Ramblings of an old Doc

 

Security disasters continue at Sony: They finally got Play Station Network back up and running after a series of hacks severely compromised it, only to have another Hacker group (LulzSec) compromise their SonyPictures servers and steal 1,000,000 customer accounts. It turns out that these accounts weren’t even encrypted!

What are the qualifications for getting a job in their IT Security Dep’t.? Knowing how to boil water without burning it?

You can see the hackers’ statement here.

They managed to get passwords, e-mail addresses, full home addresses, and dates of birth all by the simplest of methods: SQL injection.

“Sony Pictures accounts also have a number of opt-in features that contain further information about each user depending on what each signs up for. LulzSec state all of that detail was available to them. They also managed to get the details of all admin accounts for the website.” – Matthew Humphries, Geek.com

The Hackers also stole 75,000 music codes and 3.5 million music coupons.

So, I’m bringing this to you because if you’re a SonyPictures customer, you probably need to change passwords, and probably your Credit Card number as quickly as possible so that you don’t end up liable for debts run up as a result of their incompetence.

I wonder when this level of incompetence becomes legally actionable? Really: Wasn’t their PSN disaster enough to get them in gear?

Source:

http://www.geek.com/articles/geek-pick/sonypictures-com-hacked-one-million-user-accounts-compromised-2011062/


Comments (Page 4)
5 PagesFirst 2 3 4 5 
on Jun 04, 2011

Campaigner
I said that Sony getting hacked (and thus getting into trouble) is gleefully delighting because they mess with their users.

Two wrongs don't make a right....

on Jun 04, 2011

The reason they're being hacked/cracked (wtf-ever) is the same reason MS and it's products get it, and now it's starting for Apple as well: FOLLOW THE MONEY: In other words "shoot at where the most targets congregate". That way the most is gotten for the least effort (the principle guiding hackers/crackers lives).

These are nothing but criminals whom vulnerable people misidentify as heroes. They (the hackers/crackers) are in fact narcissistic, manipulative parasites.

on Jun 04, 2011

I love labels.

They do wonders as they are not only used to create divisiveness among us, but are subjective and purely relative in that they are not absolute.

So are the criminals the ones who do wrong against the system?  Or are the criminals actually the ones who created the system in the first place?

If the label 'criminal' can be interchangeable within two parties, then so would the term 'heroes'.  Glorify the evil-doers?  Who would imagine such a thing?  Well, that is exactly what we have been conditioned to do....and are doing.

I've been asked to not bring up religion in these forums.  I actually don't "bring it up", but you people do that without me.  I simply call it for what it is and make reference to the most likely etiological basis for certain related concepts.  But little do most of you people realize, that the topics/concepts, whether openly mentioned verbatim here or not, are wholly credited as being created by religion.

These thought-formers have given us a system which we have come to perceive as just, ethical and real.  The system gives us the perception of having the potential in material worth (i.e., how we measure ourselves against others...... often at the expense of others; ie narcissism, the underlying attribute of all who engage in commerce) and this in turn is used to keep us at odds with each other, not to mention the multitude of languages the thought-formers have created and the laws they have written to further divide/suppress all of humanity.

We are all parasites in this system.

"Reality", it seems, is the only word in the human language that should always be used in quotes.

-.-

on Jun 04, 2011

How many sociologists does it take to change a light globe?

Just one...but the light globe has to WANT to change....

on Jun 04, 2011

aeligos
"Reality", it seems, is the only word in the human language that should always be used in quotes.

....and "sanity" is an attribute that cannot be presumed.

on Jun 04, 2011


Quoting aeligos, reply 48"Reality", it seems, is the only word in the human language that should always be used in quotes.

....and "sanity" is an attribute that cannot be presumed.

Authority leads to deference.

Deference leads to consensus.

Consensusism kills the soul.

Is non-conformity and freethinking a psychiatric illness?  According to the DSM-IV (Diagnostic and Statistical Manual of Mental Disorders), it is.

