13 ms·

I wish people would stop calling this a hack. It's not a hack, it was a cyberwarfare. I know someone who was working on the team trying to recover from this a

by steven2012 12y ago

I wish people would stop calling this a hack. It's not a hack, it was a cyberwarfare. I know someone who was working on the team trying to recover from this attack, and Sony Pictures is basically fucked. Their IT infrastructure has been utterly destroyed, meaning they can't even pay their employees, pay their vendors or take orders from customers. They don't even want to use computers anymore, people call and text now to avoid any sort of central infrastructure that can be hacked. They had to switch to all-manual processes, and it will take months or likely years before their infrastructure is back within some sort of semblance. But by then Sony Pictures as an entity may no longer exist. From all of the emails being released ridiculing their own talent, to their employees having their privacy destroyed and financial accounts hacked, who could work for this company again? The thing this attack does is raise the bar as to what to expect. The worst we had heard until now was credit cards being stolen for quick gains, maybe some business secrets being stolen. But in my mind it started with lulzsec a couple of years ago where the attitude was for anarchy and cyberwar. But if the new trend is for companies to get destroyed, then cybersecurity will go to the next level where every company has to assume if they get hacked, they will get destroyed, so it becomes probably even more critical than other business processes.

tomp 12y ago
Just because the damage to the company was huge, it doesn't mean it was anything else than an ordinary hack in a less-than-secure computer network. I can totally imagine hackers deleting data/disabling systems/leaking emails just for the lulz!
the_real_bto 12y ago
Are there any online sources for this? I'm looking through google news, but everyone is focused on what information was leaked...
vernie 12y ago
So was it a hack, an attack or a cyberwarfare? Even you seem to use the terms interchangeably.
- walterbell 12y ago
  The event creates opportunities for collateral opportunism, the consequence of which could change interpretations of the event.
- shmerl 12y ago
  It was a security breach. Hack is a wrong term for it. See http://www.catb.org/jargon/html/meaning-of-hack.html http://www.catb.org/jargon/html/meaning-of-hack.html
  - jmnicolas 12y ago
    "Hacker" is like "GNU/Linux". 99% of the world has decided that it was just Linux and a hacker was a bad guy doing bad things with a computer. At one point if you don't want to be the "GNU Nazi" or the "hacker Nazi" you have to go with the flow.
    - shmerl 12y ago
      No, thanks. Hackers themselves should better know the right meaning of the word. Going with the flow? What was that about, this site has Hacker in the name if you didn't notice ;)
      - perlgeek 12y ago
        But is it still the "right" meaning of a word, if nearly everybody doesn't it use that way? Language doesn't work by giving some people the authority to define what a word means, against the super-majority of users. Language changes through usage. Yes, I'm all for using "hacker" the old-school way, but really doesn't help if the people whom I talk to misunderstand me.
        shmerl 12y ago
        > Language doesn't work by giving some people the authority to define what a word means That's the point, so I'm using it the way I like ;)
randyrand 12y ago
Yay, another confusing term without an agreed upon definition!
higherpurpose 12y ago
> then cybersecurity will go to the next level where every company has to assume if they get hacked, they will get destroyed, so it becomes probably even more critical than other business processes. So then companies will finally start taking security seriously, that needs to be done right from day one, and not as a "hack" that they add after they've already reached a million subscribers? If only that would happen, because clearly the Sony executive in charge of security thought the opposite of that, saying as much as it "didn't make sense" to secure the company too much. Maybe, just maybe, post-Snowden and post-Sony hack, people and companies will start taking online security seriously, while at the same time, the main stakeholders of the Internet will make a solid effort to push everyone to more modern security systems that aren't based on stuff invented 20-30 years ago and are now unnecessarily complex + easy to hack.
- nemothekid 12y ago
  >Maybe, just maybe, post-Snowden and post-Sony hack, people and companies will start taking online security seriously, while at the same time, the main stakeholders of the Internet will make a solid effort to push everyone to more modern security systems that aren't based on stuff invented 20-30 years ago and are now unnecessarily complex + easy to hack. It was only a matter of time. To be honest I could easily understand why a 60 year old exec wouldn't take IT security seriously. Even though they use it everyday, the recent "hacks" have only been a minor inconvenience to the companies targeted. Only banks and "younger" tech companies seem to take security seriously, because they have money to lose. Target had $0 taken from them when they got hacked. However now thats its clear that almost every facet of the company flows through technology people will no be more serious about security. Now that execs can't get paid and they lose money its an issue. The SPE hack shows that if security isn't taken seriously, hackers will literally bomb you back to the stone ages. I'm sure any competent security engineer is now seeing their paychecks rise and their opinions taken more seriously. I feel bad for those that worked at Sony (moreso the employees - its not impossible that year from now their credit will be destroyed because some skiddy decided to use their SSNs to buy a hummer after the fact). Even basic stuff - there doesn't even seem to be a post-hack disaster plan here too. Who knows how long it will take SPE to recover.
mbell 12y ago
> Their IT infrastructure has been utterly destroyed Seems like it was 'destroyed' to begin with, the only difference is that they are now aware of it.
waterlesscloud 12y ago
Yeah, from talking to a couple friends who work at or with Sony Pictures, morale is insanely low. Their personal information all over the place and the worst of their company's dirty laundry exposed. Having said that, SPE is too big a company to go away. They'll get through it, but badly damaged and for years to come. That to me is what makes it more than a normal hack. It's not just some data released, it's a body blow to the company itself.
LukeFitzpatrick 12y ago
The difference between a hack and cyber warfare is this: cyber warfare results in death or substantially loss to property. Here's a link that has a cool presentation about the differences to clear up any confusion: http://www.slideshare.net/mobile/digicomp/cyber-warfare-vs-hacking-in-english http://www.slideshare.net/mobile/digicomp/cyber-warfare-vs-h... Disclosure: I didn't write this presentation, but I wish I did :) According to the presentation, Steven2012 is right. Oh and there is even a definition of cyber warfare in the presentation.
deleted 12y ago
[deleted]
scotty79 12y ago
> But by then Sony Pictures as an entity may no longer exist. Is that a bad thing? I'm asking honestly. Why would you think that Sony Pictures ceasing to exist is a bad thing? Many other companies that made bad decisions ceased to exist before thus releasing their employees so they could work at places that don't make that many bad decisions. Why is that bad?
- techrat 12y ago
  Bam. You are instantly out of a job due to a fuck up on your employer's part. As a result, your coming paycheck for the previous two week's worth of work isn't going to be able to be issued on time and we're not sure your next one after is coming either. You and EVERYONE in your company are potentially looking for work in an already crowded industry. You will have the reputation of a rat fleeing a sinking ship if you bail as soon as things get rough. You're living paycheck to paycheck or damn close to it as most industry professionals actually do. Everyone you know is competition for a different job. Everyone else is reeling from how bad it got at Sony and wanting to lock things down and therefore have no inclination to bring anything into their offices associated with the massive clusterfuck that is Sony. You think you're going to easily find another job? Times tens of thousands of people? It's not "poof, bad company gone." it's "oh shit, a lot of people are truly fucked right now if it gets any worse than this." Have a little fucking empathy, asshole.
  - scotty79 12y ago
    You could defend any company with this reasoning, no matter what atrocity they commit. Company that jails people for profit? No we can't let them out because all those poor guards and their families will be left without a paycheck. Drone strikes? We need that! Where would drone operators get their paychecks? And all thise poor engineers and tech crews! Having empathy is one thing. Saying that people need jobs no matter what is another.
    - techrat 12y ago
      What company do you work for so that we can thoroughly vet that you are not a part of any global conspiracies? If we do find something that could be a problem, you will be tried for crimes against humanity as a lowly employee trying to make ends meet. Everything you responded to me with btw, has nothing to do with Sony. Your strawman, burn it.
ploxiln 12y ago
Security is the ultimate technical debt. Most companies get super deep into this kind of debt, it's just not visible until they "get unlucky". I think it would be a good thing if companies, the industry, and everyday people were more aware of this concept (even if not with this terminology). I would guess that almost all companies have significant security deficiencies, which at least some of their engineers are aware of. It's just never a priority to work on, unless they've just been hacked. Their priority is always on product and marketing, and they have to compete with all the other companies not spending real engineering effort on security, after all. They're all just gambling on not being hacked to bad.
kafkaesque 12y ago
(Put on a big tinfoil hat) I'm doing some conjecturing here, but could hacking in the 21st century and cyber warfare be the new virtual/online 'rioting'? For example, Sony aides the US army since it is affiliated with Rockwell Collins and Future Combat Systems, so it would make sense if 'socialists', leftists, progressives, and anarchists seek to destroy conglomerates where they get a large chunk of their profit, disabling any funding of the US army, since the majority government's ideology does not align with theirs. Whether these 'minorities' are citizens of the targeted country or not, this group of intelligent people seem to be growing increasingly disenchanted by how things are being played out in the world. We see it among hackers in North Korea and the Middle East. Increasingly, Japan's racist past has been brought up in the media lately, yet Kazuo Hirai allowed a racist movie for the sake of comedy to be funded. (For those not in the know, Japan is going through a period of negationism with its politics being controlled by ultra conservatives). Post-Edward Snowden, it seems like there is very little hackers, developers, etc., can do that is not political or at least aiding or taking away from some socioeconomic issue. It's sad but it seems we are all somehow weakening the System or helping it. Sure, I'm not saying we should all worry about it. These are just the observations of an amateur.
- gggeek 12y ago
  Seems precisely the scenario of cyberpunk RPGs from the 90s
danielweber 12y ago
If Sony Pictures was going to be destroyed, I think there would be a bigger hit to their stock price.
grecy 12y ago
> to their employees having their privacy destroyed I'm always shocked at how concerned Americans are about the big bad wolf that is "identity theft". Is it really as bad as everyone thinks? In all honesty, when your info gets leaked, don't you just cancel every credit card and bank account, get a new SSN, change your drivers license number, change your phone number and a few other numbers and move on with your life? Is it honestly much different than losing your wallet full of cards? (which must happen to tens of thousands of people in the developed world daily) Does anyone have direct experience on what "identity theft" is actually like? (Honest question, I'm not American and I don't understand why it's such a big deal)
- pdabbadabba 12y ago
  The short answer is that it is very difficult (in many cases not possible) to get a new SSN.
- BinaryIdiot 12y ago
  > In all honesty, when your info gets leaked, don't you just cancel every credit card and bank account, get a new SSN, change your drivers license number, change your phone number and a few other numbers and move on with your life? That is an insane pain in the ass. In this day of age just changing a credit card number is a pain; now changing your phone number is a new level of pain in the ass. Not only that but it's hard to get a new SSN; I've known plenty of people who requested a new one due to their SSN leaking and unless you have proof of identity theft many of them were simply declined. Driver license numbers you typically don't need to change however. Almost all drive license numbers are generated simply based on your name (granted this depends on the state) so most of the time you can generate someone's number, accurately, just by knowing their name or a few other details about them. They're not really used to much.
  - grecy 12y ago
    OK so it's a pain in the ass. That's not really that bad on the scale of things.
    - 12y ago

tomp 12y ago

Just because the damage to the company was huge, it doesn't mean it was anything else than an ordinary hack in a less-than-secure computer network. I can totally imagine hackers deleting data/disabling systems/leaking emails just for the lulz!

the_real_bto 12y ago

Are there any online sources for this? I'm looking through google news, but everyone is focused on what information was leaked...

vernie 12y ago

So was it a hack, an attack or a cyberwarfare? Even you seem to use the terms interchangeably.

walterbell 12y ago
The event creates opportunities for collateral opportunism, the consequence of which could change interpretations of the event.
shmerl 12y ago
It was a security breach. Hack is a wrong term for it. See http://www.catb.org/jargon/html/meaning-of-hack.html http://www.catb.org/jargon/html/meaning-of-hack.html
- jmnicolas 12y ago
  "Hacker" is like "GNU/Linux". 99% of the world has decided that it was just Linux and a hacker was a bad guy doing bad things with a computer. At one point if you don't want to be the "GNU Nazi" or the "hacker Nazi" you have to go with the flow.
  - shmerl 12y ago
    No, thanks. Hackers themselves should better know the right meaning of the word. Going with the flow? What was that about, this site has Hacker in the name if you didn't notice ;)
    - perlgeek 12y ago
      But is it still the "right" meaning of a word, if nearly everybody doesn't it use that way? Language doesn't work by giving some people the authority to define what a word means, against the super-majority of users. Language changes through usage. Yes, I'm all for using "hacker" the old-school way, but really doesn't help if the people whom I talk to misunderstand me.
      - shmerl 12y ago
        > Language doesn't work by giving some people the authority to define what a word means That's the point, so I'm using it the way I like ;)

randyrand 12y ago

Yay, another confusing term without an agreed upon definition!

