6 ms·

Sony Music Brazil hacked

141 points by sucuri2 15y ago

deleted 15y ago
[deleted]
yhlasx 15y ago
The first case was kinda shocking for me, because, afterall it was Sony who got hacked. Now, it seems just normal. It was a very bad 30 days for them.
Kwpolska 15y ago
It's the 8th time Sony was hacked this year, right?
- jbk 15y ago
  No, we are 12 now. http://attrition.org/security/rants/sony_aka_sownage.html http://attrition.org/security/rants/sony_aka_sownage.html
  - tomelders 15y ago
    13?
    - jbk 15y ago
      No, because this defacing was done last year, and is still on-going, if I understand correctly.
  - systemizer 15y ago
    12 hacks in 46 days. That's a rate of 1 hack every 3.83 days. And that means we can expect to see it get hacked again by Thursday this week. Everyone keep your eyes peeled!
    - shii 15y ago
      Do you really think every time Sony is penetrated, it's announced and everything is dumped like Lulzsec and other loud mouths do? The much more likely thing is that these vulnerabilities were known for quite awhile before.
  - ballard 15y ago
    Is quite amazing how repeated failure impacts the stock by only about $4/share or roughly 13%. I guess as long as consumers keep buying...
    - jbk 15y ago
      It just proves that their customers don't care about anything as long as they can play...
    - afterburner 15y ago
      I don't know, 13% seems significant for a company like Sony.
sucuri2 15y ago
If they have a security team (which I hope they do), I feel bad for them (considering the last few weeks). Probably were under staffed and ignored for a long time and now are under a terrible pressure.
- jamaicahest 15y ago
  And they will probably be lucky not to be fired, instead of getting what they should, which is getting more funding. Of course this is assuming that your guess is correct.
  - mikle 15y ago
    I don't know why we are so sympathetic towards them - either they are just bad at security or understaffed and thus just can't maintain everything. Both options are about as probable.
  - systemizer 15y ago
    It's not more funding they need; it's people that actually know what they're doing. Let's face it: all systems are hackable in some way, but it is the security's job to make those hacks have minimal effects. This skill requires people who actual know the general security principles that are taught at most technical institutes today.
    - SoftwareMaven 15y ago
      You can't possible make that judgement from outside. If their security team consisted of two people, the surface area was just too large. In that situation, id be worried about protecting trade secrets and intellectual property and to hell with the web sites. If it consisted of 20 people, I would agree with you: they would still be hackable, but the embarrassing simplicity of the hacks should have been covered. Without knowing details of the team, it is just an unsubstantiated guess and/or heaping crap on Sony (who, as a company, i can't stand).
      - 15y ago
dudurocha 15y ago
All of this started with the geohot affair?
- rkalla 15y ago
  More or less. 1. Sony removes "Install Other Operating Systems" option from the PS3 OS. 2. Out of frustration at corporate policy for REMOVING major features from hardware/device paid for and owned by millions, the hackers start working. 3. Months later, GeoHot releases (what I understand to be) the root private encryption keys for the device. 3.5 (forgot this) fail0verflow group circumvents the PS3's security system using this work from GeoHot - http://www.youtube.com/watch?v=4loZGYqaZ7I http://www.youtube.com/watch?v=4loZGYqaZ7I 4. Other hacking groups, now with the keys to the kingdom, begin working on hacking the PS3 to allow the installation of any software, not just officially released/signed/blessed releases. This results in a "jailbreak" for the PS3, much like what jailbreaking does to the lock-down security on an iPhone. (This is when things start to go south) 5. A technique for loading your own software onto the PS3, circumventing the system's security checks comes out. (Now the door to pirating PS3 games is open. Download images, burn the Blu-rays, pop them in the PS3 and play). 6. Another hacking group, using some portion of this manipulation, actually manage to get their PS3's logged into the private developer-based PSN network (it's a full copy of the real PSN network specifically for developers actively working on titles that need to test things like updates or addon downloads/installs). 7. It is discovered that the PSN-Dev network does not do real credit card authentication before items are purchased and downloaded. So for example, if I work at BioWare, and I'm on PSN-Dev, I can technically download any of the standalone games from the network and play them by entering a credit card of "111" or something silly - http://www.reddit.com/r/gaming/comments/gx6o4/im_a_moderator_over_at_psxscenecom_the_real/ http://www.reddit.com/r/gaming/comments/gx6o4/im_a_moderator... 