11 ms·

Sony Got Hacked Hard: What We Know and Don't Know So Far

237 points by SoftwareMaven 12y ago

Danieru 12y ago
"Or that the company spent half a million this year in severance costs to terminate employees?" That's not much. Is Wired trying to make me think that is a lot? Or are they trying to play it against the salary figures? Considering they spent valuable words in the first sentence to make it clear that the top brass is "mostly" white males I get the impression the comparison was supposed to mean something.
- legohead 12y ago
  From another article I saw [1] it appeared that there was half a million spent in severance for a single employee. Others were listed as well, in 100k range, and the article author left out the names of the employees. [1] http://fusion.net/story/30850/ http://fusion.net/story/30850/
- b3tta 12y ago
  IMO if an article starts with > Who knew that Sony’s top brass, a line-up of mostly white male executives, earn $1 million and more a year? I'm already putting my expectations for the rest of it on the same level as those for this famous one: > I don't care if you landed a spacecraft on a comet, your shirt is sexist and ostracizing. (http://www.theverge.com/2014/11/13/7213819/your-bowling-shirt-is-holding-back-progress http://www.theverge.com/2014/11/13/7213819/your-bowling-shir...) I wonder when it's time to start yelling "Oh no the overly politically correct youngsters, which are offended by everything are coming! Hide yo kids! Hide yo wife!"
  - GFK_of_xmaspast 12y ago
    Take it to stormfront.
- foldor 12y ago
  Actually the "mostly white males" comment struck me as an interesting side note. Sony is a Japanese company, so for it to be run by "mostly white males" is something that seems noteworthy in itself. Though I doubt that's what they were going for when they wrote that.
  - RaptorJ 12y ago
    Not Sony but Sony Pictures Entertainment which is an american subsidiary.
cheeze 12y ago
http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootki...
- dagw 12y ago
  Different Sony.
  - CamperBob2 12y ago
    Same name, same (lack of) good will.
nostromo 12y ago
The North Korean theory seems silly. In fact, it's exactly what I might say publicly if I were Sony and I wanted to try and turn lemons (being hacked) into lemonade (free buzz about an upcoming movie). The movie Kim Jong-un doesn't want you to see! In the end, I doubt there was any hacking involved at all: a disgruntled employee leaked documents. Perhaps Sony forgot to disable someone's password after giving them the axe.
- 001sky 12y ago
  The "state sponsored" line was about a form a data recovery sabotage used. Seems an insider would have a similar desire to hide tracks. Blame the "mysterious outside forces" is always the kneejerk tho.
- higherpurpose 12y ago
  If they did it on purpose it's even sillier. They may think that it would be cool to say they "got hacked by a state" especially if it's related to an upcoming movie about it, but to me it seems like amateur hour at Sony if they got hacked by North Korea, a country not exactly known for its advanced technology and high computer usage.
  - dagw 12y ago
    North Korea as a country might be behind the technological curve, but several reports indicate the the North Korean Army cyber warfare division is pretty well funded and advanced. There is a huge divide between the day to day realities of the average NK citizen and the realities of the upper echelons.
    - deciplex 12y ago
      Who makes up the cyber-warfare division? If I traveled in time back to 1850 with a billion dollars worth of gold bullion, I couldn't hire a single black hat with it. So a few kids of the party elite get to go to nice schools abroad - where are the rest coming from? Or does DPRK have a shit-hot education system in spite of literally other thing about the country being godawful and totally backwards? If so it's the first I've heard that.
Illniyar 12y ago
"Pastebin—the unofficial cloud repository of hackers everywhere" Are they referring to "http://pastebin.com/" http://pastebin.com/" ? if so is it really "the unoffical cloud repository of hackers everywhere" ? Is it really used often by hackers? I thought reddit and 4chan are the more popular places to dump illegally gained information.
- nostromo 12y ago
  Very common. https://www.google.com/search?q=pastebin.com%20email%20and%20password https://www.google.com/search?q=pastebin.com%20email%20and%2...
  - Illniyar 12y ago
    Don't they have some kind of policy to get rid of these things?
    - atmosx 12y ago
      Why should they????? Because someone doesn't like it? Seriously?!?!
    - rjaco31 12y ago
      Why would they?
- superuser2 12y ago
  Every password dump, claim of responsibility for a hack, etc. I have ever seen has been on pastebin. I suspect this is just because it'a a highly-visible, non-sketchy domain name that provides free, scalable hosting of text that can be used anonymously without much effort.
- hiou 12y ago
  Here's an interview with Jeroen Vader. I assume he still owns pastebin and may provide some insight into why it works well for that purpose. http://www.bbc.com/news/technology-17524822 http://www.bbc.com/news/technology-17524822
martin1975 12y ago
Smells like an inside job.
mintplant 12y ago
An article on The Hollywood Reporter has some more information on this, including perspectives from sources elsewhere within the industry: http://www.hollywoodreporter.com/news/sony-hack-studio-security-points-753509 http://www.hollywoodreporter.com/news/sony-hack-studio-secur... "It's changing our business," says one producer of its impact on Hollywood. "From now on, money and time will be allocated by studios to deal with this full-time." ...as it should have been already, given how big and how valuable a target these companies are.
- msantos 12y ago
  > "It's changing our business," says one producer of its impact on Hollywood. "From now on, money and time will be allocated by studios to deal with this full-time." Shame that most of Sony's Finance and HR are blaming the IT department - so bloody typical! "Everyone’s looking to the IT department to say, ‘How did you let this happen?'" said one employee in Sony Pictures’ finance department." http://fusion.net/story/31116/inside-sony-pictures-employees-are-panicking-about-their-hacked-personal-data/ http://fusion.net/story/31116/inside-sony-pictures-employees...
  - gadders 12y ago
    I work in an IT department. Pretty sure IT Security would be the responsibility of somebody here.
    - alecco 12y ago
      Yeah, who is routinely ignored by the rest because they are too busy with deadlines or something.
    - sarciszewski 12y ago