higherpurpose 12y ago

> then cybersecurity will go to the next level where every company has to assume if they get hacked, they will get destroyed, so it becomes probably even more critical than other business processes. So then companies will finally start taking security seriously, that needs to be done right from day one, and not as a "hack" that they add after they've already reached a million subscribers? If only that would happen, because clearly the Sony executive in charge of security thought the opposite of that, saying as much as it "didn't make sense" to secure the company too much. Maybe, just maybe, post-Snowden and post-Sony hack, people and companies will start taking online security seriously, while at the same time, the main stakeholders of the Internet will make a solid effort to push everyone to more modern security systems that aren't based on stuff invented 20-30 years ago and are now unnecessarily complex + easy to hack.

nemothekid 12y ago
>Maybe, just maybe, post-Snowden and post-Sony hack, people and companies will start taking online security seriously, while at the same time, the main stakeholders of the Internet will make a solid effort to push everyone to more modern security systems that aren't based on stuff invented 20-30 years ago and are now unnecessarily complex + easy to hack. It was only a matter of time. To be honest I could easily understand why a 60 year old exec wouldn't take IT security seriously. Even though they use it everyday, the recent "hacks" have only been a minor inconvenience to the companies targeted. Only banks and "younger" tech companies seem to take security seriously, because they have money to lose. Target had $0 taken from them when they got hacked. However now thats its clear that almost every facet of the company flows through technology people will no be more serious about security. Now that execs can't get paid and they lose money its an issue. The SPE hack shows that if security isn't taken seriously, hackers will literally bomb you back to the stone ages. I'm sure any competent security engineer is now seeing their paychecks rise and their opinions taken more seriously. I feel bad for those that worked at Sony (moreso the employees - its not impossible that year from now their credit will be destroyed because some skiddy decided to use their SSNs to buy a hummer after the fact). Even basic stuff - there doesn't even seem to be a post-hack disaster plan here too. Who knows how long it will take SPE to recover.

mbell 12y ago

> Their IT infrastructure has been utterly destroyed Seems like it was 'destroyed' to begin with, the only difference is that they are now aware of it.

waterlesscloud 12y ago

Yeah, from talking to a couple friends who work at or with Sony Pictures, morale is insanely low. Their personal information all over the place and the worst of their company's dirty laundry exposed. Having said that, SPE is too big a company to go away. They'll get through it, but badly damaged and for years to come. That to me is what makes it more than a normal hack. It's not just some data released, it's a body blow to the company itself.

LukeFitzpatrick 12y ago

The difference between a hack and cyber warfare is this: cyber warfare results in death or substantially loss to property. Here's a link that has a cool presentation about the differences to clear up any confusion: http://www.slideshare.net/mobile/digicomp/cyber-warfare-vs-hacking-in-english http://www.slideshare.net/mobile/digicomp/cyber-warfare-vs-h... Disclosure: I didn't write this presentation, but I wish I did :) According to the presentation, Steven2012 is right. Oh and there is even a definition of cyber warfare in the presentation.

deleted 12y ago

[deleted]

scotty79 12y ago

> But by then Sony Pictures as an entity may no longer exist. Is that a bad thing? I'm asking honestly. Why would you think that Sony Pictures ceasing to exist is a bad thing? Many other companies that made bad decisions ceased to exist before thus releasing their employees so they could work at places that don't make that many bad decisions. Why is that bad?

techrat 12y ago
Bam. You are instantly out of a job due to a fuck up on your employer's part. As a result, your coming paycheck for the previous two week's worth of work isn't going to be able to be issued on time and we're not sure your next one after is coming either. You and EVERYONE in your company are potentially looking for work in an already crowded industry. You will have the reputation of a rat fleeing a sinking ship if you bail as soon as things get rough. You're living paycheck to paycheck or damn close to it as most industry professionals actually do. Everyone you know is competition for a different job. Everyone else is reeling from how bad it got at Sony and wanting to lock things down and therefore have no inclination to bring anything into their offices associated with the massive clusterfuck that is Sony. You think you're going to easily find another job? Times tens of thousands of people? It's not "poof, bad company gone." it's "oh shit, a lot of people are truly fucked right now if it gets any worse than this." Have a little fucking empathy, asshole.
- scotty79 12y ago
  You could defend any company with this reasoning, no matter what atrocity they commit. Company that jails people for profit? No we can't let them out because all those poor guards and their families will be left without a paycheck. Drone strikes? We need that! Where would drone operators get their paychecks? And all thise poor engineers and tech crews! Having empathy is one thing. Saying that people need jobs no matter what is another.
  - techrat 12y ago
    What company do you work for so that we can thoroughly vet that you are not a part of any global conspiracies? If we do find something that could be a problem, you will be tried for crimes against humanity as a lowly employee trying to make ends meet. Everything you responded to me with btw, has nothing to do with Sony. Your strawman, burn it.

ploxiln 12y ago

Security is the ultimate technical debt. Most companies get super deep into this kind of debt, it's just not visible until they "get unlucky". I think it would be a good thing if companies, the industry, and everyday people were more aware of this concept (even if not with this terminology). I would guess that almost all companies have significant security deficiencies, which at least some of their engineers are aware of. It's just never a priority to work on, unless they've just been hacked. Their priority is always on product and marketing, and they have to compete with all the other companies not spending real engineering effort on security, after all. They're all just gambling on not being hacked to bad.

kafkaesque 12y ago

(Put on a big tinfoil hat) I'm doing some conjecturing here, but could hacking in the 21st century and cyber warfare be the new virtual/online 'rioting'? For example, Sony aides the US army since it is affiliated with Rockwell Collins and Future Combat Systems, so it would make sense if 'socialists', leftists, progressives, and anarchists seek to destroy conglomerates where they get a large chunk of their profit, disabling any funding of the US army, since the majority government's ideology does not align with theirs. Whether these 'minorities' are citizens of the targeted country or not, this group of intelligent people seem to be growing increasingly disenchanted by how things are being played out in the world. We see it among hackers in North Korea and the Middle East. Increasingly, Japan's racist past has been brought up in the media lately, yet Kazuo Hirai allowed a racist movie for the sake of comedy to be funded. (For those not in the know, Japan is going through a period of negationism with its politics being controlled by ultra conservatives). Post-Edward Snowden, it seems like there is very little hackers, developers, etc., can do that is not political or at least aiding or taking away from some socioeconomic issue. It's sad but it seems we are all somehow weakening the System or helping it. Sure, I'm not saying we should all worry about it. These are just the observations of an amateur.

gggeek 12y ago
Seems precisely the scenario of cyberpunk RPGs from the 90s

danielweber 12y ago

If Sony Pictures was going to be destroyed, I think there would be a bigger hit to their stock price.

grecy 12y ago

> to their employees having their privacy destroyed I'm always shocked at how concerned Americans are about the big bad wolf that is "identity theft". Is it really as bad as everyone thinks? In all honesty, when your info gets leaked, don't you just cancel every credit card and bank account, get a new SSN, change your drivers license number, change your phone number and a few other numbers and move on with your life? Is it honestly much different than losing your wallet full of cards? (which must happen to tens of thousands of people in the developed world daily) Does anyone have direct experience on what "identity theft" is actually like? (Honest question, I'm not American and I don't understand why it's such a big deal)

pdabbadabba 12y ago
The short answer is that it is very difficult (in many cases not possible) to get a new SSN.
BinaryIdiot 12y ago
> In all honesty, when your info gets leaked, don't you just cancel every credit card and bank account, get a new SSN, change your drivers license number, change your phone number and a few other numbers and move on with your life? That is an insane pain in the ass. In this day of age just changing a credit card number is a pain; now changing your phone number is a new level of pain in the ass. Not only that but it's hard to get a new SSN; I've known plenty of people who requested a new one due to their SSN leaking and unless you have proof of identity theft many of them were simply declined. Driver license numbers you typically don't need to change however. Almost all drive license numbers are generated simply based on your name (granted this depends on the state) so most of the time you can generate someone's number, accurately, just by knowing their name or a few other details about them. They're not really used to much.
- grecy 12y ago
  OK so it's a pain in the ass. That's not really that bad on the scale of things.
  - 12y ago