Sony Website Hacked By the "Lulz Boat"

Frostbite3789

New member
Jul 12, 2010
1,778
0
0
Kenjitsuka said:
spasicle said:
Storing user passwords in plaintext is beyond inept. Even the most basic forum software hashes passwords, Sony really is asking to be hacked. And a SQL injection? Ridiculous.
Exactly this.
Encrypting your database is super easy and the second thing you should do to it (the first being just making the db).

SQL Injection is from like 2005 or so, and it's not that hard to prevent it.
Just be on the ball a little, admins.
I'm litterally shaking my head here, so dumb... fire these people!
And we have exactly the hackers' word that this is what they did. I mean, they have no incentive to lie and make Sony look bad, right? I mean a group with "lulz" in their name would only tell the truth, nothing but the truth and only the truth, right?

Hackers are and always have been the most trustworthy people, right?

Get it? I'm being sarcastic.
 

King_Serpent

GUY YOU DON'T KNOW
Jul 12, 2010
66
0
0
What proof do we have the security was that lax. Maybe they are just claiming there is low security to make sony look bad. Also these hackers can go die in a pit. Not all hackers just these ones because they posted the personal info of the users. They will never have my support because of this.
 

poiuppx

New member
Nov 17, 2009
674
0
0
danpascooch said:
An SQL injection? Seriously? A fucking SQL injection!?

That's the simplest type of hack in the world, if hacking were burglary, that would be the equivalent of checking if the front door was unlocked. Basically Sony left its front door open after being robbed blind just weeks ago, WHAT. THE. FUCK.

Don't even tell me none of this is Sony's fault, that's bullshit, I've always known it was bullshit, but now there's proof.
The problem with that is, and this is coming from someone who has a fair bit of knowledge on the matter, the connections between Sony divisions basically boil down to:

*The name

*The owners

That's about it. It's like how Universal Pictures and Universal Music USED to basically be two arms on the same body, but now are more akin to distant cousins that share the same family name. In short, the guys who are actively doing all they can to update their security, the considerable fervor filling every office, etc.? The dudes at Sony Pictures probably know about as much about it as we do, maybe less. The guys at the top of Sony Pictures SHOULD, logically, have known to do something too, mind you. But still, there is minimal connection between THIS Sony and the Sony most of us on these forums are used to discussing.
 

zehydra

New member
Oct 25, 2009
5,033
0
0
King_Serpent said:
danpascooch said:
An SQL injection? Seriously? A fucking SQL injection!?

That's the simplest type of hack in the world, if hacking were burglary, that would be the equivalent of checking if the front door was unlocked. Basically Sony left its front door open after being robbed blind just weeks ago, WHAT. THE. FUCK.

Don't even tell me none of this is Sony's fault, that's bullshit, I've always known it was bullshit, but now there's proof.
?She dresses seductively so raping her seemed like the thing to do?

That?s your argument.
No, it's more like leaving your car unlocked in a dimly lit parking lot overnight and being surprised when it's gone the next day.
 

LikeDustInTheWind

New member
Mar 29, 2010
485
0
0
*sigh* It's not even close to funny any more. And it never was, really. They're just doing it because they're assholes now.
 

Kopikatsu

New member
May 27, 2010
4,924
0
0
poiuppx said:
Where does your expertise come from? (Note: I'm not doubting you in the slightest...that's pretty much what I've been saying for the last three pages. I'm just curious is all, as it's apparent I like knowing the sources...*points at most posts I make, like the last one for example*)
 

poiuppx

New member
Nov 17, 2009
674
0
0
Frylock72 said:
This is the one of the things that would make me glad to deal with a regulated internet.
Depressingly, I'm starting to agree. I'm a believer in free speech and a free internet, but if it allows this kind of damage... maybe it's time to tame the Wild West.
 

subtlefuge

Lord Cromulent
May 21, 2010
1,107
0
0
I'm still waiting until they find a conveniently placed note from Lulz Boat owning up to all the other hacks too. Something along the lines of "We did it, even though we didn't exist."
 