      I worked in an IT department for a communications company that worked with AT&T where, at least once a month, I would find a different way to suggest to a different team lead to check out EMET in case we ever got targeted. It got ignored. If they ever get hacked, I won't be surprised.
    - 12y ago
ck2 12y ago
Not knowing anything about it did not stop every damn "news" channel from saying "oh North Korea did it" then added at the end "but there is no proof". How can "news" call themselves news if all they do is speculate. Granted it wouldn't be entertaining if all they said was "Sony got hacked and we don't have any details" but that is why news is called news.
- cellis 12y ago
  Nope! News is simply "here's some words you might be interested in reading, and hopefully believing: ...words here...". Journalism is a dying art.
- logn 12y ago
  WSJ has some reasons to suspect North Korea: http://online.wsj.com/articles/more-signs-north-korea-may-be-behind-hacking-of-sony-pictures-1417467267 http://online.wsj.com/articles/more-signs-north-korea-may-be... But I think most of the media pretty much just reads the news, press releases, and their social media feeds to write their articles.
higherpurpose 12y ago
You'd think they would've learned a thing or two after they were made the hackers' pinata the last time around. Sony continues to come up as the poster-boy company for weak security.
- Narishma 12y ago
  That was a different Sony company that was hacked. I don't think they share much in common except the Sony name.
  - LLWM 12y ago
    It was twelve different Sony companies. It was clear that no part of Sony had any interest in information security.
    - tptacek 12y ago
      The only difference between Sony and any of a dozen different financial services companies is that Sony has better name recognition and so is a bigger target.
      - LLWM 12y ago
        Are you implying that's not an enormous difference?
chx 12y ago
So. Sony America suffered an outage on the Playstation Network due to a hack in 2011 causing 171 million in damages (that's the official figure, who knows how much the lost goodwill cost them ongoing). After that if they did not make cybersecurity priority number 1 then they deserve what they've gotten. Fool me once, shame on you; fool me twice, shame on me.
- derefr 12y ago
  Effectively, Sony Computer Entertainment and Sony Pictures Entertainment are about as related as Virgin Airlines and Virgin Mobile. Think of Sony (and any conglomerate in general) not as a parent company per se, but more like a VC firm or a majority-shareholder mutual fund; the executives of the Sony conglomerate don't really have any more insight into the component companies than those companies' other shareholders do. The only way business-process insight is going to be spread between the component companies is if the executives of one happen to read the trade press of the other.
  - chx 12y ago
    Eh, if I am a majority shareholder then I will read the riot act to the company I hold a majority in after they lose $171M on shitty security. Also, http://www.sony.com/SCA/who-we-are/our-businesses.shtml http://www.sony.com/SCA/who-we-are/our-businesses.shtml lists all these so there is some cohesion. AFAIK there's no such Virgin supercompany.
    - derefr 12y ago
      Richard Branson is Virgin's sole-proprietor supercompany. :) But yes, that's true—the investors would be mad at SCE. But would that, in turn, make them think of pulling aside SPE to give them the same talk? SPE isn't even doing anything involving running a public-facing web service; why would the investors presume they'd be at risk? It'd be like YCombinator calling in all their current batch of startups to give them a lesson on finances because one of them screwed up their bookkeeping.
      - 12y ago
elnate 12y ago
Is this a hack of a division of Sony? Because the executive names I found don't sound white. http://www.sony.net/SonyInfo/CorporateInfo/executive/ http://www.sony.net/SonyInfo/CorporateInfo/executive/
- davidw 12y ago
  > Now we all do, since about 40 gigabytes of sensitive company data from computers belonging to Sony Pictures Entertainment were stolen and posted online. From the article, a few sentences in.
- lkbm 12y ago
  It's Sony Pictures Entertainment, am American subsidiary: http://www.sonypictures.com/corp/management.html http://www.sonypictures.com/corp/management.html
yabatopia 12y ago
It's Sony Pictures Entertainment that got hacked, not Sony. They're completely separate companies, yet the media fails to recognize that. Very annoying and confusing, it's almost deliberately.
- chinpokomon 12y ago
  Gosh, someone should tell someone at Sony. They themselves draw no distinction. Sony -- Script to Screen: http://youtu.be/4P4Wl1Ogg_g http://youtu.be/4P4Wl1Ogg_g
- itafroma 12y ago
  > It's Sony Pictures Entertainment that got hacked, not Sony. They're completely separate companies, yet the media fails to recognize that. Sony is a very large conglomerate: while it would be incorrect to say that, say, Sony Computer Entertainment (the subsidiary that runs Sony's video games operations) got hacked, Sony Pictures Entertainment is a wholly-owned subsidiary of Sony Entertainment, Inc., which is itself a wholly-owned subsidiary of Sony Corporation.[1] It's as much "Sony" as any of its other subsidiaries. [1]: http://www.sonypictures.com/corp/aboutsonypictures.html http://www.sonypictures.com/corp/aboutsonypictures.html
- CamperBob2 12y ago
  BS. We heard the same lame excuse when the Sony-BMG rootkit debacle took place. You want to use the name "Sony" for positive publicity and goodwill? Then you take the negative publicity along with it.
- _delirium 12y ago
  "Completely separate companies" is overstating it a bit. Operationally separate business units of the same company might be closer to the mark. Their "About" page doesn't even try to describe them independently, saying only that "Sony Pictures Entertainment (SPE) is a subsidiary of Sony Entertainment Inc., a subsidiary of Tokyo-based Sony Corporation." And the footer links directly to sony.com.
- johansch 12y ago
  A bunch of Amazon EC2 machines that were also running web sites seemingly part of the Sony Playstation network were seeding the torrent for a day or so after the leak: http://www.theregister.co.uk/2014/12/03/strange_things_afoot_with_great_sony_pictures_torrent_data_leak/ http://www.theregister.co.uk/2014/12/03/strange_things_afoot...
tortos123 12y ago
haha funny shit on YC... they are promoting the wire like bitches.... I posted about sony being hacked 4 days ago when it was to actually happen... But wire does a report at it oh 1st on YC... this site is full of brats... /neveragain checking this site out. Shadoban me.thanks
- bitplanets 12y ago
  I can see you
- maaaats 12y ago
