Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SonyPictures.com hacked, personal information and passwords compromised

pastebin.com

Post reply on HN
Print view View original

41–50 of 165 posts

Re: SonyPictures.com hacked, personal information and passwords compromised

#41

Post by rosser »

kevindication wrote: post #25
MediaBehavior wrote: post #11

Earlier quoted context omitted.

>...as many holes. But would you find most storing passwords in plain text? in 2011?

I had to stop a previous employer from doing just that in 2003. It was bad practice then, too. Big companies are just more susceptible to these kinds of short-cuts. Especially shortcuts with no clear benefit except to a lazy programmer. I remain pessimistic.

Failing to encrypt user passwords isn't a short-cut; it's an inexcusable and egregious failure — especially when it's done by a company that has the resources to do it right in the first place.

Re: SonyPictures.com hacked, personal information and passwords compromised

#42

Post by radicaldreamer »

mtw wrote: post #32
henrikschroder wrote: post #9

Earlier quoted context omitted.

http://en.wikipedia.org/wiki/Sony_Computer_Entertainment_Ame...

so why isn't there anything done against Apple? Apple's lawyers are on the back of anyone who makes white iPhone cases, jailbreakers, etc.

First, selling unofficial/unreleased parts with an Apple logo on them and jailbreaking are completely different. You can sell all the cases and backplates you want, but you can't start putting someone else's trademarks on them.

Second, Apple hasn't sued any jailbreakers.

Re: SonyPictures.com hacked, personal information and passwords compromised

#43

Post by dholowiski »

nborgo wrote: post #3

For those put off by the first 40 lines, here's the good part: "SonyPictures.com was owned by a very simple SQL injection, one of the most primitive and common vulnerabilities, as we should all know by now. From a single injection, we accessed EVERYTHING. Why do you put such faith in a company that allows itself to become open to these simple attacks? "What's worse is that every bit of data we took wasn't encrypted.…

Yikes - I believe in the PSN hack there was some question as to whether the passwords were encrypted or not. I'm glad it's out in the open for this one. Think we'll see Sony changing their name any time soon?

Re: SonyPictures.com hacked, personal information and passwords compromised

#45

Post by marcamillion »

Seems Sony really has kicked up the swarm with that GeoHot clamp down.

I am fairly certain that there are some executive meetings that are seriously questioning whether or not that initial action was wise.

I never thought this type of extortion could work, but Hot Damn. This is an effective campaign.

Talk about relentless!

Edit: This is really a losing battle for Sony. They are too big, there are too many vulnerabilities. They are too exposed. I know this sounds extreme, but are we witnessing the end of Sony as we know it ? It sounds ridiculous on the surface, but think about the distraction this has become. The billions of dollars of civil liabilities they are now open to, and this is not stopping any time soon. Talk about the perfect storm created by one anonymous group. Kinda insane, but also feels kinda cool....in a weird way. There is something liberating about a small group of 'anonymous' hackers taking on a Goliath of a corporation and winning. And I am a Capitalist to the core.

Although, the likely, annoying outcome of this is that this strengthens the hand of those that want a 'censored' Internet to prevent these types of things from happening. So this could very well lead to the end of the internet as we know it today. Also very hyperbolic, I know....but I believe it to be true.

Re: SonyPictures.com hacked, personal information and passwords compromised

#46

Post by smackfu »

ary wrote: post #2

At first it was embarrassing, now it's just absurd.

The question is whether Sony is really an outlier in terms of security, or if most big corps are getting by with security by obscurity (or no one cares about hacking them).

Re: SonyPictures.com hacked, personal information and passwords compromised

#47

Post by kbatten »

9999 wrote: post #28
pyre wrote: post #21

Earlier quoted context omitted.

If they didn't release the information: 1) Sony would just accuse them of lying and people (the general public) would just believe Sony over a bunch of anonymous hackers. 2) Change doesn't happen unless people get off their butts. This is a way to motivate that change. I don't necessarily agree with it, but you're talking as if there is no logic behind this other than recklessness.

The public is already predisposed to believing any hacking claims targeted at Sony at the moment. I wouldn't exactly frame their actions as reckless or lacking in logic either. How about malicious? I am particularly put off by this line: "This is disgraceful and insecure: they were asking for it." I get it, they have poor security, as a customer, this makes me really angry. But the general tone there is kind of simil…

This seems more comparable to a bunch of people finally ganging up to beat the shit out of a bully who had a history of treating weaker individuals badly.

Re: SonyPictures.com hacked, personal information and passwords compromised

#48

Post by 46Bit »

raganwald wrote: post #13
kevindication wrote: post #5

Earlier quoted context omitted.

Disagree on absurdity. I'm certain that if you focused enough eyes on any company with as much surface area exposed to the internet you'd poke just as many holes.

What's worse is that every bit of data we took wasn't encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it's just a matter of taking it. This is disgraceful and insecure: they were asking for it. I'm not sure that is true for any company with as much surface area. I would be extremely disappointed if it were true of any of Canada's five major banks, for example. Google has bee…

Banks hopefully encrypt them, but even a cursory glance when logging in to most nowadays shows they don't hash them (asking for individual characters). Or at least, you hope they aren't storing hashes of individual characters of your password ... even with salt.

Re: SonyPictures.com hacked, personal information and passwords compromised

#49

Post by evo_9 »

DrCatbox wrote: post #35
citricsquid wrote: post #16

http://twitter.com/#!/LulzSec/status/76388576832651265 Stay classy

Another imaginary currency. Very bad. Bitcoin is just another imaginary currency. But now its technofreaks imagining it, what a difference. A real adventure into economics and currencies would be to strive for a society with no currency, where people do things for the lulz. Not for the coins man.

Man are you a spook?

I don't get this anti-Bitcoin thing at all. I'm not for or against it, it's interesting tech for sure - fascinating even - and obviously polarizing to some. But I just don't get this attitude at all, at least amongst HN'ers.

Re: SonyPictures.com hacked, personal information and passwords compromised

#50

Post by sp332 »

kevindication wrote: post #5
ary wrote: post #2

At first it was embarrassing, now it's just absurd.

Disagree on absurdity. I'm certain that if you focused enough eyes on any company with as much surface area exposed to the internet you'd poke just as many holes.

Sony didn't even have a CISO before they shut PSN down.
Post reply on HN