Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Sony IT

Sony Music Greece Falls To Hackers 303

Posted by samzenpus from the kicking-them-while-they're-down dept.
xsee writes "Hackers: 6, Sony: 0. It appears an attacker has performed a SQL injection attack against SonyMusic.gr. The latest attack has exposed usernames, real names, email addresses and more. Is Sony's network being used as the world's largest public penetration test?"
This discussion has been archived. No new comments can be posted.

Sony Music Greece Falls To Hackers More

Sony Music Greece Falls To Hackers

Comments Filter:

  • SQL Injection... (Score:5, Funny)

    by yarnosh ( 2055818 ) on Monday May 23, 2011 @12:05AM (#36213904)
    The most preventable of all security holes. How sad.

    • Re:SQL Injection... (Score:4, Interesting)

      by hedwards ( 940851 ) on Monday May 23, 2011 @12:10AM (#36213932)

      I'm enjoying this for the lulz and the epic security fail. I just wish I could buy a drink for whomever it is that's doing this to Sony.

      • And you're egging them on?

        They aren't just doing this to Sony, they're doing this to the people who use the services too.

        Take it from a person had a gawker account. When they were hacked, it caused a great inconvenience for me.

        • Re:people are stealing user info (Score:5, Insightful)

          by fotbr ( 855184 ) on Monday May 23, 2011 @12:28AM (#36214038) Journal

          In this case....I don't feel sorry for anyone doing business with sony. From my point of view, they made their bed, now they get to lay in it.

          • Re:people are stealing user info (Score:4, Insightful)

            by Killerchronic ( 1170217 ) on Monday May 23, 2011 @12:34AM (#36214078)
            It maybe a problem for users but this is a serious wakeup call to said users, no your data is not as safe as you think it is when you are handing it over to all these companies, its about time the cracks were shown to customers and just how slack these companies can be in keeping their protocols and systems running correctly. I am still laughing, im not a sony fan in any way, shape or form, obviously its bad its happening but its hilarious that a company this big has such lax security and is being exposed on an almost daily basis.

            • Re: (Score:3)

              by naz404 ( 1282810 )
              Did Sony fall for Little Bobby Tables again?

              http://xkcd.com/327/ [xkcd.com]

            • They probably wanted to save money (Score:4, Insightful)

              by elucido ( 870205 ) * on Monday May 23, 2011 @02:41AM (#36214638)

              It's cheaper not to hire or pay for information security.

              And when they do they probably don't hire the best. Let's face it, Sony is not innocent and I could care less what happens to Sony. I don't own Sony stock, I don't work for Sony, and I don't own any Sony products except for an old PSX. So I just don't care what happens to Sony.

              Maybe other companies will now give a shit about information security.

            • its about time the cracks were shown to customers

              I think Geohot already did that, quite literally.

        • You're right. While we might enjoy this bullying because we dislike a company there is a larger context than, OMGZ 0WN3D!1!!!!11

          I had a gawker account as well and, while it wasn't a problem for me to change my level lame password for that and other sites, it might turn out worse for other people.

        • Re:people are stealing user info (Score:5, Insightful)

          by LordLucless ( 582312 ) on Monday May 23, 2011 @01:10AM (#36214276)

          So your saying, by doing this they're going to drive customers away from Sony, reduce their income stream, and eventually remove them from the world of global commerce?

          Wow, that sounds...terrible

          • Re:people are stealing user info (Score:5, Insightful)

            by justforgetme ( 1814588 ) on Monday May 23, 2011 @04:42AM (#36215186) Homepage

            ohh, wait I have to say something about this!!!!

            I was in a bank once, while it was being robed! Ok, it wasn't the nicest experience I ever had and I might have been inconvenienced a bit.
            Did I lose the money I had in the bank? No.
            Did I loose the info I had stored in it? No.
            Did I manage to do the jobs I had with the bank? Yes, I just went to another branch.

            So if you are going to create a service infrastructure that hasn't enough failsaves and backup plans to deal with a simple digital break in then you damn well deserve to be reduced to the economic equivalent of decarbonized organic material... And all people who trusted your Services (including Yours truly) deserve a very big refund for your incompetence and a big slap in the face for being such fools!

        • Re:people are stealing user info (Score:5, Interesting)

          by hedwards ( 940851 ) on Monday May 23, 2011 @02:28AM (#36214566)

          Honestly is this really that much worse than when Sony decides to vandalize customer equipment?

        • Re: (Score:2)

          by AmiMoJo ( 196126 )

          Browsers could do a lot to mitigate the damage if they just enabled some basic password protection features. Firefox, for example, has a master password system but it isn't enabled by default, and even when it is on there is no secure password generator. It can all be done with add-ons but should really be the default so everyone starts using it.

          In case you don't know what I am talking about the ideal way for a browser to manage passwords is for it to generate a random secure password for each site. It stor

          • Re: (Score:2)

            by DarkOx ( 621550 )

            That sounds great, that way nobody can logon to any site from a machine that is not theirs because they won't have the password safe on that machine and don't know any of the passwords. We might as well just forget this whole cloud thing and go back to fat clients for every service. Oh and before you say lastpass, we all know how well that worked out for people recently; also a service like that presents to valuable a target, even if its a hard one it will be attacked often.

        • My Gawker account was compromised too.
          Oh dear, I had to wait until they got the system back up and change my password.

