3 ms·

I've said this before and I'll say it again: Sony is facing a highly skilled group of hackers that have made it their mission to ruin the company. If you have s

I've said this before and I'll say it again: Sony is facing a highly skilled group of hackers that have made it their mission to ruin the company. If you have sensitive data with any of Sonys products, I'd advise you to delete it ASAP. This is not going away. Sony will be fighting attacks like this for years to come and they have only themselves to blame.

n09n 15y ago
That may or may not be true, but this particular attack shows no evidence of skill, and they admit as much in the original link.
forensic 15y ago
It's not about skill, it's about motivation. Cracking big company stuff is more about persistence than about skill. Skilled hackers are bored by SQL injection attacks. What Sony has done is give thousands of bored teenagers a reason to hate them.
bigiain 15y ago
I don't know that deleting it will do much good. Most web apps for performance reasons don't actually do a delete against the database, rather mark a record as deleted and perhaps run a batch job later to clean deleted records from the database. If you've got access to the database via SQL injection, you'll have access to all those "deleted" records as well. Even of you go through the website and update each field with empty, anonyomoua, or incorrect data; I suspect there's a high chance of backups being available to anyone who's 0wned their servers... My advice would be to assume any data Sony has about you is already in the hands of attackers, and do whatever you can to minimize the usefulness of that to the attackers (which largely means ensure the password you used at any Sony site isn't useable anywhere else online)
- VMG 15y ago
  Remember, these people make websites vulnerable to SQL injections in the year 2011. They might not have the best backup strategies.
  - bigiain 15y ago
    Heh - yeah maybe... I was imagining a shared hosting cpanel account with a bunch of dated backup.tgz files sitting in the home directory which only ever get removed when the webhost complains about disk space usage...
- natural219 15y ago
  Alternatively, you could SQL inject their databases yourself and personally delete your information.
  - mcantor 15y ago
    Anything less would not qualify as due diligence!
shii 15y ago
lolwut, SQLi is sophisticated and takes mad skills now? The methods employed are very low-brow to be charitable, brah. To be completely honest, I don't think Lulzsec is the first to discover this at all. They're just being loud about it all. For a sophisticated popular hack recently, look at the work by zerofor0wned or the Stuxnet worm (not classifying the two in the same category of course).

n09n 15y ago

That may or may not be true, but this particular attack shows no evidence of skill, and they admit as much in the original link.

forensic 15y ago

It's not about skill, it's about motivation. Cracking big company stuff is more about persistence than about skill. Skilled hackers are bored by SQL injection attacks. What Sony has done is give thousands of bored teenagers a reason to hate them.

bigiain 15y ago

I don't know that deleting it will do much good. Most web apps for performance reasons don't actually do a delete against the database, rather mark a record as deleted and perhaps run a batch job later to clean deleted records from the database. If you've got access to the database via SQL injection, you'll have access to all those "deleted" records as well. Even of you go through the website and update each field with empty, anonyomoua, or incorrect data; I suspect there's a high chance of backups being available to anyone who's 0wned their servers... My advice would be to assume any data Sony has about you is already in the hands of attackers, and do whatever you can to minimize the usefulness of that to the attackers (which largely means ensure the password you used at any Sony site isn't useable anywhere else online)

VMG 15y ago
Remember, these people make websites vulnerable to SQL injections in the year 2011. They might not have the best backup strategies.
- bigiain 15y ago
  Heh - yeah maybe... I was imagining a shared hosting cpanel account with a bunch of dated backup.tgz files sitting in the home directory which only ever get removed when the webhost complains about disk space usage...
natural219 15y ago
Alternatively, you could SQL inject their databases yourself and personally delete your information.
- mcantor 15y ago
  Anything less would not qualify as due diligence!

shii 15y ago

lolwut, SQLi is sophisticated and takes mad skills now? The methods employed are very low-brow to be charitable, brah. To be completely honest, I don't think Lulzsec is the first to discover this at all. They're just being loud about it all. For a sophisticated popular hack recently, look at the work by zerofor0wned or the Stuxnet worm (not classifying the two in the same category of course).