Print 57 comment(s) - last by Uniprint QLD.. on Jun 2 at 11:21 PM

Sony has proven itself to be utterly inept when it comes to security.  (Source: AFP)
Holy hacking, Batman, these guys are clueless!

The display of security incompetence Sony Corp. (6758) is astonishing.  Weeks after losing the contents of its two largest databases -- the PlayStation Network (PSN) database and the Sony Online Entertainment (SOE) database -- the company appears to have lost yet more information after experiencing an attack almost identical to one just days prior.

I. Sony Fails to Block Identical Attack

On Sunday, The Hacker News revealed that Sony BMG Greece (the Greek unit of the company's music branch) was hacked using an SQL injection attack and lost 8,000+ customer records.

It now appears that just days later a group called LulzSecurity -- known for formerly hacking's login database -- has used an injection attack to compromise databases on Sony BMG Japan.

Astonishingly, Sony appears to have done little to nothing in the way of escaping or parameterization to protect its databases, even in the wake of the SQL injection breach of its Greek property.

The hackers accessed an on-site tablet that did not appear to contain any personally identifiable information.  They openly mocked Sony, posting to Twitter, "LOL @Sony, Nice Japanese website dumbasses (sic)."

They later posted, "This isn't a l337 h4x0r, we just want to embarrass Sony some more.  Can this be hack number 8? 7 and a half?!"

While the hack itself was obviously just designed to target Sony and not hurt its customers, the hackers did post publicly that there was two other databases on the site that they did not look at, but should be accessible using the injection attack.

This message was likely up for hours -- at least -- before Sony heard about it and shut down access to its servers.  In the meantime it's very feasible that other users -- including outright malicious ones -- could have stolen information from these tables.  As tables on the Sony BMG Greece website contained users' names, passwords, etc. it's quite possible that one of these tables held similar information, and you can almost guarantee that there would be many more records than in the Greece table, as Japan is Sony's home nation.

II. Sony Intrusion Send Clear Message to Customers -- You Can't Trust Sony

Sophos Security researcher Chester Wisniewski , who yesterday took a gentler tone when covering the Greece intrusion, this time firmly admonished Sony, writing:

While there is an enormous target on Sony's back as a result of these very public attacks it is unclear why this is happening. Is Sony taking security seriously or are there simply so many flaws from the past that exist in their public facing sites that it will take them a long time to patch them all?

I hope this is the last time I have to report on a flaw at Sony. Sony has announced they are working with several professional organizations to get their security house in order and for their sake I hope this happens sooner rather than later.

Besides the two music site breaches, another Sony subsidiary -- the ISP So-net Entertainment Corp. -- was recently hacked, with the bandits making off with $1,225 USD in redeemable gift points.  Another hack transformed one of Sony's servers into a host for a phishing website

The problem with all these breaches is that Sony as a company has essentially left customers with no hope that it is properly protecting their data against malicious parties.  

It would not be surprising if these customers refuse to use Sony's online properties, taking business to competitors like Microsoft Corp. (MSFT) or Nintendo Comp., Ltd. (7974).  Reportedly some customers are already doing exactly that.

III. High Costs for Sony

The average cost of a system intrusion in 2010 was $318 USD per record lost, up 48 percent from a year prior.  Sony claims that the loss of 101 million records will only cost it $2 USD per record.  Unless the company has found the mother of all "bulk discounts", when it comes to data loss payouts, the company appears to be seriously understating the cost to its bottom line.

The company is currently in the throes of multiple class action lawsuits.

At the end of the day Sony, much like Gawker Media, brought on the attacks by lashing out the greater hacker community, particularly the massive hacker collective Anonymous, which has at least 10,000 members internationally.  

Sony provoked the hackers when they decided to kill homebrews and Linux on the PlayStation 3 after allowing and even supporting those popular offerings for the console's early years.  The hackers were further infuriated by the fact that Sony sued iconic hardware hacker George "GeoHot" Hotz -- something that even GeoHot's perpetual target Apple, Inc (AAPL) hadn't dared do.

The humiliation of Sony's security is proof that the online world is still very much like the Wild West.  If you anger one person enough, you may need protection; but if you anger the masses, half-baked protection outfits may not be good enough.

Sony has clearly been exposed as the inferior to the hackers in cyber-security.  With customers growing wary of the company, it may pay dearly for its failings to protect its online properties.

In a sign of the times, even as Sony hopes to restart its PlayStation Network in the U.S. after a second outage, the Japanese government is denying it permission to restart.  They say they're not convinced that Sony is any more able to protect its customers, this time around.