  Your title to that post was bad, you misspelled Sony and editorialized the title: "Sonny just got hacked!". And whether a post is successful or not can be a bit random.
simi_ 12y ago
The compensation levels should't be confidential in the first place. This policy is only useful to the wrong people. This is how we get artificially low market rates for developers and ridiculous amounts of money paid to incompetent execs. edit: the downvotes are an indication that you deserve your bullshit laws/status quo
- maaaats 12y ago
  The down votes may not be because people disagree with open salaries, but because this has no value in the discussion.
doctorpangloss 12y ago
Many people suggest that startups not over-optimize on issues like security and performance when it's not their core business. The same could be said of Sony: empathize a little with them. Sony Pictures pays a lot of creative people. Maybe they should have seen the hack coming, but like the PSN outage this story will be maybe a paragraph in a Wikipedia article years from now. Even one great film could be watched by people a century from now, and I respect that their priorities are around figuring out economically viable filmmaking, not I.T. The film industry regards Sony Pictures as the major studio that still takes risks on edgy comedies and dramas. They are known to respect directors more than the other majors. Gawker will surface their ridiculous PowerPoints which truthfully exist everywhere. Or journalists will scandalize the executive pay and severances, nevermind that Nick Denton's and Anna Wintour's paychecks and perks are probably far more offensive. But I don't mean to engage in whataboutism. In fact I mean the opposite: Just because some tech companies care a lot about security doesn't mean everyone should.
- deleted 12y ago
  [deleted]
- InclinedPlane 12y ago
  I empathize with them not at all. I know how much Sony pays their high level security folks, it's a laughable amount and there is no possible way they could retain anyone even remotely qualified for those roles. If you do your best and get hacked, I'll empathize. If you deprioritize security to an extreme degree and get hacked I won't feel sorry for you.
- akshatpradhan 12y ago
  Sony Pictures has an operating income (revenue minus expenses) of $501 million per year. They can afford to pay creatives, but they can't afford to pay for a few more security engineers? Look, I get the creative field costs a lot of money. But Sony Pictures was paying $454,224,070 http://fusion.net/story/30850/ http://fusion.net/story/30850/ in total salaries as of May. Even hiring 5 more security engineers would have gone a long way. That's $1 million if we assume a $200k salary for good security engineers. A drop in the bucket for Sony Pictures. I personally could do a lot with 5 security engineers.
venomsnake 12y ago
I love the fact that salaries have gone public. That should lead to some very amusing inter company drama.
secfirstmd 12y ago
Even though I am a massive supporter and advocate of whistle-blowing and leaking (in the public interest), the state of a lot of the journalism around this is appalling - esp the Gawker article. (Though the Wired one is pretty responsible in fairness.) Unless Sony has shown to be doing something malicious (which I don't think it has - other than some horrific Adam Sandler movies recently), then the angle of mining the data just to create click-bait headlines is particularly infuriating. Yes, it is right to report such a large cyber intrusion in the public interest, especially if people's data has been taken (and Sony already had this problem occur before - so it is worth pointing out that they had a chance to tighten up security) but trawling through the internal data of an innocent private company and exposing it online, just to gossip, is particularly poor journalism. Having worked with a lot of media, you can be sure they rightly wouldn't be too happy if people did that to them - just for kicks.
- deleted 12y ago
  [deleted]
- serve_yay 12y ago
  During/after the recent leak of celebrities' private photos, the condemnation was swift and serious. People can see how that directly applies to their own life, they wouldn't want their photos out there like that. But when it's a company -- it's apparently OK to just look through all their shit. It's already publicly available anyway, so what's the big deal?
KOOKLER 12y ago
test
jfmercer 12y ago
I am not a sysadmin or network security guy, so I have to ask: how could hackers siphon as much as 100 terabytes of data from Sony's network without being noticed? Shouldn't they have indictors to see their bandwidth was running dry? If so, did the GOP do it slowly to avoid drawing attention?
- spacemanmatt 12y ago
  For a network the size of Sony's, it seems like that volume should be relatively easy to smuggle out. Maybe not all at once, right?
  - gizzlon 12y ago
    If my math is right, it would take ~120 days at 10 MB / second.
- gizzlon 12y ago
  Although it's possible to monitor bandwidth use pretty closely, none of the companies I've worked for ever did that unless we where having problems. All the "hackers" have to do is copy the date in a matter that does not cause obvious problems. For example, as you said, do it slowly, or do it at night when "nobody's" using the network anyway.
- JonnieCache 12y ago
  As a movie studio I imagine their infrastructure is used to moving obscenely large archives around as a matter of course.
- shthed 12y ago
  Served from Sony's EC2 instances: http://www.theregister.co.uk/2014/12/03/strange_things_afoot_with_great_sony_pictures_torrent_data_leak/ http://www.theregister.co.uk/2014/12/03/strange_things_afoot...
dbcooper 12y ago
Re/code is claiming that Sony will officially name North Korea as the source of the attack: http://recode.net/2014/12/03/sony-to-officially-name-north-korea-as-source-of-hack-attack/ http://recode.net/2014/12/03/sony-to-officially-name-north-k... Sony Pictures will officially name North Korea as the source of a hacking attack that has exposed sensitive files and brought down its corporate network last week, two sources close to the investigation tell Re/code. An announcement could come as soon as today. Details of what Sony and the security firm Mandiant will announce are still being finalized. But the sources confirm that North Korea will be named as the source of the attack. A Sony spokeswoman declined to comment on the timing or the news, but said “The investigation continues into this very sophisticated cyber attack.”
- rconti 12y ago
  "Harming the regional peace and security and violating human rights for money". Interesting. The focus on this film and these supposed ideals make it sound very regional. I'm not saying it's North Korea, but it's someone in the region. Assuming the "purported hacker" actually had something to do with it.
