Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SonyPictures.com hacked, personal information and passwords compromised

pastebin.com

Post reply on HN
Print view View original

91–100 of 165 posts

Re: SonyPictures.com hacked, personal information and passwords compromised

#91

Post by mtw »

abronte wrote: post #33
mtw wrote: post #32

Earlier quoted context omitted.

so why isn't there anything done against Apple? Apple's lawyers are on the back of anyone who makes white iPhone cases, jailbreakers, etc.

Apple has gone after jailbreakers? Thats news to me. Geohot has hacked (as far as I know) almost every iDevice Apple has put out, but Apple didn't take him to court because of it.

I didn't say that Apple took them to court. http://www.wired.com/threatlevel/2009/07/jailbreak/ I am just saying that Apple is using every means available to them to prevent other people using their software or hardware in a different way.

Re: SonyPictures.com hacked, personal information and passwords compromised

#92

Post by 9999 »

shubble wrote: post #77
9999 wrote: post #28

Earlier quoted context omitted.

The public is already predisposed to believing any hacking claims targeted at Sony at the moment. I wouldn't exactly frame their actions as reckless or lacking in logic either. How about malicious? I am particularly put off by this line: "This is disgraceful and insecure: they were asking for it." I get it, they have poor security, as a customer, this makes me really angry. But the general tone there is kind of simil…

That's sort of like saying that software piracy is theft. Blaming victims for rape is dangerous because it discourages victims from coming forward, and adds to intense feelings of shame and guilt that come with sexual violation. It also tends to come with suggestions that women should restrict their behavior, not seeking to be attractive or acting in 'risky' stereotypically male ways. Criticizing a cooperation for fa…

I probably should not have used rape as the example there. What I was really trying to convey is that a crime was committed, and the perpetrators have set things up to shift the public's blame to Sony.

Re: SonyPictures.com hacked, personal information and passwords compromised

#93

Post by n09n »

daimyoyo wrote: post #83

I've said this before and I'll say it again: Sony is facing a highly skilled group of hackers that have made it their mission to ruin the company. If you have sensitive data with any of Sonys products, I'd advise you to delete it ASAP. This is not going away. Sony will be fighting attacks like this for years to come and they have only themselves to blame.

That may or may not be true, but this particular attack shows no evidence of skill, and they admit as much in the original link.

Re: SonyPictures.com hacked, personal information and passwords compromised

#94

Post by kristofferR »

pkulak wrote: post #86
marcamillion wrote: post #45

Seems Sony really has kicked up the swarm with that GeoHot clamp down. I am fairly certain that there are some executive meetings that are seriously questioning whether or not that initial action was wise. I never thought this type of extortion could work, but Hot Damn. This is an effective campaign. Talk about relentless! Edit: This is really a losing battle for Sony. They are too big, there are too many vulnerabili…

What the hell did they do that got people so pissed off?

Sue a bunch of people for re-enabling Linux and enabling homebrew on the PS3

Re: SonyPictures.com hacked, personal information and passwords compromised

#95

Post by nitrogen »

pkulak wrote: post #86
marcamillion wrote: post #45

Seems Sony really has kicked up the swarm with that GeoHot clamp down. I am fairly certain that there are some executive meetings that are seriously questioning whether or not that initial action was wise. I never thought this type of extortion could work, but Hot Damn. This is an effective campaign. Talk about relentless! Edit: This is really a losing battle for Sony. They are too big, there are too many vulnerabili…

What the hell did they do that got people so pissed off?

Just in case you really don't know, the various branches of Sony have demonstrated technological contempt for [their] customers for years. I'll omit their insistence on promoting their own products over other standards and general push for increased DRM, such as Minidisc/ATRAC, Blu-ray, etc. and focus on their actual attacks.

It started with the CD root kit fiasco, in which music CDs distributed by Sony infected Windows PCs with software designed to prevent the ripping of music CDs to the computer, which also contained exploitable holes used by malware to infect computers.

Sony then removed the Other OS (e.g. Linux) feature from the new version of its PS3 consoles. This wasn't too egregious, but next they retroactively removed Other OS from older consoles that originally supported it. That upset a lot of people.

Along came GeoHot, a reverse engineer determined to get Other OS back, and no doubt other less-outspoken hackers. So he and the others did, and along with it recovered Sony's private key used to sign PS3 software, allowing Linux to access all the hardware of the PS3, as well as running other homebrew software.

Less-scrupulous individuals, not including GeoHot himself, used the aforementioned work to run pirated software on the PS3. This upset Sony.

The straw that broke the camel's back, though, was Sony suing GeoHot into oblivion (I personally suspect they also astroturfed gaming sites to get GeoHot's hack associated with cheaters at Call of Duty, which it was not). This is the final event that triggered the misguided but potent onslaught of attacks against any and all Sony properties.

References:

https://secure.wikimedia.org/wikipedia/en/wiki/Sony_BMG_copy...

https://secure.wikimedia.org/wikipedia/en/wiki/PlayStation_3...

[Edit: fixed botched pronoun after partial sentence rewrite]

Re: SonyPictures.com hacked, personal information and passwords compromised

#96

Post by kristofferR »

benedikt wrote: post #82
nborgo wrote: post #3

For those put off by the first 40 lines, here's the good part: "SonyPictures.com was owned by a very simple SQL injection, one of the most primitive and common vulnerabilities, as we should all know by now. From a single injection, we accessed EVERYTHING. Why do you put such faith in a company that allows itself to become open to these simple attacks? "What's worse is that every bit of data we took wasn't encrypted.…

I noticed that they are willing to give away passwords, but not willing to point out the SQL injection.

They did, just in a seperate file

http://www.sonypictures.com/homevideo/ghostbusters/photouplo...

http://lulzsecurity.com/releases/sownage_FILE%20CONTENTS.txt

Re: SonyPictures.com hacked, personal information and passwords compromised

#97

Post by forensic »

daimyoyo wrote: post #83

I've said this before and I'll say it again: Sony is facing a highly skilled group of hackers that have made it their mission to ruin the company. If you have sensitive data with any of Sonys products, I'd advise you to delete it ASAP. This is not going away. Sony will be fighting attacks like this for years to come and they have only themselves to blame.

It's not about skill, it's about motivation.

Cracking big company stuff is more about persistence than about skill.

Skilled hackers are bored by SQL injection attacks.

What Sony has done is give thousands of bored teenagers a reason to hate them.

Re: SonyPictures.com hacked, personal information and passwords compromised

#98

Post by bigiain »

daimyoyo wrote: post #83

I've said this before and I'll say it again: Sony is facing a highly skilled group of hackers that have made it their mission to ruin the company. If you have sensitive data with any of Sonys products, I'd advise you to delete it ASAP. This is not going away. Sony will be fighting attacks like this for years to come and they have only themselves to blame.

I don't know that deleting it will do much good. Most web apps for performance reasons don't actually do a delete against the database, rather mark a record as deleted and perhaps run a batch job later to clean deleted records from the database. If you've got access to the database via SQL injection, you'll have access to all those "deleted" records as well. Even of you go through the website and update each field with empty, anonyomoua, or incorrect data; I suspect there's a high chance of backups being available to anyone who's 0wned their servers...

My advice would be to assume any data Sony has about you is already in the hands of attackers, and do whatever you can to minimize the usefulness of that to the attackers (which largely means ensure the password you used at any Sony site isn't useable anywhere else online)

Re: SonyPictures.com hacked, personal information and passwords compromised

#99

Post by jerryr »

Hey, I'm curious whether my information was compromised in this attack, but I'm too lazy to figure out how to figure out whether it was. If someone has downloaded the released data and is looking for a weekend project (and the weekend's coming up), I'd love a site that lets me easily determine whether I'm affected.

Re: SonyPictures.com hacked, personal information and passwords compromised

#100

Post by 9999 »

pkulak wrote: post #86
marcamillion wrote: post #45

Seems Sony really has kicked up the swarm with that GeoHot clamp down. I am fairly certain that there are some executive meetings that are seriously questioning whether or not that initial action was wise. I never thought this type of extortion could work, but Hot Damn. This is an effective campaign. Talk about relentless! Edit: This is really a losing battle for Sony. They are too big, there are too many vulnerabili…

What the hell did they do that got people so pissed off?

A well known cracker named George Hotz (GeoHot), best known for iPhone jailbreaking, began to target the PS3's security to enable full access to the PS3's graphics capabilities via the Linux install option that the PS3 originally shipped with. Sony was concerned that that would enable piracy, so they removed the Linux install option in a firmware update.

If you refused to install that firmware update, you could continue using your PS3 with that Linux installation, but you wouldn't be able to play new games or potentially play online. Basically, compute clusters that relied on that install continued working, and continue to work today.

The removal of that option incensed many PS3 purchasers, tech writers, hackers, etc. George Hotz then went on to crack the PS3's security anyway, enabling arbitrary code to run on the device (including applications that would let you run pirated PS3 games). Sony sued Hotz, ostensibly because he enabled massive piracy. This further incensed varied and sundry "hacking" organizations which began to target Sony. Eventually, Sony dropped the case against Hotz, for reasons that are difficult to discern (bad publicity for the most part). At this point, various hacking groups were able to penetrate the Playstation Network as well as many other Sony properties, resulting in hundreds of millions of dollars of lost income at this point.

Post reply on HN