limed

New member
Jun 3, 2011
1
0
0
doggie015 said:
I cannot beleive they got this from a SIMPLE, SINGLE SQL injection! If that's all it took to expose plaintext usernames and passwords then I am glad I don't have a sony account. I was thinking of buying a PS3 but I'll hold off on it until they get their shit together, secure the database and ENCRYPT THE PASSWORDS!
Alot of you people need to lookup what SQL actually is... SQL is a database managing language primarily used to lookup data or create tables of data in a database, you can't hack any server using SQL alone. If anything SQL is the easy part of hacking the data from the server. For SQL to do anything you'd have to force your connection into the Sony Pictures database server. They haven't mentioned the method to do that, it is likely far more complicated than they are letting on. Either that, or they're script kiddies who don't particularly understand what they did to get in.

Its also hard to say the stuff they obtained really was unencrypted because there is no way to tell how biased the LulzSec tweets are. Until we get a few more viewpoints on the security situation from other sources (related or unrelated to Sony) you can't concretely say the security is as bad as LulzSec is advertising it to be.

The above being said, Sony is going to be having rough times for a long while it seems. Its rare to ever actually catch good hackers, its also rare to catch even script kiddies so unless LulzSec makes a major slip-up or gets bored this will probably continue for a long while. I'd hate to think what this is going to do to Internet freedoms though. Its hard enough to maintain that the benefits of internet freedoms outweigh the misappropriation of intellectual properties (piracy), or the more easy proliferation of terrorist groups, but to also expose the general public to such insecurities due to internet anonymity protecting criminals, it is definitely getting harder and harder to make a case for full internet freedom nowadays...
 

Awexsome

Were it so easy
Mar 25, 2009
1,549
0
0
poiuppx said:
Frylock72 said:
This is the one of the things that would make me glad to deal with a regulated internet.
Depressingly, I'm starting to agree. I'm a believer in free speech and a free internet, but if it allows this kind of damage... maybe it's time to tame the Wild West.
Seconded. This is out of control.

I'd be fully in favor of requiring to identify yourself with your social security number or whatever takes the place of something like that in other countries before surfing online. It's too lawless. People could believe the government conspiracy theories of if they'd watch you surfing porn, but I for one have the confidence that the government isn't going to turn into Big Brother from bringing criminals like this to justice just like that.
 

poiuppx

New member
Nov 17, 2009
674
0
0
Kopikatsu said:
poiuppx said:
Where does your expertise come from? (Note: I'm not doubting you in the slightest...that's pretty much what I've been saying for the last three pages. I'm just curious is all, as it's apparent I like knowing the sources...*points at most posts I make, like the last one for example*)
Just finished my MBA, and I did a major project for one semester on Sony. I talked with folks who work there, and they made it pretty clear there's a lot of walls between the different companies under the Sony umbrella. It was actually pretty fascinating, cause from the outside, you never hear about the seperations.
 

SenseOfTumour

New member
Jul 11, 2008
4,514
0
0
As someone else said, it's time to stop hiring lawyers and start hiring some security, all the lawyers in the world won't help if this stuff keeps going public as people just are not going to trust you with their info.

As an analogy, in defending your home, most people make sure they have locks on their doors before they get guns and guard dogs. Defence before attack.

OF course, that's all based on whether what this bunch of criminals are saying is actually true, about how weak their security was. If it is however, they really should have shifted some funds around and got some shit locked down after the first break in.
 

Therumancer

Citation Needed
Nov 28, 2007
9,909
0
0
Greg Tito said:
post
I'm not sure that kind of rape-logic holds up, but LulzSec does have a point. Sony is a big company, with lots of interchangable parts, but you think database security would be at the top of every divisions to-do list right about now.

Source: LulzSecurity [http://lulzsecurity.com/releases/]

Thanks to [user]ckeymel[/user] for the awesome-est tip in the world!