johngd 12y ago
Anecdotally, I knew some guys who worked at (or with?) the global security division at Sony US HQ. The story went that each of the Sony subsidiaries[1] had their own security division that was largely autonomous for reasons of politics and budget, of course. Each part of the company had different vendors, different policies and procedures, and different philosophies on how security should be implemented. When they would all send their representatives to have a global security pow wow, however often it happened, it ended up like an episode of game of thrones. [1] http://en.wikipedia.org/wiki/Sony_Corporation_shareholders_and_subsidiaries http://en.wikipedia.org/wiki/Sony_Corporation_shareholders_a...
- drivingmenuts 12y ago
  > The story went that each of the Sony subsidiaries[1] had their own security division that was largely autonomous for reasons of politics and budget, of course. Each part of the company had different vendors, different policies and procedures, and different philosophies on how security should be implemented. And they could centralize all of that and ... it still wouldn't solve the problem. You'd have a single point of failure that might still leave them with their pants down at the end of the day. Some days, you just can't win. You can have the smartest people (they probably didn't), the best hardware and software (ditto) and you're still gonna get punched in the junk.
  - johngd 12y ago
    Absolutely. I think it is a very difficult problem to solve as companies grow larger and larger and rise to behemoth proportions all while trying to tackle something that is relatively new (the security concerns of today, as opposed to say the 80's,90's,2000's when Sony didn't have to be as competitive in the products that they offered) and typically expensive (for a company Sony's size) where funding for these things seem to be viewed in terms of $ now, instead of potential $ later.
mlrtime 12y ago
There are some comments over at reddit suggesting this is a huge deal internally. There are teams that are just not showing up for work because all the systems are down.
Zigurd 12y ago
Security means security against the state actor threat. We got a foretaste of it because North Korea's head of state has strange priorities, but there's no reason a hack like this wouldn't be launched in a trade conflict, for example. We created a security environment that prioritizes surveillance over security, especially in creating a market for zero-day exploits. That's a market that might exist without the US as a buyer, but the size and value of that market is dominated by US spending. We would not tolerate the development and auctioning of weaponized disease microbes. But we funded a similar market that threatens our technology infrastructure.
lurkylurk 12y ago
with a hack as big as this why hasn't it affected their stock price?
post_break 12y ago
My friend got doxxed from this. SSN, passport, hiring agreements, everything. This hack basically dumped every single document Sony had out on the web.
talmand 12y ago
"a line-up of mostly white male executives" What's the point in such a statement?
- forgottenpass 12y ago
  What's the point in such a statement? In-group signalling.
eyeareque 12y ago
With security you either pay for it now, or you pay for it later. These companies who make lots of bad mistakes seem to have opted for the latter.
- dasil003 12y ago
  Or you never pay for it and no one ever hears about it and everyone is sleeping like babies. Or you pay for it now and later, because you know, security is hard and crackers have the upper hand. The possibilities are endless and nuanced!
DAddYE 12y ago
Opening an article these days with: > Who knew that Sony’s top brass, a line-up of mostly white male executives, earn $1 million and more a year? is just take advantage of a difficult moment and increase the `hate`. I don't get why this could happen on magazine like Wired... Reading comments on the article seems that statement is pretty unfair. I didn't check myself because I think reading those informations is bad as the hack itself, however the author who did that can also feel free to judge others.
- deleted 12y ago
  [deleted]
- rsingel 12y ago
  Oh, no! Pointing out that a corporate power structure is overwhelming white and male is so unfair to those that are white and male. I used to be this author's editor and that lede is very Wired. Sad to see this "tone policing" comment is the top-voted comment on this thread.
  - lkbm 12y ago
    I definitely think that it's useful to point out the over-representation of white and male voices in powerful positions (which seems particularly relevant in big media corporations, since it's such a cultural driver), but in this case it's kind of stuck in there without any follow-up or relevant thesis. But, yeah, it's definitely silly that the top comment is just complaining about that sentence.
    - patronagezero 12y ago
      Yes, because privileged white guys, right? Would you feel the same if it was a minority instead? Would it even be noteworthy? Could we even have this conversation if it was a cabal of religiously exclusive peoples? That's right, only white guys are privileged, not minorities who have actual legislative privileges. One is evil, the other is supposed to be socially rewarding, but guess what, many see it for what it is; inconsistent dogma for the over-socialized.
  - 12y ago
Animats 12y ago
Are their backups OK? That's the only real issue. None of the "leaked" data is that interesting. Some executive pay info is in SEC filings. Talent pay is usually known in Hollywood. Leaking the script of Annie? That's a remake; we know how it comes out. The real question is, what did the attackers change? Did they add some phony businesses to accounts payable, or initiate financial transactions? There's a lot to be said for making backups to write-once media.
debuggerpk 12y ago
http://www.theverge.com/2014/12/4/7333263/the-malware-that-took-down-sony-was-written-in-korean http://www.theverge.com/2014/12/4/7333263/the-malware-that-t... in the article it says "and the computer that did the compiling was set up to display its text in Korean characters." i have a problem digesting this, because as per my experience, the compiler doesn't leave a trace the native host's display language or does it? what do you people have to say about it?
- kevin_thibedeau 12y ago
  There was a resource file included with Korean language strings. That either got there because the developers were Korean or as a false flag since malware doesn't otherwise need multilingual support.
bigtunacan 12y ago
I'm surprised that after the scandal of the 2011 Playstation Network hack that security isn't a big priority.

237 points by SoftwareMaven 12y ago

"Or that the company spent half a million this year in severance costs to terminate employees?" That's not much. Is Wired trying to make me think that is a lot? Or are they trying to play it against the salary figures? Considering they spent valuable words in the first sentence to make it clear that the top brass is "mostly" white males I get the impression the comparison was supposed to mean something.

legohead 12y ago
From another article I saw [1] it appeared that there was half a million spent in severance for a single employee. Others were listed as well, in 100k range, and the article author left out the names of the employees. [1] http://fusion.net/story/30850/ http://fusion.net/story/30850/
b3tta 12y ago
IMO if an article starts with > Who knew that Sony’s top brass, a line-up of mostly white male executives, earn $1 million and more a year? I'm already putting my expectations for the rest of it on the same level as those for this famous one: > I don't care if you landed a spacecraft on a comet, your shirt is sexist and ostracizing. (http://www.theverge.com/2014/11/13/7213819/your-bowling-shirt-is-holding-back-progress http://www.theverge.com/2014/11/13/7213819/your-bowling-shir...) I wonder when it's time to start yelling "Oh no the overly politically correct youngsters, which are offended by everything are coming! Hide yo kids! Hide yo wife!"
- GFK_of_xmaspast 12y ago
  Take it to stormfront.
foldor 12y ago
Actually the "mostly white males" comment struck me as an interesting side note. Sony is a Japanese company, so for it to be run by "mostly white males" is something that seems noteworthy in itself. Though I doubt that's what they were going for when they wrote that.
- RaptorJ 12y ago
  Not Sony but Sony Pictures Entertainment which is an american subsidiary.

cheeze 12y ago

http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootkit_scandal http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootki...

dagw 12y ago
Different Sony.
- CamperBob2 12y ago
  Same name, same (lack of) good will.

nostromo 12y ago

The North Korean theory seems silly. In fact, it's exactly what I might say publicly if I were Sony and I wanted to try and turn lemons (being hacked) into lemonade (free buzz about an upcoming movie). The movie Kim Jong-un doesn't want you to see! In the end, I doubt there was any hacking involved at all: a disgruntled employee leaked documents. Perhaps Sony forgot to disable someone's password after giving them the axe.

001sky 12y ago
The "state sponsored" line was about a form a data recovery sabotage used. Seems an insider would have a similar desire to hide tracks. Blame the "mysterious outside forces" is always the kneejerk tho.
higherpurpose 12y ago
If they did it on purpose it's even sillier. They may think that it would be cool to say they "got hacked by a state" especially if it's related to an upcoming movie about it, but to me it seems like amateur hour at Sony if they got hacked by North Korea, a country not exactly known for its advanced technology and high computer usage.
- dagw 12y ago
  North Korea as a country might be behind the technological curve, but several reports indicate the the North Korean Army cyber warfare division is pretty well funded and advanced. There is a huge divide between the day to day realities of the average NK citizen and the realities of the upper echelons.
  - deciplex 12y ago
    Who makes up the cyber-warfare division? If I traveled in time back to 1850 with a billion dollars worth of gold bullion, I couldn't hire a single black hat with it. So a few kids of the party elite get to go to nice schools abroad - where are the rest coming from? Or does DPRK have a shit-hot education system in spite of literally other thing about the country being godawful and totally backwards? If so it's the first I've heard that.

Illniyar 12y ago

"Pastebin—the unofficial cloud repository of hackers everywhere" Are they referring to "http://pastebin.com/" http://pastebin.com/" ? if so is it really "the unoffical cloud repository of hackers everywhere" ? Is it really used often by hackers? I thought reddit and 4chan are the more popular places to dump illegally gained information.

nostromo 12y ago
Very common. https://www.google.com/search?q=pastebin.com%20email%20and%20password https://www.google.com/search?q=pastebin.com%20email%20and%2...
- Illniyar 12y ago
  Don't they have some kind of policy to get rid of these things?
  - atmosx 12y ago
    Why should they????? Because someone doesn't like it? Seriously?!?!
  - rjaco31 12y ago
    Why would they?
superuser2 12y ago
Every password dump, claim of responsibility for a hack, etc. I have ever seen has been on pastebin. I suspect this is just because it'a a highly-visible, non-sketchy domain name that provides free, scalable hosting of text that can be used anonymously without much effort.
hiou 12y ago
Here's an interview with Jeroen Vader. I assume he still owns pastebin and may provide some insight into why it works well for that purpose. http://www.bbc.com/news/technology-17524822 http://www.bbc.com/news/technology-17524822

martin1975 12y ago

Smells like an inside job.

mintplant 12y ago

An article on The Hollywood Reporter has some more information on this, including perspectives from sources elsewhere within the industry: http://www.hollywoodreporter.com/news/sony-hack-studio-security-points-753509 http://www.hollywoodreporter.com/news/sony-hack-studio-secur... "It's changing our business," says one producer of its impact on Hollywood. "From now on, money and time will be allocated by studios to deal with this full-time." ...as it should have been already, given how big and how valuable a target these companies are.

msantos 12y ago
> "It's changing our business," says one producer of its impact on Hollywood. "From now on, money and time will be allocated by studios to deal with this full-time." Shame that most of Sony's Finance and HR are blaming the IT department - so bloody typical! "Everyone’s looking to the IT department to say, ‘How did you let this happen?'" said one employee in Sony Pictures’ finance department." http://fusion.net/story/31116/inside-sony-pictures-employees-are-panicking-about-their-hacked-personal-data/ http://fusion.net/story/31116/inside-sony-pictures-employees...
- gadders 12y ago
  I work in an IT department. Pretty sure IT Security would be the responsibility of somebody here.
  - alecco 12y ago
    Yeah, who is routinely ignored by the rest because they are too busy with deadlines or something.
  - sarciszewski 12y ago
    I worked in an IT department for a communications company that worked with AT&T where, at least once a month, I would find a different way to suggest to a different team lead to check out EMET in case we ever got targeted. It got ignored. If they ever get hacked, I won't be surprised.
  - 12y ago

ck2 12y ago

Not knowing anything about it did not stop every damn "news" channel from saying "oh North Korea did it" then added at the end "but there is no proof". How can "news" call themselves news if all they do is speculate. Granted it wouldn't be entertaining if all they said was "Sony got hacked and we don't have any details" but that is why news is called news.

cellis 12y ago
Nope! News is simply "here's some words you might be interested in reading, and hopefully believing: ...words here...". Journalism is a dying art.
logn 12y ago
WSJ has some reasons to suspect North Korea: http://online.wsj.com/articles/more-signs-north-korea-may-be-behind-hacking-of-sony-pictures-1417467267 http://online.wsj.com/articles/more-signs-north-korea-may-be... But I think most of the media pretty much just reads the news, press releases, and their social media feeds to write their articles.

higherpurpose 12y ago

You'd think they would've learned a thing or two after they were made the hackers' pinata the last time around. Sony continues to come up as the poster-boy company for weak security.

Narishma 12y ago
That was a different Sony company that was hacked. I don't think they share much in common except the Sony name.
- LLWM 12y ago
  It was twelve different Sony companies. It was clear that no part of Sony had any interest in information security.
  - tptacek 12y ago
    The only difference between Sony and any of a dozen different financial services companies is that Sony has better name recognition and so is a bigger target.
    - LLWM 12y ago
      Are you implying that's not an enormous difference?

chx 12y ago

So. Sony America suffered an outage on the Playstation Network due to a hack in 2011 causing 171 million in damages (that's the official figure, who knows how much the lost goodwill cost them ongoing). After that if they did not make cybersecurity priority number 1 then they deserve what they've gotten. Fool me once, shame on you; fool me twice, shame on me.

derefr 12y ago
Effectively, Sony Computer Entertainment and Sony Pictures Entertainment are about as related as Virgin Airlines and Virgin Mobile. Think of Sony (and any conglomerate in general) not as a parent company per se, but more like a VC firm or a majority-shareholder mutual fund; the executives of the Sony conglomerate don't really have any more insight into the component companies than those companies' other shareholders do. The only way business-process insight is going to be spread between the component companies is if the executives of one happen to read the trade press of the other.
- chx 12y ago
  Eh, if I am a majority shareholder then I will read the riot act to the company I hold a majority in after they lose $171M on shitty security. Also, http://www.sony.com/SCA/who-we-are/our-businesses.shtml http://www.sony.com/SCA/who-we-are/our-businesses.shtml lists all these so there is some cohesion. AFAIK there's no such Virgin supercompany.
  - derefr 12y ago
    Richard Branson is Virgin's sole-proprietor supercompany. :) But yes, that's true—the investors would be mad at SCE. But would that, in turn, make them think of pulling aside SPE to give them the same talk? SPE isn't even doing anything involving running a public-facing web service; why would the investors presume they'd be at risk? It'd be like YCombinator calling in all their current batch of startups to give them a lesson on finances because one of them screwed up their bookkeeping.
    - 12y ago

elnate 12y ago

Is this a hack of a division of Sony? Because the executive names I found don't sound white. http://www.sony.net/SonyInfo/CorporateInfo/executive/ http://www.sony.net/SonyInfo/CorporateInfo/executive/

davidw 12y ago
> Now we all do, since about 40 gigabytes of sensitive company data from computers belonging to Sony Pictures Entertainment were stolen and posted online. From the article, a few sentences in.
lkbm 12y ago
It's Sony Pictures Entertainment, am American subsidiary: http://www.sonypictures.com/corp/management.html http://www.sonypictures.com/corp/management.html

yabatopia 12y ago

It's Sony Pictures Entertainment that got hacked, not Sony. They're completely separate companies, yet the media fails to recognize that. Very annoying and confusing, it's almost deliberately.

chinpokomon 12y ago
Gosh, someone should tell someone at Sony. They themselves draw no distinction. Sony -- Script to Screen: http://youtu.be/4P4Wl1Ogg_g http://youtu.be/4P4Wl1Ogg_g
itafroma 12y ago
> It's Sony Pictures Entertainment that got hacked, not Sony. They're completely separate companies, yet the media fails to recognize that. Sony is a very large conglomerate: while it would be incorrect to say that, say, Sony Computer Entertainment (the subsidiary that runs Sony's video games operations) got hacked, Sony Pictures Entertainment is a wholly-owned subsidiary of Sony Entertainment, Inc., which is itself a wholly-owned subsidiary of Sony Corporation.[1] It's as much "Sony" as any of its other subsidiaries. [1]: http://www.sonypictures.com/corp/aboutsonypictures.html http://www.sonypictures.com/corp/aboutsonypictures.html
CamperBob2 12y ago
BS. We heard the same lame excuse when the Sony-BMG rootkit debacle took place. You want to use the name "Sony" for positive publicity and goodwill? Then you take the negative publicity along with it.
_delirium 12y ago
"Completely separate companies" is overstating it a bit. Operationally separate business units of the same company might be closer to the mark. Their "About" page doesn't even try to describe them independently, saying only that "Sony Pictures Entertainment (SPE) is a subsidiary of Sony Entertainment Inc., a subsidiary of Tokyo-based Sony Corporation." And the footer links directly to sony.com.
johansch 12y ago
A bunch of Amazon EC2 machines that were also running web sites seemingly part of the Sony Playstation network were seeding the torrent for a day or so after the leak: http://www.theregister.co.uk/2014/12/03/strange_things_afoot_with_great_sony_pictures_torrent_data_leak/ http://www.theregister.co.uk/2014/12/03/strange_things_afoot...

tortos123 12y ago

haha funny shit on YC... they are promoting the wire like bitches.... I posted about sony being hacked 4 days ago when it was to actually happen... But wire does a report at it oh 1st on YC... this site is full of brats... /neveragain checking this site out. Shadoban me.thanks

bitplanets 12y ago
I can see you
maaaats 12y ago
Your title to that post was bad, you misspelled Sony and editorialized the title: "Sonny just got hacked!". And whether a post is successful or not can be a bit random.

simi_ 12y ago

The compensation levels should't be confidential in the first place. This policy is only useful to the wrong people. This is how we get artificially low market rates for developers and ridiculous amounts of money paid to incompetent execs. edit: the downvotes are an indication that you deserve your bullshit laws/status quo

maaaats 12y ago
The down votes may not be because people disagree with open salaries, but because this has no value in the discussion.

doctorpangloss 12y ago

Many people suggest that startups not over-optimize on issues like security and performance when it's not their core business. The same could be said of Sony: empathize a little with them. Sony Pictures pays a lot of creative people. Maybe they should have seen the hack coming, but like the PSN outage this story will be maybe a paragraph in a Wikipedia article years from now. Even one great film could be watched by people a century from now, and I respect that their priorities are around figuring out economically viable filmmaking, not I.T. The film industry regards Sony Pictures as the major studio that still takes risks on edgy comedies and dramas. They are known to respect directors more than the other majors. Gawker will surface their ridiculous PowerPoints which truthfully exist everywhere. Or journalists will scandalize the executive pay and severances, nevermind that Nick Denton's and Anna Wintour's paychecks and perks are probably far more offensive. But I don't mean to engage in whataboutism. In fact I mean the opposite: Just because some tech companies care a lot about security doesn't mean everyone should.

deleted 12y ago
[deleted]
InclinedPlane 12y ago
I empathize with them not at all. I know how much Sony pays their high level security folks, it's a laughable amount and there is no possible way they could retain anyone even remotely qualified for those roles. If you do your best and get hacked, I'll empathize. If you deprioritize security to an extreme degree and get hacked I won't feel sorry for you.
akshatpradhan 12y ago
Sony Pictures has an operating income (revenue minus expenses) of $501 million per year. They can afford to pay creatives, but they can't afford to pay for a few more security engineers? Look, I get the creative field costs a lot of money. But Sony Pictures was paying $454,224,070 http://fusion.net/story/30850/ http://fusion.net/story/30850/ in total salaries as of May. Even hiring 5 more security engineers would have gone a long way. That's $1 million if we assume a $200k salary for good security engineers. A drop in the bucket for Sony Pictures. I personally could do a lot with 5 security engineers.

venomsnake 12y ago

I love the fact that salaries have gone public. That should lead to some very amusing inter company drama.

secfirstmd 12y ago

Even though I am a massive supporter and advocate of whistle-blowing and leaking (in the public interest), the state of a lot of the journalism around this is appalling - esp the Gawker article. (Though the Wired one is pretty responsible in fairness.) Unless Sony has shown to be doing something malicious (which I don't think it has - other than some horrific Adam Sandler movies recently), then the angle of mining the data just to create click-bait headlines is particularly infuriating. Yes, it is right to report such a large cyber intrusion in the public interest, especially if people's data has been taken (and Sony already had this problem occur before - so it is worth pointing out that they had a chance to tighten up security) but trawling through the internal data of an innocent private company and exposing it online, just to gossip, is particularly poor journalism. Having worked with a lot of media, you can be sure they rightly wouldn't be too happy if people did that to them - just for kicks.

deleted 12y ago
[deleted]
serve_yay 12y ago
During/after the recent leak of celebrities' private photos, the condemnation was swift and serious. People can see how that directly applies to their own life, they wouldn't want their photos out there like that. But when it's a company -- it's apparently OK to just look through all their shit. It's already publicly available anyway, so what's the big deal?

KOOKLER 12y ago

test

jfmercer 12y ago

I am not a sysadmin or network security guy, so I have to ask: how could hackers siphon as much as 100 terabytes of data from Sony's network without being noticed? Shouldn't they have indictors to see their bandwidth was running dry? If so, did the GOP do it slowly to avoid drawing attention?

spacemanmatt 12y ago
For a network the size of Sony's, it seems like that volume should be relatively easy to smuggle out. Maybe not all at once, right?
- gizzlon 12y ago
  If my math is right, it would take ~120 days at 10 MB / second.
gizzlon 12y ago
Although it's possible to monitor bandwidth use pretty closely, none of the companies I've worked for ever did that unless we where having problems. All the "hackers" have to do is copy the date in a matter that does not cause obvious problems. For example, as you said, do it slowly, or do it at night when "nobody's" using the network anyway.
JonnieCache 12y ago
As a movie studio I imagine their infrastructure is used to moving obscenely large archives around as a matter of course.
shthed 12y ago
Served from Sony's EC2 instances: http://www.theregister.co.uk/2014/12/03/strange_things_afoot_with_great_sony_pictures_torrent_data_leak/ http://www.theregister.co.uk/2014/12/03/strange_things_afoot...

dbcooper 12y ago

Re/code is claiming that Sony will officially name North Korea as the source of the attack: http://recode.net/2014/12/03/sony-to-officially-name-north-korea-as-source-of-hack-attack/ http://recode.net/2014/12/03/sony-to-officially-name-north-k... Sony Pictures will officially name North Korea as the source of a hacking attack that has exposed sensitive files and brought down its corporate network last week, two sources close to the investigation tell Re/code. An announcement could come as soon as today. Details of what Sony and the security firm Mandiant will announce are still being finalized. But the sources confirm that North Korea will be named as the source of the attack. A Sony spokeswoman declined to comment on the timing or the news, but said “The investigation continues into this very sophisticated cyber attack.”

rconti 12y ago
"Harming the regional peace and security and violating human rights for money". Interesting. The focus on this film and these supposed ideals make it sound very regional. I'm not saying it's North Korea, but it's someone in the region. Assuming the "purported hacker" actually had something to do with it.

johngd 12y ago

Anecdotally, I knew some guys who worked at (or with?) the global security division at Sony US HQ. The story went that each of the Sony subsidiaries[1] had their own security division that was largely autonomous for reasons of politics and budget, of course. Each part of the company had different vendors, different policies and procedures, and different philosophies on how security should be implemented. When they would all send their representatives to have a global security pow wow, however often it happened, it ended up like an episode of game of thrones. [1] http://en.wikipedia.org/wiki/Sony_Corporation_shareholders_and_subsidiaries http://en.wikipedia.org/wiki/Sony_Corporation_shareholders_a...

drivingmenuts 12y ago
> The story went that each of the Sony subsidiaries[1] had their own security division that was largely autonomous for reasons of politics and budget, of course. Each part of the company had different vendors, different policies and procedures, and different philosophies on how security should be implemented. And they could centralize all of that and ... it still wouldn't solve the problem. You'd have a single point of failure that might still leave them with their pants down at the end of the day. Some days, you just can't win. You can have the smartest people (they probably didn't), the best hardware and software (ditto) and you're still gonna get punched in the junk.
- johngd 12y ago
  Absolutely. I think it is a very difficult problem to solve as companies grow larger and larger and rise to behemoth proportions all while trying to tackle something that is relatively new (the security concerns of today, as opposed to say the 80's,90's,2000's when Sony didn't have to be as competitive in the products that they offered) and typically expensive (for a company Sony's size) where funding for these things seem to be viewed in terms of $ now, instead of potential $ later.

mlrtime 12y ago

There are some comments over at reddit suggesting this is a huge deal internally. There are teams that are just not showing up for work because all the systems are down.

Zigurd 12y ago

Security means security against the state actor threat. We got a foretaste of it because North Korea's head of state has strange priorities, but there's no reason a hack like this wouldn't be launched in a trade conflict, for example. We created a security environment that prioritizes surveillance over security, especially in creating a market for zero-day exploits. That's a market that might exist without the US as a buyer, but the size and value of that market is dominated by US spending. We would not tolerate the development and auctioning of weaponized disease microbes. But we funded a similar market that threatens our technology infrastructure.

lurkylurk 12y ago

with a hack as big as this why hasn't it affected their stock price?

post_break 12y ago

My friend got doxxed from this. SSN, passport, hiring agreements, everything. This hack basically dumped every single document Sony had out on the web.

talmand 12y ago

"a line-up of mostly white male executives" What's the point in such a statement?

forgottenpass 12y ago
What's the point in such a statement? In-group signalling.

eyeareque 12y ago

With security you either pay for it now, or you pay for it later. These companies who make lots of bad mistakes seem to have opted for the latter.

dasil003 12y ago
Or you never pay for it and no one ever hears about it and everyone is sleeping like babies. Or you pay for it now and later, because you know, security is hard and crackers have the upper hand. The possibilities are endless and nuanced!

DAddYE 12y ago

Opening an article these days with: > Who knew that Sony’s top brass, a line-up of mostly white male executives, earn $1 million and more a year? is just take advantage of a difficult moment and increase the `hate`. I don't get why this could happen on magazine like Wired... Reading comments on the article seems that statement is pretty unfair. I didn't check myself because I think reading those informations is bad as the hack itself, however the author who did that can also feel free to judge others.

deleted 12y ago
[deleted]
rsingel 12y ago
Oh, no! Pointing out that a corporate power structure is overwhelming white and male is so unfair to those that are white and male. I used to be this author's editor and that lede is very Wired. Sad to see this "tone policing" comment is the top-voted comment on this thread.
- lkbm 12y ago
  I definitely think that it's useful to point out the over-representation of white and male voices in powerful positions (which seems particularly relevant in big media corporations, since it's such a cultural driver), but in this case it's kind of stuck in there without any follow-up or relevant thesis. But, yeah, it's definitely silly that the top comment is just complaining about that sentence.
  - patronagezero 12y ago
    Yes, because privileged white guys, right? Would you feel the same if it was a minority instead? Would it even be noteworthy? Could we even have this conversation if it was a cabal of religiously exclusive peoples? That's right, only white guys are privileged, not minorities who have actual legislative privileges. One is evil, the other is supposed to be socially rewarding, but guess what, many see it for what it is; inconsistent dogma for the over-socialized.
- 12y ago

Animats 12y ago

Are their backups OK? That's the only real issue. None of the "leaked" data is that interesting. Some executive pay info is in SEC filings. Talent pay is usually known in Hollywood. Leaking the script of Annie? That's a remake; we know how it comes out. The real question is, what did the attackers change? Did they add some phony businesses to accounts payable, or initiate financial transactions? There's a lot to be said for making backups to write-once media.

debuggerpk 12y ago

http://www.theverge.com/2014/12/4/7333263/the-malware-that-took-down-sony-was-written-in-korean http://www.theverge.com/2014/12/4/7333263/the-malware-that-t... in the article it says "and the computer that did the compiling was set up to display its text in Korean characters." i have a problem digesting this, because as per my experience, the compiler doesn't leave a trace the native host's display language or does it? what do you people have to say about it?

kevin_thibedeau 12y ago
There was a resource file included with Korean language strings. That either got there because the developers were Korean or as a false flag since malware doesn't otherwise need multilingual support.

bigtunacan 12y ago

I'm surprised that after the scandal of the 2011 Playstation Network hack that security isn't a big priority.