3 ms·

I work in VFX, and its a little bitter sweet to see Sony entertainment on its knees. First, various people like sony have been forcing VFX houses to go through

I work in VFX, and its a little bitter sweet to see Sony entertainment on its knees. First, various people like sony have been forcing VFX houses to go through draconian security changes to stop this kind of threat. (supposedly because one of us leaked expendables 3, despite none of us having the complete movie or sound) These rules include three separate zones, of which only one has access to the internet. All USB storage is disabled. All internet access must go through a terminal server. (all our phonehome services for disks now don't work) All data must go through a purgatory like intermediate stage, for the data ops guys to move out to the "outside" zone, for upload to studios. We then have monitors to look at the data flow, to see if wierd stuff is happening. So if they'd followed the MPAA's own advice none of this would have happened, unless of course it was an inside job. Which in my mind there is little doubt.

millerc 12y ago
If anything you should thank them for forcing on you the very measures that might have saved your business. But of course, conspiracy theories and big companies being unfair against the nineteny-nine-percent, are all much more newsworthy than reality. Hence goes my last post on HN. I'll come back when - if - reason someday prevails over sensationalism.
- beedogs 12y ago
  Well, bye then. Pfft.
- icantthinkofone 12y ago
  Completely agree.
- KaiserPro 12y ago
  Whilst I agree that following security best practices is important, I think you miss the point of my post. WE are implementing the rules they drew up. From what I can see they did not.
- deleted 12y ago
  [deleted]
- deleted 12y ago
  [deleted]
- adamb_ 12y ago
  Your melodramatic announcement of no longer participating in HN discussions directly contradicts your desire for reason to prevail over sensationalism.
berkut 12y ago
This has happened at plenty of places! Ever worked on a Marvel film? They're insane about security - only certain parts of the studio are actually allowed access to that show's dailies, assets, etc.
- KaiserPro 12y ago
  Yup. Turning off the internet made me very sad.
  - berkut 12y ago
    That's only the case for lighting and comp for us. The earlier stages (Assets, texturing) need internet for reference :)
funkdobiest 12y ago
I can confirm this is industry wide when dealing with the big movie companies. I work in the big data industry and we have several of those clients under the MPAA and have had to go through multiple security audits just for their business.
- jrockway 12y ago
  What kind of security things do they require? Stuff like using two factor authentication? (Not storing passwords in a spreadsheet would also be good, but they clearly don't require that ;)
  - KaiserPro 12y ago
    Oh no, they require that. but thats difficult to enforce. Strick AD password, account lockouts after n attempts, password rotations every 90 days. The internet must have an air gap between it and the "production" network. So that means internet in terminal server clients. (we used to be able to get away with VLANs, and just have a clientside VM on a different VLAN) No automated mechanism to move data between the "production" network and the outside world. Any data that needs transporting must be accounted for (and that's literally terabytes a day.)
dba7dba 12y ago
You are assuming Sony really cared about MPAA's advise. My bet is that while Sony was forcing other vendors to follow draconian security measure, they themselves had very lax security. Keeping SSN of 3000+ employees in a non-encrypted excel file? That alone tells me Sony didn't have tight enough security, hence hack by outside (teenagers or N Korea) is more likely. Things like this happen all the time, where a big company/org tells vendors to follow some rules while they themselves ignore them. All the time.
- KaiserPro 12y ago
  Naa, Sony couldn't give a shit about security, it was a cost that they thought wasn't worth bearing. Its the same as any other company. The problem is that a lot of the first release stuff came from HR. As we all know HR types rarely understand computers, let alone security. Even if they had a password repo that was super secure, it would be easier for them to share a spreadsheet, so they'll do that instead. For all we know, Sony could have had fairly tight security. From my understanding there were hefty ACLs to stop various sides of the business talking to each other. Yet these were still breached, for a long time and lots of data seeped across. The way the malware was written, and the actions of the hacker(s) leads me to suggest that this was an inside job. It is very had to sneak out large amounts of data, and fiddling with change control whilst not being detected is very difficult. Unless you know how to imitate the normal ebb and flow of work life. The problem SPE have now is that they'll have to throw away everything and start from scratch. All previous data will have to be quarantined, all infrastructure from the server, switches, printers to the workstations will have to be disposed of. Why? because there is no way of proving that there isn't any malware still embedded.
wahsd 12y ago
I thought you were going to say "Supposedly because one of us leaked expendables 3, despite none of us having any desire see it"
rebootthesystem 12y ago
We did image processing for movie applications many years ago. The studios sent armed guards with the data tapes. They had instructions to remain with the tapes until the job was done. That often meant 16 hour days. Intimidating but a rather false sense of security. I am sure they are far more sophisticated today.