Permalink

Well, I think this is all connected to the "Other OS" thing. See Sony claimed they were removing the "Other OS" option for the protection of the users because of this backdoor it presented through their security. In reality they were basically going further than most DRM schemes, basically punishing legitimate users for a few. Where a DRM scheme might annoy you by putting some crippleware on your computer, Sony was basically robbing from you. They took something you paid for, even if you didn't use, and didn't give you any say in the matter or restitution for it. Their big defense was pretty much "you don't own your consoles, the TOS says so, if you don't like it take it up with our lawyers". Given that your typical console user can't go toe to toe with Sony, especially when they, like most businesses, pay off expert lawyers in areas like this just enough to create a "conflict of interests" so even if a rich person with an objection DID want to go after them the odds of them fighting it properly and winning are minimal due to having to use more of a generalist lawyer against what is going to be a team of specialists who are on staff to do nothing but argue that kind of point.

At any rate, the point being made here seems to be that Sony doesn't really have any security in place that is strong enough for someone to need something like a back door. The point here is that they are continually feeding Sony's lies back to them, as they conduct exactly the kind of hacker attack that their theft was allegedly to prevent. Sony screwed over enough people, where it's not surprising it's not being let go. I'm mad even though I didn't use the feature (and I'm not quite ADHD afflicted enough to forget what they did because I can't login to PSN for a couple of weeks). If I'm angry enough to post multiple times a day about it instead of babbling about games or comics or whatever, just imagine how the kids of geeks that run around and install Linux on everything might be... and those kinds of techies are pretty much the guys a security dependant company is stupid to tick off.

As I've said before, I think Sony could end this very simply, all it has to do is publically apologize, restore the other OS functionality, and concede that people own the products they pay for. Now I understand why a massive Godzilla-like corperation doesn't want to do those things, and what is at stake, but really that's pretty much what is going to end this.

Also while I'm responding to an article more directly than normal, I do have one "tin foil hat" theory that I had been toying with. I remember hearing how the US military bought tons of PS-3 systems so they could network them together as cheap computers, something which requires the "Other OS" option as they were doing it. I don't know if this doesn't apply to them, or if they were given a way out, but I have been wondering if perhaps the reason why nobody can catch these hackers is because it's a faction of the US goverment who just pretty much told their IS guys they could make Sony miserable due to the loss of all that hardware. Unlikely for a lot of reasons... real tin foil hat territory, but I do find the thought amusing on a few levels since it would explain so much of this. I am going to laugh if it turns out to be like half a dozen bored server techs in the basement of the Pentagon who were told "go for it, as long as it doesn't interfere with your other work".
 

Kopikatsu

New member
May 27, 2010
4,924
0
0
Awexsome said:
poiuppx said:
Frylock72 said:
This is the one of the things that would make me glad to deal with a regulated internet.
Depressingly, I'm starting to agree. I'm a believer in free speech and a free internet, but if it allows this kind of damage... maybe it's time to tame the Wild West.
Seconded. This is out of control.

I'd be fully in favor of requiring to identify yourself with your social security number or whatever takes the place of something like that in other countries before surfing online. It's too lawless. People could believe the government conspiracy theories of if they'd watch you surfing porn, but I for one have the confidence that the government isn't going to turn into Big Brother from bringing criminals like this to justice just like that.
Thirded. I don't know about government not turning into Big Brother (I'm a believer in Communism, but there hasn't been a single true Communist nation. Soviet Russia, North Korea, Vietnam, etc...those were all Socialist. You can't have totalitarian anything or a Dictator in an actual Communist society, but lo and behold...people took advantage and made themselves into Tyrants. Kind of like the thing with Anonymous breaking down. Alphas and people who perceive themselves as an Alpha will always be looking to take control...)

ANYWHO! Getting off topic here. I would give up my anonymity in order to make the internet a safer place, most definitely so.

