Sony Japan hacked by SQL injection • Hacker News Board

Re: Sony Japan hacked by SQL injection

#11

Post by JoachimSchipper » Tue, May 24, 2011, 1:53 PM UTC

andrewcooke wrote: post #6

the example in the link (the image of the "hack") isn't sql injection - it's just reading a database table through the appropriate api. the more detailed info at http://www.thehackernews.com/2011/05/lulzsec-leak-sonys-japa... again doesn't show any injection. all they are doing is reading the contents of various tables through a simple (REST-like) API/URL. ["IT security blog of the year" and they don't know what inje…

It seems to work as designed, but its design is pretty stupid - it's arguably still a hole.

I'm with you on the "experts" though.

Re: Sony Japan hacked by SQL injection

#12

Post by stcredzero » Tue, May 24, 2011, 2:37 PM UTC

jbk wrote: post #4

And once again, a proof that to take security seriously, you need to have a security culture and policy in your whole company. Else, many small Business Units of your International MegaCorp, who won't have the knowledge or the culture of security, will not care enough and might get hacked, in a way or another...

in a way or another...

In a way that you can eliminate using straightforward technical fixes.

Re: Sony Japan hacked by SQL injection

#13

Post by jlind » Tue, May 24, 2011, 2:56 PM UTC

andrewcooke wrote: post #6

the example in the link (the image of the "hack") isn't sql injection - it's just reading a database table through the appropriate api. the more detailed info at http://www.thehackernews.com/2011/05/lulzsec-leak-sonys-japa... again doesn't show any injection. all they are doing is reading the contents of various tables through a simple (REST-like) API/URL. ["IT security blog of the year" and they don't know what inje…

Security hole or not, Sony clearly has a whole lot of negative momentum in regards to security. Sony are already estimating $171m loss for as a result of the PSN outage[1].

[1]http://www.joystiq.com/2011/05/23/psn-breach-and-restoration...

Re: Sony Japan hacked by SQL injection

#14

Post by swaits » Tue, May 24, 2011, 3:45 PM UTC

pseudonym wrote: post #5

I'm actually kind of curious about this now. Right now this is hack...5? against something under the Sony umbrella. 1. Just because it's got "Sony" in the name, how related are these, really? Does Sony actually have a hand in all of them, or were they just random companies that were acquired and picked up the "Sony" brand name, instead of keeping their own and saying "Owned by X", like (for example) Blizzard and Acti…

They're all under the Sony umbrella, but Sony Music, Sony Pictures, Sony Computer (PlayStation), Sony Online (Everquest, etc.), and Sony Electronics (TVs, etc.) are all indeed separate companies. And, there are separate companies based on region; Sony Computer Entertainment America, Sony Computer Entertainment Japan, etc.

Re: Sony Japan hacked by SQL injection

#15

Post by WettowelReactor » Tue, May 24, 2011, 3:59 PM UTC

pseudonym wrote: post #5

I'm actually kind of curious about this now. Right now this is hack...5? against something under the Sony umbrella. 1. Just because it's got "Sony" in the name, how related are these, really? Does Sony actually have a hand in all of them, or were they just random companies that were acquired and picked up the "Sony" brand name, instead of keeping their own and saying "Owned by X", like (for example) Blizzard and Acti…

I was at a CIO conference a few weeks ago (just after PSN went down) and the Sony reps there stated that Sony was undertaking a massive effort to centralize all their servers across divisions into one group in a cost saving measure. Not sure how accurate that info is but it may be a contributing factor to these problems.