Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

First of all there was the PSN hack, which was compromised due to a vulnerable version of Apache and no Firewall and using a developer console. Then Sony Greece fell due to an SQL Injection attack. Then there was a phishing site on Sony's Thailand servers. Then Sony Canada and Sony Japan were compromised. Then today SonyPictures.com was compromised.

How significant is itfor such a large corporation to be continuously attacked like Sony have been and what if any impact will these attacks have on the IT Security industry?

share|improve this question
I'm not too sure what tags to put this question under, so suggestions are welcome. – Sonny Ordell Jun 3 '11 at 1:14
1  
I'll have to dig through my mail, but I've gone through this list. Currently Sony is up to 9 unique compromises since Feburary. With the Sony pictures release today they're at around 108 million customer records exposed. – Ori Jun 3 '11 at 1:36
@AviD Is there any way I could edit this to have it reopened? A think an analysis of the sony attacks is interesting and relevant, how is asking for an analysis not appropriate? – Sonny Ordell Jun 12 '11 at 15:00
@Sonny, I really don't know what your actual question was, so I couldnt say how to edit it. Perhaps reading the FAQ could help? It's also pertinent to note that this question also has very subjective overtones to it, specifically asking for "speculation" - that really wouldn't be helpful, anyway. Also, asking about a specific, isolated incident also smells like "Too localized". – AviD♦ Jun 12 '11 at 15:03
@AviD AFAIK Nothing like this has happened before, an all out attack on a corporation as big as Sony with over 10 serious compromises in such a short period of time. Surely there must be a way to discuss this on this site....what about asking how such a sophisticated attack was possible or how the industry will deal with it? – Sonny Ordell Jun 15 '11 at 13:38
show 2 more comments

closed as not a real question by Iszi, AviD♦ Jun 7 '11 at 15:22

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.

1 Answer

up vote 4 down vote accepted

Jan 2, 2011 GeoHot releases Root Signing key for the PS3.

Febuary 16, Bret (Trixter) McDanel pokes around in the PSN trying to reverse engineer connection protocols and chat protocols. Essentially breaking the trust model of PSN by issuing a self signed cert and bouncing off a proxy he controlled. http://173.255.232.215/logs/efnet/ps3dev/2011-02-16 (Wired Details some of that) http://www.wired.com/threatlevel/2011/04/trixter/

Rebug Released Late March (3.55.1) allowed access to the Dev-PSN using the RootKey http://attackofthefanboy.com/news/playstation-3-hackers-using-developer-network-to-access-psn/

SOE Fires 205 Employees the same day Rebug 3.55.1 is released.

DDOS Performed against Sony by Anonymous for filing Suit against GeoHot. Claims by many, including Sony, was this was used as a great distraction by the malicious attacker. http://www.eweek.com/c/a/Security/Sony-Data-Breach-Was-Camouflaged-by-Anonymous-DDoS-Attack-807651/

PSN goes offline April 20th.

a Week later, Sony says enter image description here happened.

They announce: April 26th PSN and Qrocity data exposure (77 Million Customer Records including 10 million Credit Card numbers) http://www.h-online.com/security/news/item/PSN-hack-Personal-data-of-millions-of-customers-stolen-1233209.html

SOE Announces "No Breach Has occured"

Days later, SOE announces, we're sorry our bad, 24.6 million accounts were actually compromised. http://www.geekosystem.com/sony-online-entertainment-hacked/

Lots more came after that: So-Net, Sony Greece, Sony Erikson Canada, Sony Thailand, Sony Music Japan, Sony Music Indonesia, Sony Pictures

share|improve this answer
T0ph with Veracode did a great Webinar for the Blackhat conference group. The image is shameless stolen from it, further his blog entry does a much better job: veracode.com/blog – Ori Jun 3 '11 at 2:47
Wow, thanks! I am tempted to mark your answer as correct, just wondering if it is etiquette to wait a bit longer first? – Sonny Ordell Jun 3 '11 at 3:16
@sonny - Yeah - this is very informative. But you might be surprised. Always wait a day or two at least.... @ori - the June 2 sony pictures hack by LulzSec was also SQL Injection – nealmcb Jun 3 '11 at 3:40
The question nobody seems to be able to answer and has been wracking my brain ever since the deluge started: Was this all because of a horrible series of vulnerabilities or is this representative of most Fortune 50 environments if they are targeted with this much effort? – Ori Jun 3 '11 at 3:53
the majority of the Fortune/FTSE 100 are continually targeted at similar or higher skill level on the part if the attackers. It is a continuous arms race in these environments. – Rory Alsop♦ Jun 3 '11 at 6:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.