getting the feeling now that it must have been a fairly common practice. Given the wildly different business sectors that Sony is involved in, it's really not so surprising that their security varies considerably amongst them. Somehow I doubt lulzsec would be anywhere nearly as successful if they were attempting to steal semiconductor manufacturing information from the Japanese offices. Although that might just make it all the more insulting to Sony's customers who just had all of their personal information stolen.
- wbhart 15y agoThe thing that struck me first about this was the fact that it is in impeccable English, yet written as a kid would write. Something smells funny about that. What is to stop a competitor of Sony from trying to take them down under the guise of disenfranchised youth.
- praeclarum 15y agoFunny, I didn't notice until you mentioned that. It is nicely written, and apostrophe use seems all right. :-) Not sure if I buy the "as a kid would write" bit, but it is surprising to see this. Maybe the hacker just took 10 mins and proofread his own text?
- JackWebbHeller 15y agoOr maybe we shouldn't stereotype, and assume these people - like you and I - can use proper grammar without even having to spend 10 minutes proofreading?
- praeclarum 15y agoSpeak for yourself, I have to proofread and edit everything I write! :-)
- lallysingh 15y ago.. how about that it was written by an intelligent adult, intentionally using a childish voice for dramatic effect? Cracking often has a playful tone to it.
- niels_olson 15y agoGiven the concurrent China stories, I wonder how many of these independent releases are just uncovering things that China farms like rice, and checks on them like they're rss feeds.
- marcamillion 15y agoSeems Sony really has kicked up the swarm with that GeoHot clamp down. I am fairly certain that there are some executive meetings that are seriously questioning whether or not that initial action was wise. I never thought this type of extortion could work, but Hot Damn. This is an effective campaign. Talk about relentless! Edit: This is really a losing battle for Sony. They are too big, there are too many vulnerabilities. They are too exposed. I know this sounds extreme, but are we witnessing the end of Sony as we know it ? It sounds ridiculous on the surface, but think about the distraction this has become. The billions of dollars of civil liabilities they are now open to, and this is not stopping any time soon. Talk about the perfect storm created by one anonymous group. Kinda insane, but also feels kinda cool....in a weird way. There is something liberating about a small group of 'anonymous' hackers taking on a Goliath of a corporation and winning. And I am a Capitalist to the core. Although, the likely, annoying outcome of this is that this strengthens the hand of those that want a 'censored' Internet to prevent these types of things from happening. So this could very well lead to the end of the internet as we know it today. Also very hyperbolic, I know....but I believe it to be true.
- spydum 15y agoI didn't see anything being attributed to anonymous here.. just some hackers looking to hop on the bandwagon, stumbling across a very simple vulnerability in one of the many Sony properties.
- rbanffy 15y agoBut I am quite sure Sony's board knows very well what event started all this.
- r00fus 15y agoThis is the 3rd or 4th such attack. Even if they're completely clueless: "Once is happenstance. Twice is coincidence. The third time it's enemy action."
- shii 15y ago11th actually. This article[1] documents the last 10 times up with today making it 11. Starts from the first DDoS by Anonymous on Apr 4. [1]: http://blogs.forbes.com/andygreenberg/2011/05/24/sony-goes-silent-as-its-hacking-spree-snowballs/ http://blogs.forbes.com/andygreenberg/2011/05/24/sony-goes-s...
- kefs 15y agoIt's worth noting that this is the same group that gained access to the complete Fox.com X-Factor contestant database last month. http://news.ycombinator.com/item?id=2525865 http://news.ycombinator.com/item?id=2525865 http://thepiratebay.org/user/LulzSec http://thepiratebay.org/user/LulzSec
- rbanffy 15y agoI have seen lots of web work for Sony-sized companies being awarded to design-heavy advertising agencies with incompetent backend developers when such work should be undertaken by people skilled in making the plumbing of public-facing, secure and scalable websites. This is the kind of mistake only a junior makes that should never pass the most complacent code-review process. Like an old friend of mine used to say, "you pay peanuts, you buy monkeys"
- Periodic 15y agoI've actually been one of those developers working on a site for a major corporation who outsourced the development and design to an advertising agency. I wouldn't be surprised if there were a few holes in our site, despite the external security audit. The main issue is that the advertising agency handled the development very poorly. Expectations and specifications were not well defined, budgets were not set appropriately, and project management was largely absent. This leads to my fellow developer and I, who were brought in because the agency lacked developer talent, having to scramble to get all the features in before the deadline. I would blame some of this on lack of technical project management as well, not just on the coders.