SenseOfTumour said:
As someone else said, it's time to stop hiring lawyers and start hiring some security, all the lawyers in the world won't help if this stuff keeps going public as people just are not going to trust you with their info.

As an analogy, in defending your home, most people make sure they have locks on their doors before they get guns and guard dogs. Defence before attack.

OF course, that's all based on whether what this bunch of criminals are saying is actually true, about how weak their security was. If it is however, they really should have shifted some funds around and got some shit locked down after the first break in.
Sony hired at least three separate security firms to revamp their security after the PSN fiasco. I think this is the 23rd time I've mentioned this on this thread...
 

sleeky01

New member
Jan 27, 2011
342
0
0
Kopikatsu said:
sleeky01 said:
Kopikatsu said:
sleeky01 said:
You want a real challenge?

http://www.pbc.gov.cn/

Take your pick.
Uuuuuh...http://blogs.forbes.com/andygreenberg/2011/05/30/pbs-hacked-after-critical-wikileaks-show/
Oh for god sa...look at that link again would you?
...Oh. I mistook the 'c' as an 's'. My bad. Why would that site be difficult to hack, though?
Did you even look at the site I linked? Somehow I don't think you would be asking me that question if you did. Take a look again:

http://www.pbc.gov.cn/

If lulzdouche is looking to finance themselves and are looking for a challenge...
 

Kopikatsu

New member
May 27, 2010
4,924
0
0
sleeky01 said:
Kopikatsu said:
sleeky01 said:
Kopikatsu said:
sleeky01 said:
You want a real challenge?

http://www.pbc.gov.cn/

Take your pick.
Uuuuuh...http://blogs.forbes.com/andygreenberg/2011/05/30/pbs-hacked-after-critical-wikileaks-show/
Oh for god sa...look at that link again would you?
...Oh. I mistook the 'c' as an 's'. My bad. Why would that site be difficult to hack, though?
Did you even look at the site I linked? Somehow I don't think you would be asking me that question if you did. Take a look again:

http://www.pbc.gov.cn/

If lulzdouche is looking to finance themselves and are looking for a challenge...
Yeah, I did. People's Bank of China. I don't get the challenge thing, though. Are Chinese Government sites supposed to be hackproof or something?
 

OutforEC

Professional Amateur
Jul 20, 2010
427
0
0
This alleged security breach, as far as I have been able to tell, hasn't even been verified by Sony yet (who at last check was 'looking into it'), so everyone is basically just taking as gospel the words of a group called Lulzboat? Really?
 

Sikratua

New member
Apr 11, 2011
183
0
0
Doxcology said:
Oh for fucks sake, I'll say it again and maybe this will be put to rest. THERE IS NO REASON FOR THE HACKERS TO LIE ABOUT THEIR METHODS!
That comment has already been shown to be bullshit multiple times in this thread. If you read this thread, you will see that most of the comments fall into one of two catagories.

1: "These hackers suck and should go to jail."

2: "Sony sucks, and so does their security."

Since the only stated reason for this attack was to discredit Sony, it would benefit the hackers to claim that it was dirt simple to perform this hack. Let's put this into a different kind of attack. When a couple kids get into a fight in the playground, how often does the winner say "I got some of the crap kicked out of me, but I still won?" It's human nature to try to discredit other people, because doing so brings them down to a lower level. That's exactly what these guys intended to do with Sony. So, their stated intent gives them an extremely good reason to lie about the defenses that Sony mustered.

So, just to reiterate: The comment I quoted above is bullshit. Can we move on, please?
 

Kopikatsu

New member
May 27, 2010
4,924
0
0
mojodamm said:
This alleged security breach, as far as I have been able to tell, hasn't even been verified by Sony yet (who at last check was 'looking into it'), so everyone is basically just taking as gospel the words of a group called Lulzboat? Really?
It helps that they regularly post all of the information they've gathered and it's a rather simple matter to check if the accounts/people are real or not.

One news network called an account's given phone number post by LulzSec and verified that it was genuine.

Out of hundreds of thousands.