The DSM-IV is the manual used by psychiatrists to diagnose mental illnesses and compared to the 1950's, the manual has grown in size.  Are we really becoming sicker as a human race?  Is this a consequence of unidentified toxins, synthetic or otherwise?

New mental illnesses identified by the DSM-IV include arrogance, narcissism, above-average creativity, cynicism, and antisocial behavior.  In the past, these were called “personality traits,” but now they’re criteria for certain mental diseases.  And guess what?  Oh, and "treatments" are available, at least for a few generations until the synthetic toxins get black-box warnings after a few generations of exposure.

In the last 50 years, the DSM-IV has more than doubled in the number of psychiatric illnesses.  A majority of these illnesses happen to afflict children.  Although the manual is an important diagnostic and coding tool for the psychiatric industry, it has also been responsible for social changes; ie social engineering, hence the targeting of children.

The rise in ADD, bipolar disorder, and depression in children has been largely because of the manual’s identifying certain behaviors as symptoms.  A Washington Post article noted that, if Mozart were born today, he would be diagnosed with ADD and “medicated into barren normality.”  And we wonder why there are no great philosophers in our era.

Therefore "sanity" is designated and conferred so long as one keeps on track with the established format.

-.-

on Jun 04, 2011

DrJBHL
The reason they're being hacked/cracked (wtf-ever) is the same reason MS and it's products get it, and now it's starting for Apple as well: FOLLOW THE MONEY: In other words "shoot at where the most targets congregate". That way the most is gotten for the least effort (the principle guiding hackers/crackers lives).

These are nothing but criminals whom vulnerable people misidentify as heroes. They (the hackers/crackers) are in fact narcissistic, manipulative parasites.

Seem that you don't understand the meaning of Hackers... maybe some quote will help :

"A community of enthusiast computer programmers and systems designers, originated in the 1960s around the Massachusetts Institute of Technology's (MIT's) Tech Model Railroad Club (TMRC) and MIT Artificial Intelligence Laboratory. This community is notable for launching the free software movement. The World Wide Web and the Internet itself are also hacker artifacts. The Request for Comments RFC 1392 amplifies this meaning as "a person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular.""

"The hobbyist home computing community is focusing on hardware hacking since the late 1970s. The community included Steve Jobs, Steve Wozniak and Bill Gates and created the personal computing industry."

Hacking is not illegal... in fact, in country like Holland, it is legal by law... since the 90s, due to the media who have use the word Hacker in place of Cracker, usual people have mix the two... if you have read fully the first link from my previous post, in the Q&A section, you can read :

Q:

Would you help me to crack a system, or teach me how to crack?

A:

No. Anyone who can still ask such a question after reading this FAQ is too stupid to be educable even if I had the time for tutoring. Any emailed requests of this kind that I get will be ignored or answered with extreme rudeness.

Q:

How can I get the password for someone else's account?

A:

This is cracking. Go away, idiot.

Q:

How can I break into/read/monitor someone else's email?

A:

This is cracking. Get lost, moron.

Q:

How can I steal channel op privileges on IRC?

A:

This is cracking. Begone, cretin.

 

Linux is build by Hackers, people with high understanding of hardware who allow them to create Linux driver for these hardware... Mono is a .Net hack... Moonlight is a hack of Silverlight... Wine is a windows hack... well, there is plenty of example... none of them illegal... it is only hacker who create new and original code who emulate the functionality of already existing code who is not open source...

In fact, long time ago, with my first computer ( a sinclair ZX-80 ), some hacking skill was needed since the computer was only a bunch of electronic element that you need to assemble yourself...

On the other side, cracking is illegal... unless you are a "white hat"... someone working for a official security business who test the security from other business on request.

Let's take a car for example... the Hacker will be the guy who know enough about your car for tune it for a rally competition and allow you to win... the Cracker will be the guy who know just enough of the car for rip the cable below your dashboard, start the car and steal it...

Other example, i am a member from a modding group related to a Stardock game called "sins of a solar empire"... in fact, modding is in some way like hacking the game... learn enough about it's internal for create mod who add new feature/material... something perfectly legal... A cracker will remove security feature from the game, allowing people who have not purchase the game to use it... something totally illegal...