8. The hacking group is able to pull software off the network, for free, and leak it to the web. 9. Some point very shortly after this, the real PSN gets the full intrusion. I forget if the two are related or not... I don't recall if the group went PSN-Dev > PSN and that is how they got in, or if there was another group that did the straight PSN hack. That is the gist of the avalanche that started with "We are removing Other-OS install support". Different groups piggy-backing on each other's work to retaliate. The endless backlash against Sony seems to have been the result of them going after GeoHot.Then at some point it stopped being about retribution for him and just became the popular thing to do. It is sort of getting old, so unless Sony does something to re-ignite the flames, I imagine the groups will move on in a month or two. [Links] fail0verflow's presentation on how they circumvented the PS3's security (really cool presentation): http://www.youtube.com/watch?v=4loZGYqaZ7I http://www.youtube.com/watch?v=4loZGYqaZ7I Post supposedly from one of the internal Sony folk during the total media black-out when the network first went down explaining the console-Dev-PSN-network issue: http://www.reddit.com/r/gaming/comments/gx6o4/im_a_moderator_over_at_psxscenecom_the_real/ http://www.reddit.com/r/gaming/comments/gx6o4/im_a_moderator...
rkalla 15y ago
At this point I'm curious if this is the result of any large company becoming the whipping boy of multiple hacking groups, or if this is just unique to Sony. For example, if Microsoft were focused on next... or Ford or GE or IBM, would the same endless embarrassment ensue? When Sony originally got hacked, I commented like everyone else: Sony is incompetent, their security team is subpar, etc, but after the 12th hack... is this just how shoddy most systems are and they just have the spotlight on them at the moment? I believe back on the announcement thread of the latest hack here on HN, there was an entire sub-thread about "Is this the norm at big companies?" and the consensus was "yes". Someone mentioned security was between "horribly broken" and "totally laughable". Of course that's always juicy to read, but I wonder how true it is. If this endless list of penetration is any sort of barometer, it looks to be true. I'll be curious what the global fallout of this is. I would hate to be the next company that does something socially unacceptable that gets the baton passed to them from Sony.
- jimbobimbo 15y ago
  "if this is just unique to Sony"..."Sony is incompetent" More likely, Sony simply outsorces their web properties to some outside teams, which do not have proper expertise in building secure websites. This theory is especially make sense if you look at what properties were hacked - they're mostly local-market websites. So, I'd say, the only one hacked property Sony must really be embarrased for is PSN, hands down.
  - brandall10 15y ago
    I worked with a guy about 7-8 years ago who went onto to manage an Indian outsourced team for the SonyStyle web store. He was terribly frustrated with the situation and the quality of the engineering staff. Stopped having lunch with him as every time it seemed to devolve into a rant session. Note that he was Indian born/educated himself. It was sad as we collaborated closely on a project for over a year and he was one of the sharpest, happiest, most positive engineers I ever worked with.
- jvandenbroeck 15y ago
  They definatly don't take security seriously at Sony, if you get hacked with a sql injection - you suck. When I was creating PHP websites as a 12 year old kid, they where even protected against sql-injections -- and it's not that i was a super smart or paranoid kid I don't think that if anonymous would target Microsoft (or a normal company) that it would be the same.
themal 15y ago
This is the first time that I have looked at any of these 'Sony' hacks. I had a quick look at their website, and the credits at the bottom clearly say that it was designed, developed and run by two third parties - yet they aren't mentioned in the headline.
jasonlotito 15y ago
Okay, this is sad. Not that Sony got hacked again, but that I'm putting Sony getting hacked and Yet-Another-Groupon-Article into the same basket: do we really need to post this. I mean, at this point, I'll assume Sony is constantly being backed. Come back in 100 days and post a 100-days since Sony was hacked. That would probably be more informative. As for Groupon: everyone has a weasel-filled opinion. And I thought /. was plagued by duping stories.
- nuromancer 15y ago
  Im surprised there is no discussion about the images/message of the hacked homepage.
jjm 15y ago
Obscure hack that was hard to defend against (DNS or OS vuln) I'd feel sad about. Not encrypting customer data and transport, plain text passwords, etc.. doesn't make me feel sad, at all.
johndbritton 15y ago
Link to the hacked page: http://www.sonymusic.com.br/index.asp http://www.sonymusic.com.br/index.asp
plainOldText 15y ago
I guess this serves as a proof that some large corporations don't take security seriously enough. And we're supposed to trust them with our data. I think we should have a "Hall of Shame" for all this companies that fail from a security perspective.
paulnelligan 15y ago
Despite the noble 'Little guy fights back' story. I'm starting to wonder if this will have an overall detrimental effect?, Give wings to Sarkozy's desire to police and control the internet, and overall limit consumer and business confidence in web security?