- rbanffy 15y agoI have to agree with you: the result cannot be blamed on the programmers alone. What I saw was a cultural mismatch, all the way from the control of the requirements to the selection of personnel. Making an ad is not the same as making a web application, the attributes of a good writer or artists are not what define a good programmer. I have successfully introduced a measure of sanity in two agencies I worked for, with great results (I really love making people's lives better), but that's not the whole market. Yet, I can understand a bit of this mindset. Far too many websites are to be discarded by the end of the campaign. When so many products are supposed to last a month or so, people often forget about how sausages should be made.
- cjboco 15y agoCompanies like Sony make claims that their Intellectual Property is worth X amount in court and go after individuals for huge amounts of money. I think you could argue that people's Personal Information is worth at least X + Y more. If someone takes them to court and a huge, ridiculous, judgement is handed out, then maybe these companies will think twice about securing their customers data. Seriously, unencrypted password fields? A SQL injection? Of course, I'm just dreaming.
- daimyoyo 15y agoI've said this before and I'll say it again: Sony is facing a highly skilled group of hackers that have made it their mission to ruin the company. If you have sensitive data with any of Sonys products, I'd advise you to delete it ASAP. This is not going away. Sony will be fighting attacks like this for years to come and they have only themselves to blame.
- n09n 15y agoThat may or may not be true, but this particular attack shows no evidence of skill, and they admit as much in the original link.
- forensic 15y agoIt's not about skill, it's about motivation. Cracking big company stuff is more about persistence than about skill. Skilled hackers are bored by SQL injection attacks. What Sony has done is give thousands of bored teenagers a reason to hate them.
- bigiain 15y agoI don't know that deleting it will do much good. Most web apps for performance reasons don't actually do a delete against the database, rather mark a record as deleted and perhaps run a batch job later to clean deleted records from the database. If you've got access to the database via SQL injection, you'll have access to all those "deleted" records as well. Even of you go through the website and update each field with empty, anonyomoua, or incorrect data; I suspect there's a high chance of backups being available to anyone who's 0wned their servers... My advice would be to assume any data Sony has about you is already in the hands of attackers, and do whatever you can to minimize the usefulness of that to the attackers (which largely means ensure the password you used at any Sony site isn't useable anywhere else online)
- VMG 15y agoRemember, these people make websites vulnerable to SQL injections in the year 2011. They might not have the best backup strategies.
- kaffiene 15y agoObviously I don't think the same way as the rest of HN, but I think these hackers are a bunch of cunts. They fuck up the services for all the paying customers and all for what? Geohot? FFS - he took the money that people gave him to fight Sony and then SETTLED. It's not like he's some paragon of virtue. I happen to think that Sony were wrong to withdraw Linux access to PS3 and wrong to sue GeoHot, but this vigilante justice is just fucked up and I'm bemused by the number of HN posters who think this kind of vandalism is justified.
- jerryr 15y agoHey, I'm curious whether my information was compromised in this attack, but I'm too lazy to figure out how to figure out whether it was. If someone has downloaded the released data and is looking for a weekend project (and the weekend's coming up), I'd love a site that lets me easily determine whether I'm affected.
- InclinedPlane 15y agoThis series of hackings is everything that's wrong with the software industry in a microcosm. Sony is a multi-billion dollar international company, and yet they can't even hire competent enough software and security professionals to ensure that their public facing websites holding personal data for millions of people don't have noob level security vulnerabilities. Software is still more alchemy than chemistry today. There are no objective measures or well-trusted authorities which can be used to ensure that any given developer or any given piece of software meets a certain degree of competence or quality. Only the subjective judgment of fellow alchemists can reliably gauge the quality of another alchemist, and then often only with a rather lot of effort. The most fundamental consequence of this is that no organization can easily produce high quality software merely by throwing enough money at it. This is a competitive advantage for small high-talent shops but it has some rather negative consequences for the rest of the world.
- gcb 15y agocount down until someone adapts the bitcoin-blocker extension to also block blatantly obvious sony network security breaches that popup every hour on the front page... 3. 2. 1
- hitechsites 15y agoWhile this is incredibly embarrassing for Sony, as it exposes gross incompetence, can someone explain why the FBI/law enforcement is not able to shutdown the hackers by filing criminal charges against the owners/operators of lulzsecurity.com, since they are openly admitting that they are behind all of the attacks.
- scrrr 15y agoWhat is the benefit of publishing all the stolen data now? I guess it's proof for a successful attack, but it doesn't have any other benefit now, does it?
- oliciv 15y agoIt makes the people who have data included in the leak care that bit more, and makes hit hit that bit closer to home?
- deleted 15y ago[deleted]