By mixing the two words, you are insulting thousand if not million of programmer, modders, and more who have made nothing illegal !!! Yes, Cracker claim to be Hacker for look like the "white knight" when in fact they don't follow any of the Hacker ethic... Somehow, it is like the few thousand Muslim terrorist who claim to speak/act for the million's of other Muslim...

on Jun 04, 2011

@ Doc

Who said anything about having to "crack" said encryption.  Encryption data is often very accessible from within so once the attacker is inside the organization there is often no longer a need to crack anything.  Like I said, good hackers can compromise your system, reside there for months while they go digging through your things until they find the keys needed to access whatever it is they want.  That was the point of posting reply #22.  All encryption does is make hackers have to stick around longer in your systems.  While it may sound dangerous for the hacker to do that, many organizations are ill-equipped to handle/run full penetrations sweeps on say a daily basis (not that those types of sweeps guarantee security anyway).

 

 

@ Tridus

 

Tridus
You're wrong. Passwords should be hashed so that when you get them, they're not usable. This isn't some kind of esoteric super-bizzare requirement that only the NSA uses. It's standard industry best practice that even open-source forum software does. Second year CS students know it. There is never a valid excuse for not doing it.

Sure.  But who uses passwords these days for things other than logins that aren't used 10,000 times a day?  Certificates and keys can be intercepted (often with relative ease) once an attacker is actually within (the proverbial) walls of your organization.  Hence my comments.

 

Tridus


No it's not, and claiming it is doesn't make it so. While it is bordering on impossible to stop the most professional and advanced criminal operations (see Syria, or Operation Aurora against Google), these guys aren't that. You CAN stop random script kiddies who only know how to do what is #1 on the top 10 vulnerability list. These guys could have been thwarted if somebody at Sony wasn't dangerously incompetent.

What you're saying is the online equivalent of "the CIA can get into my house if they really want to, so locks on the doors are a waste of time." And that's what happened here. Sony left the front door open and a pile of gold sitting in it, and is now upset that someone stole it. That doesn't justify the criminals, but they didn't exactly put much effort into protecting themselves. If a bank left themselves open like this and lost peoples money, you wouldn't hear people going "oh that poor bank!" You'd have an army of lawyers suing for negligence to get peoples money back.

 

Hell, the only way this thing could have been easier to attack is if it was setup as a honeypot.

 

That's not at all what I'm saying.  Re-read my original post (reply #22) where I say the best "security" anyone can really hope for (personal or corporate) is to make themselves the least desirable target.  Once you become a TARGET for whatever reason there remains little anyone can hope for in terms of protection from catastrophe.  That was and still remains my point, a point which is proven over and over all over this world.

 

on Jun 04, 2011

There is a duty of care when a corporation collects an individual's information.
Once gathered, it's their responsibility to protect their clients personal information. They should do what is reasonable to protect it.

When you have Sony, which is a multi-billion dollar corporation, who collects personal information from millions and uses this information for their own benefit. Who is a technology company which makes a profit from network services ... and then gets hacked. The question has to be asked if they set up security worthy of their resources and if they have systems in place to prevent harm to their clients.

on Jun 05, 2011

I don't think that I can think of 1 company that did not put profits ahead of client safety. The only time safety comes into the equation is how much will the law suits cost and lost customers vs protecting clients. Just look at the Car Industries safety record.

In 1965, consumer activist Ralph Nader published "Unsafe at any Speed," a blistering attack on the GM's Corvair compact car.

That prompted Congressional investigations into the industry as a whole, culminating in the National Highway Traffic Safety Act in 1966. The stage was set for a regime of safety regulation that continues to this day.

Within two years of the act's passage, cars were required to have safety belts with shoulder harnesses. That paid off in the coming years: As U.S. states gradually began making belt-use mandatory in 1984, accident injuries and fatalities declined. http://autos.aol.com/article/car-safety-history/

Car companies (except Volvo) had to be made to put in safety features with legislation. This practice of safety last continues today with any product.

on Jun 05, 2011

When I use the term Hacker it is meant in the popular (not complementary) way. If you choose to apply some other meaning and take insult, that's your problem. It's a word/terminological/rhetorical debate anyway, since you understand what I meant.

If you use the term hack instead of mod, you invite misunderstanding: You probably hate when a doctor uses medical jargon when he/she tries to explain something to you, right? Same here.

If a person does an illegal activity in search of gain, he is a criminal.

If a person uses skills which would be otherwise employable to further an illegal 'career', he has a personality disorder.

If the_Monk is correct, and he very well may be, the person is a parasite as well as criminal. They can defeat a body's defenses, but eventually they can be found and destroyed. It may very well be true that perfect defense is impossible, but that does not justify sub standard IT security practices. Why not just publish all the data and save the wtf-evers the time and trouble?

I say a company which harbors your data has an obligation to defend it by using the best possible software/hardware and isolation methods. If they do less, and can be proven to have done less, then they are negligent and culpable. The victims should then be compensated, and the perpetrators punished.

What's wrong with that? 

on Jun 05, 2011

DrJBHL
I say a company which harbors your data has an obligation to defend it by using the best possible software/hardware and isolation methods. If they do less, and can be proven to have done less, then they are negligent and culpable. The victims should then be compensated, and the perpetrators punished.

What's wrong with that? 

I can agree with that but what happens when a company is cracked and then they hide it to protect themselves which they will try. Who will be in charge of overseeing if the company is negligent. Do consumers only have a "wait and see" policy or should there be legislation to make companies conform to curtain standards of protection. I don't like the fix it after its already done and would much rather a you make damn sure this can't happen.

on Jun 05, 2011

myfist0
Quoting DrJBHL, reply 56I say a company which harbors your data has an obligation to defend it by using the best possible software/hardware and isolation methods. If they do less, and can be proven to have done less, then they are negligent and culpable. The victims should then be compensated, and the perpetrators punished.

What's wrong with that? 

I can agree with that but what happens when a company is cracked and then they hide it to protect themselves which they will try. Who will be in charge of overseeing if the company is negligent. Do consumers only have a "wait and see" policy or should there be legislation to make companies conform to curtain standards of protection. I don't like the fix it after its already done and would much rather a you make damn sure this can't happen.

The laws governing data protection depend on where (location - ie, country), and type of data (HIPAA vs non health care) and on and on... it is fragmented and difficult to in terpret. Of course. Well there should be a unified law (here), but what can we do about data storage abroad... one of the big "Cloud" security problems: Physical Security (ie machines being stolen) and hack/crack type problems. What can the USA do about stuff stored elsewhere? Also, expect companies to search for cheap solutions and doing it abroad might make it easier and cheaper... I don't know. As for closing the barn door after the horses are gone? Obviously opening the umbrella before the rain starts keeps one drier.

on Jun 05, 2011

DrJBHL
Obviously opening the umbrella before the rain starts keeps one dryer.

A 'dryer' is one of those bits of white-goods in your laundry ......not the one that cleans stuff....the other one.

'drier' is what your clothes become when that white-good is used ....

If they aren't 'drier' you probably have them in the wrong one...and they're now wetter.

....but cleaner.

 

I hope we have that all tickety-boo, now ....

on Jun 06, 2011

starkers
That, to me, is no better than home invasion because Sony used covert means to invade his PS3 console... they entered without consent.

It actually is the same (and against the law in the US).  However it is considered civil law (Sosumi), and unfortunately the big recording companies have lots of lawyers whose only job is to argue these cases in court (in other words, you would probably not win).

starkers
The forced update that changed his user experience was encoded into the disc of a new game he'd purchased.

Here's where they will probably get you.  Did he read the EULA?  It probably states they can do just that.  I doubt many would agree to the EULAs if they really read them, and that is what the recording companies hope for.  Unfortunately, about the only recourse is to boycott them.

5 PagesFirst 2 3 4 5