Comments     Threshold

This article is over a month old, voting and posting comments is disabled

RE: LOL & Sony
By Chaser on 5/24/2011 8:15:17 PM , Rating: 0
Its amazing how all across the net people the too many opinions seem to reflect gleefully about this. Believe it or not folks there are still a considerable amount of consumers that buy Sony products and/or use their services. And no just because they bought them doesn't mean anyone deserves this. Even Sony.
It'd be hard enough to track down a couple hackers attacking your firm -- good luck if the entire hacking community decides to rain fire down upon you.
Exactly. How many companies could weather an assault like this? There is no winner here. And to take solace just because someone else is thinks they are just a "smarter consumer" or they that think Sony is getting whats coming to them is pathetic stupidity.
Game over.
Try not to cheer too loudly.

RE: LOL & Sony
By EricMartello on 5/24/2011 10:04:57 PM , Rating: 4
In your idealized world nobody deserves "bad things" but the reality of the situation is that Sony chose to put itself at odds with its customers, including it did in fact set itself up for what's happening now. It would have been wiser for Sony to simply back off and let people use their PS3s as they see fit - after all the people bought and paid for the consoles so there should be no restrictions on what software can be used on there.

Cry stupid all you want but if you plan to start shit be prepared to finish it. Sony, obviously, was not prepared to fight the fight they started here...and it is solely Sony's fault for whatever 'collateral damage' occurs to its customers.

RE: LOL & Sony
By Reclaimer77 on 5/24/11, Rating: -1
RE: LOL & Sony
By anyman on 5/25/2011 5:17:00 AM , Rating: 4
It just happens to be that a lot of PS3 owners can't even play Blu-rays on their systems.

Sony has done nothing about it and imho deserves what they're getting now.

RE: LOL & Sony
By Reclaimer77 on 5/25/2011 10:09:22 AM , Rating: 1
Oh please. Firmware updates routinely break functionality in devices. Hell my first Intel SSD was broken because of the TRIM firmware.

If every company who made buggy firmware deserved to be hacked and shut down, we wouldn't have many tech companies left.

RE: LOL & Sony
By EricMartello on 5/26/2011 3:04:27 AM , Rating: 2
It's a console. If you want to run ANYTHING on it you want with no restrictions, get a PC. Sony's only obligation is to make sure you have a fully working console. You make it seem like they told people they could no longer play games on it or something or broke key functionality.

Wrong. It's not an issue of Sony's obligations; Sony first allowed "homebrew" applications on the PS3 and in fact promoted it as being usable in applications other than gaming. They then did a 180 without any justification. Sony didn't provide any kind of support for homebrew users, but they did actively attempt to disable it and disband the "official" homebrew community. THAT is a big part of the problem - Sony forcefully trying to control what someone does with a product they paid for.

Oh please. Firmware updates routinely break functionality in devices. Hell my first Intel SSD was broken because of the TRIM firmware.

If every company who made buggy firmware deserved to be hacked and shut down, we wouldn't have many tech companies left.

Again, buggy firmware isn't the issue. Sony did try to root peoples' computers in the name of "anti piracy". They're also a member of the RIAA and MPAA. That alone is enough to justify what was done to them, and more.

RE: LOL & Sony
By artemicion on 5/24/11, Rating: 0
RE: LOL & Sony
By BansheeX on 5/25/2011 4:31:12 AM , Rating: 2
Maybe they should have never offered the option in the first place like MS and Nintendo. Then people would love them!

RE: LOL & Sony
By Aloonatic on 5/25/2011 8:23:26 AM , Rating: 2
Even if 1 person cares, it's still selling something to someone and then taking it back.

When my PS3 had come to the end of its useful life, i.e. the PS4 was out (which I might have bought, but almost certainly wont now) I would probably have had a play around with the otherOS thing. Sure, it wasn't the main or deciding factor in my purchase, but it's something that I still wanted to do.

Anyway, that aside.

I ask this on each of these threads, but wasn't one of the reasons that they had the otherOS feature a way to get around import tax/tariff issues? The theory being that it mean that a PS 3 could be imported as a PC (linux/otherOS enabled) rather than an entertainment device/games console? I might be misremembering something from way back when, or it is complete rubbish that didn't happen. It just seems like something that might come back to haunt Sony later, if true.

RE: LOL & Sony
By Strunf on 5/25/2011 12:02:34 PM , Rating: 2
You're talking to a wall... these days if you don't follow the trend you'll only get rated down if not worst.

I find this whole thing very "American" in no other country you would see so many people cheering and finding justifications for something that is illegal... on a second thought the rest of world would probably cheer just as much each time a US company or a US agency gets hit, there seems to be a balance... today SONY tomorrow the Pentagon ? or maybe the US power grid?

RE: LOL & Sony
By Uncle on 5/26/2011 2:07:28 AM , Rating: 2
Someone should ask sony if they would consider putting a rootkit update on all their ps3's.LOL

"If you can find a PS3 anywhere in North America that's been on shelves for more than five minutes, I'll give you 1,200 bucks for it." -- SCEA President Jack Tretton

Most Popular ArticlesFree Windows 10 offer ends July 29th, 2016: 10 Reasons to Upgrade Immediately
July 22, 2016, 9:19 PM
Top 5 Smart Watches
July 21, 2016, 11:48 PM

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki