Just when Sony appeared to be getting back on the right
track with the full
restoration of its PlayStation Network, LulzSec struck again hitting Sony
right between the eyes. The group once again used an SQL
injection tactic to gain access to the Sony Pictures account database.
This time around, LulzSec manage to obtain:
- 1 million user accounts (including passwords, email and home addresses, and data of birth)
- All admin account details and passwords
- 75,000 music codes
- 3.5 million music coupons
In addition, there was even opt-in data that was accessible,
which gives even more information about Sony's customers and their preferences.
The part that amazes LulzSec (and us for that matter) is
that fact that Sony stored all 1 million user passwords in simple plain text
files -- no encryption whatsoever was used. "It's just a matter of taking
it," stated LulzSec in a press release. "This is disgraceful and
insecure: they were asking for it."
The group went on to express its disdain for Sony and its
security practices (or lack thereof):
Our goal here is not to come across as master hackers, hence
what we're about to reveal: SonyPictures.com was owned by a very simple SQL
injection, one of the most primitive and common vulnerabilities, as we should
all know by now. From a single injection, we accessed EVERYTHING. Why do you
put such faith in a company that allows itself to become open to these simple
attacks?
LulzSec has provided evidence of their latest
"Sownage" on its site, which can be accessed here.