millerc 12y ago

If anything you should thank them for forcing on you the very measures that might have saved your business. But of course, conspiracy theories and big companies being unfair against the nineteny-nine-percent, are all much more newsworthy than reality. Hence goes my last post on HN. I'll come back when - if - reason someday prevails over sensationalism.

beedogs 12y ago
Well, bye then. Pfft.
icantthinkofone 12y ago
Completely agree.
KaiserPro 12y ago
Whilst I agree that following security best practices is important, I think you miss the point of my post. WE are implementing the rules they drew up. From what I can see they did not.
deleted 12y ago
[deleted]
deleted 12y ago
[deleted]
adamb_ 12y ago
Your melodramatic announcement of no longer participating in HN discussions directly contradicts your desire for reason to prevail over sensationalism.

berkut 12y ago

This has happened at plenty of places! Ever worked on a Marvel film? They're insane about security - only certain parts of the studio are actually allowed access to that show's dailies, assets, etc.

KaiserPro 12y ago
Yup. Turning off the internet made me very sad.
- berkut 12y ago
  That's only the case for lighting and comp for us. The earlier stages (Assets, texturing) need internet for reference :)

funkdobiest 12y ago

I can confirm this is industry wide when dealing with the big movie companies. I work in the big data industry and we have several of those clients under the MPAA and have had to go through multiple security audits just for their business.

jrockway 12y ago
What kind of security things do they require? Stuff like using two factor authentication? (Not storing passwords in a spreadsheet would also be good, but they clearly don't require that ;)
- KaiserPro 12y ago
  Oh no, they require that. but thats difficult to enforce. Strick AD password, account lockouts after n attempts, password rotations every 90 days. The internet must have an air gap between it and the "production" network. So that means internet in terminal server clients. (we used to be able to get away with VLANs, and just have a clientside VM on a different VLAN) No automated mechanism to move data between the "production" network and the outside world. Any data that needs transporting must be accounted for (and that's literally terabytes a day.)

dba7dba 12y ago

You are assuming Sony really cared about MPAA's advise. My bet is that while Sony was forcing other vendors to follow draconian security measure, they themselves had very lax security. Keeping SSN of 3000+ employees in a non-encrypted excel file? That alone tells me Sony didn't have tight enough security, hence hack by outside (teenagers or N Korea) is more likely. Things like this happen all the time, where a big company/org tells vendors to follow some rules while they themselves ignore them. All the time.

KaiserPro 12y ago
Naa, Sony couldn't give a shit about security, it was a cost that they thought wasn't worth bearing. Its the same as any other company. The problem is that a lot of the first release stuff came from HR. As we all know HR types rarely understand computers, let alone security. Even if they had a password repo that was super secure, it would be easier for them to share a spreadsheet, so they'll do that instead. For all we know, Sony could have had fairly tight security. From my understanding there were hefty ACLs to stop various sides of the business talking to each other. Yet these were still breached, for a long time and lots of data seeped across. The way the malware was written, and the actions of the hacker(s) leads me to suggest that this was an inside job. It is very had to sneak out large amounts of data, and fiddling with change control whilst not being detected is very difficult. Unless you know how to imitate the normal ebb and flow of work life. The problem SPE have now is that they'll have to throw away everything and start from scratch. All previous data will have to be quarantined, all infrastructure from the server, switches, printers to the workstations will have to be disposed of. Why? because there is no way of proving that there isn't any malware still embedded.

wahsd 12y ago

I thought you were going to say "Supposedly because one of us leaked expendables 3, despite none of us having any desire see it"

rebootthesystem 12y ago

We did image processing for movie applications many years ago. The studios sent armed guards with the data tapes. They had instructions to remain with the tapes until the job was done. That often meant 16 hour days. Intimidating but a rather false sense of security. I am sure they are far more sophisticated today.