141 points by sucuri2 15y ago

deleted 15y ago

[deleted]

The first case was kinda shocking for me, because, afterall it was Sony who got hacked. Now, it seems just normal. It was a very bad 30 days for them.

Kwpolska 15y ago

It's the 8th time Sony was hacked this year, right?

jbk 15y ago
No, we are 12 now. http://attrition.org/security/rants/sony_aka_sownage.html http://attrition.org/security/rants/sony_aka_sownage.html
- tomelders 15y ago
  13?
  - jbk 15y ago
    No, because this defacing was done last year, and is still on-going, if I understand correctly.
- systemizer 15y ago
  12 hacks in 46 days. That's a rate of 1 hack every 3.83 days. And that means we can expect to see it get hacked again by Thursday this week. Everyone keep your eyes peeled!
  - shii 15y ago
    Do you really think every time Sony is penetrated, it's announced and everything is dumped like Lulzsec and other loud mouths do? The much more likely thing is that these vulnerabilities were known for quite awhile before.
- ballard 15y ago
  Is quite amazing how repeated failure impacts the stock by only about $4/share or roughly 13%. I guess as long as consumers keep buying...
  - jbk 15y ago
    It just proves that their customers don't care about anything as long as they can play...
  - afterburner 15y ago
    I don't know, 13% seems significant for a company like Sony.

sucuri2 15y ago

If they have a security team (which I hope they do), I feel bad for them (considering the last few weeks). Probably were under staffed and ignored for a long time and now are under a terrible pressure.

jamaicahest 15y ago
And they will probably be lucky not to be fired, instead of getting what they should, which is getting more funding. Of course this is assuming that your guess is correct.
- mikle 15y ago
  I don't know why we are so sympathetic towards them - either they are just bad at security or understaffed and thus just can't maintain everything. Both options are about as probable.
- systemizer 15y ago
  It's not more funding they need; it's people that actually know what they're doing. Let's face it: all systems are hackable in some way, but it is the security's job to make those hacks have minimal effects. This skill requires people who actual know the general security principles that are taught at most technical institutes today.
  - SoftwareMaven 15y ago
    You can't possible make that judgement from outside. If their security team consisted of two people, the surface area was just too large. In that situation, id be worried about protecting trade secrets and intellectual property and to hell with the web sites. If it consisted of 20 people, I would agree with you: they would still be hackable, but the embarrassing simplicity of the hacks should have been covered. Without knowing details of the team, it is just an unsubstantiated guess and/or heaping crap on Sony (who, as a company, i can't stand).
    - 15y ago

dudurocha 15y ago

All of this started with the geohot affair?

rkalla 15y ago
More or less. 1. Sony removes "Install Other Operating Systems" option from the PS3 OS. 2. Out of frustration at corporate policy for REMOVING major features from hardware/device paid for and owned by millions, the hackers start working. 3. Months later, GeoHot releases (what I understand to be) the root private encryption keys for the device. 3.5 (forgot this) fail0verflow group circumvents the PS3's security system using this work from GeoHot - http://www.youtube.com/watch?v=4loZGYqaZ7I http://www.youtube.com/watch?v=4loZGYqaZ7I 4. Other hacking groups, now with the keys to the kingdom, begin working on hacking the PS3 to allow the installation of any software, not just officially released/signed/blessed releases. This results in a "jailbreak" for the PS3, much like what jailbreaking does to the lock-down security on an iPhone. (This is when things start to go south) 5. A technique for loading your own software onto the PS3, circumventing the system's security checks comes out. (Now the door to pirating PS3 games is open. Download images, burn the Blu-rays, pop them in the PS3 and play). 6. Another hacking group, using some portion of this manipulation, actually manage to get their PS3's logged into the private developer-based PSN network (it's a full copy of the real PSN network specifically for developers actively working on titles that need to test things like updates or addon downloads/installs). 7. It is discovered that the PSN-Dev network does not do real credit card authentication before items are purchased and downloaded. So for example, if I work at BioWare, and I'm on PSN-Dev, I can technically download any of the standalone games from the network and play them by entering a credit card of "111" or something silly - http://www.reddit.com/r/gaming/comments/gx6o4/im_a_moderator_over_at_psxscenecom_the_real/ http://www.reddit.com/r/gaming/comments/gx6o4/im_a_moderator... 8. The hacking group is able to pull software off the network, for free, and leak it to the web. 9. Some point very shortly after this, the real PSN gets the full intrusion. I forget if the two are related or not... I don't recall if the group went PSN-Dev > PSN and that is how they got in, or if there was another group that did the straight PSN hack. That is the gist of the avalanche that started with "We are removing Other-OS install support". Different groups piggy-backing on each other's work to retaliate. The endless backlash against Sony seems to have been the result of them going after GeoHot.Then at some point it stopped being about retribution for him and just became the popular thing to do. It is sort of getting old, so unless Sony does something to re-ignite the flames, I imagine the groups will move on in a month or two. [Links] fail0verflow's presentation on how they circumvented the PS3's security (really cool presentation): http://www.youtube.com/watch?v=4loZGYqaZ7I http://www.youtube.com/watch?v=4loZGYqaZ7I Post supposedly from one of the internal Sony folk during the total media black-out when the network first went down explaining the console-Dev-PSN-network issue: http://www.reddit.com/r/gaming/comments/gx6o4/im_a_moderator_over_at_psxscenecom_the_real/ http://www.reddit.com/r/gaming/comments/gx6o4/im_a_moderator...

rkalla 15y ago

At this point I'm curious if this is the result of any large company becoming the whipping boy of multiple hacking groups, or if this is just unique to Sony. For example, if Microsoft were focused on next... or Ford or GE or IBM, would the same endless embarrassment ensue? When Sony originally got hacked, I commented like everyone else: Sony is incompetent, their security team is subpar, etc, but after the 12th hack... is this just how shoddy most systems are and they just have the spotlight on them at the moment? I believe back on the announcement thread of the latest hack here on HN, there was an entire sub-thread about "Is this the norm at big companies?" and the consensus was "yes". Someone mentioned security was between "horribly broken" and "totally laughable". Of course that's always juicy to read, but I wonder how true it is. If this endless list of penetration is any sort of barometer, it looks to be true. I'll be curious what the global fallout of this is. I would hate to be the next company that does something socially unacceptable that gets the baton passed to them from Sony.

jimbobimbo 15y ago
"if this is just unique to Sony"..."Sony is incompetent" More likely, Sony simply outsorces their web properties to some outside teams, which do not have proper expertise in building secure websites. This theory is especially make sense if you look at what properties were hacked - they're mostly local-market websites. So, I'd say, the only one hacked property Sony must really be embarrased for is PSN, hands down.
- brandall10 15y ago
  I worked with a guy about 7-8 years ago who went onto to manage an Indian outsourced team for the SonyStyle web store. He was terribly frustrated with the situation and the quality of the engineering staff. Stopped having lunch with him as every time it seemed to devolve into a rant session. Note that he was Indian born/educated himself. It was sad as we collaborated closely on a project for over a year and he was one of the sharpest, happiest, most positive engineers I ever worked with.
jvandenbroeck 15y ago
They definatly don't take security seriously at Sony, if you get hacked with a sql injection - you suck. When I was creating PHP websites as a 12 year old kid, they where even protected against sql-injections -- and it's not that i was a super smart or paranoid kid I don't think that if anonymous would target Microsoft (or a normal company) that it would be the same.

themal 15y ago

This is the first time that I have looked at any of these 'Sony' hacks. I had a quick look at their website, and the credits at the bottom clearly say that it was designed, developed and run by two third parties - yet they aren't mentioned in the headline.

jasonlotito 15y ago

Okay, this is sad. Not that Sony got hacked again, but that I'm putting Sony getting hacked and Yet-Another-Groupon-Article into the same basket: do we really need to post this. I mean, at this point, I'll assume Sony is constantly being backed. Come back in 100 days and post a 100-days since Sony was hacked. That would probably be more informative. As for Groupon: everyone has a weasel-filled opinion. And I thought /. was plagued by duping stories.

nuromancer 15y ago
Im surprised there is no discussion about the images/message of the hacked homepage.

jjm 15y ago

Obscure hack that was hard to defend against (DNS or OS vuln) I'd feel sad about. Not encrypting customer data and transport, plain text passwords, etc.. doesn't make me feel sad, at all.

johndbritton 15y ago

Link to the hacked page: http://www.sonymusic.com.br/index.asp http://www.sonymusic.com.br/index.asp

plainOldText 15y ago

I guess this serves as a proof that some large corporations don't take security seriously enough. And we're supposed to trust them with our data. I think we should have a "Hall of Shame" for all this companies that fail from a security perspective.

paulnelligan 15y ago

Despite the noble 'Little guy fights back' story. I'm starting to wonder if this will have an overall detrimental effect?, Give wings to Sarkozy's desire to police and control the internet, and overall limit consumer and business confidence in web security?