          My PSN account has been compromised.
          Oh dear. I had to wait a couple of weeks for them to bring their service up again.

          In both cases the password change was done in seconds. I went to the web page, entered my old password, clicked the "Password Hasher" icon next to the "new Password" box, clicked "Bump" and entered my passphrase. Click OK. Completely new 26 character UPPER/lower/1234/!"

        • Anybody who trusts Sony after all the various customer-rapings Sony has committed in the last ten or fifteen years deserves to have their data stolen.

          Fool me once, shame on you. Fool me twice, shame on me. If you buy Sony you're begging to be abused.

    • Time to sell short Sony stocks while we are at it.

    • Re:SQL Injection... (Score:5, Informative)

      by Bacon Bits ( 926911 ) on Monday May 23, 2011 @12:16AM (#36213982)

      I thought the most preventable of all security holes was blank administrator passwords. Granted, the most notorious instance of this was the default install of SQL Server 2000's sa account....

    • The Application String Interface was a poor idea from the start. It's the 21st century, we shouldn't be building strings to do DB queries.

      • Re:But... why?! (Score:4, Insightful)

        by betterunixthanunix ( 980855 ) on Monday May 23, 2011 @12:21AM (#36214006)
        I would classify this as part of the more general category of "in band signalling." The telephone network learned the hard way why such a design is bad when people began to use blue boxes, but it still took decades for them to fix the problem. I suspect that it will be a while before we see a real fix to the SQL injection problem as well.

        • SQL injection attacks fixed long ago (Score:5, Informative)

          by SuperKendall ( 25149 ) on Monday May 23, 2011 @12:46AM (#36214152)

          I suspect that it will be a while before we see a real fix to the SQL injection problem as well.

          It's called a paramterized query and pretty much every language on the planet supports this mechanism.

          SQL injection is mostly a solved problem, except for programmers.

          • Re: (Score:3)

            by plover ( 150551 ) *

            Parameterized queries by themselves aren't the panacea that people make them out to be. They still allow attack code to be stored in the database. Bad handling of the data deeper in the application stack, where protections aren't expected, might still choke on the code. You need 100% of the SQL queries in the system to be parameterized. Even then, they do nothing to prevent other language injection attacks to pass through, such as XSS attacks.

            As you say, it's a solved problem, if the programmers use it.

            • Re: (Score:2)

              by Splab ( 574204 )

              Indeed you can inject JS or whatever if data isn't parsed correctly, but using parametrized queries will at least never ever expose the users credit cards, username, passwords etc.

            • Re: (Score:2)

              by nstlgc ( 945418 )
              You failed to refute his point that parameterized queries fix SQL injection attacks. Indeed it does not protect against XSS attacks, buffer overflows, aids, cancer and greed, but nobody claimed that it would.
          • Obviously a parameterised[sic] query prevents the most obvious forms of injection attack, but it alone does not protect against everything. Although it can be tedious, all data returned in forms should really be checked for syntactical legitimacy. Apart from anything else, this makes it easy to distinguish between accident and malice, and so know when to pop up a box saying "please check that the contents of each box make sense before clicking Submit" and when to put up a 404 and block the IP for a while. O

          • Parameterized queries still don't keep you off the hook from sanitizing your database inputs. Even if you're using something like the PDO object to generate and prep DB queries, in the end, MySQL's looking for a string for input.

            The real solution is getting away from sending SQL queries to DBs in string format, as the root poster hinted at, but, sanitizing DB inputs really isn't the hardest job to do, nor is it the biggest problem we face.

        • I wouldn't go so far as to use the comparison to in band signalling for this particular problem. After all, that comparison might be more fitting for the notoriously sloppy way modern PCs fail to distinguish between program storage and data storage.

          • Not distinguishing between program storage and data storage permit all kind of nice meta programming. LISP is beautiful in its kind for that. But not checking your inputs is the worst offender and the source of all sins. It is so easy to cut corners on input validation :-(

  • Public penetration test (Score:5, Insightful)

    by mehrotra.akash ( 1539473 ) on Monday May 23, 2011 @12:15AM (#36213978)

    Isnt every network exposed to the public (esp. mid size or larger commercial ones) continously under attempted attack?

    • Isnt every network exposed to the public (esp. mid size or larger commercial ones) continously under attempted attack?

      Yes, of course they are. However, there are examples of SQL injection attacks [wikipedia.org] going back to November, 2005. There's no excuse for a company as big as Sony to be vulnerable to them almost five years later.

      • Re: (Score:3)

        by smash ( 1351 )
        Well given they were running apache 1.3 on various things, which was not really suggested as the basis for new installs even way back in 2003-2004, its no great surprise they're still vulnerable to shit that was popular / exposed back in 2005.

        • Re: (Score:2)

          by AmiMoJo ( 196126 )

          What surprises me is that it took this long to uncover the vulnerability. I would expect every script kiddie to be testing for SQL injections and ancient versions of software.

    • Re:Public penetration test (Score:5, Insightful)

      by MagusSlurpy ( 592575 ) on Monday May 23, 2011 @12:56AM (#36214200) Homepage
      Yes, but to be fair to Sony (which really pains me), they are currently the focus of every bored script kiddie in the world right now, as well as most of the legitimately pissed-off, skilled hackers. While there may not be such a thing as "security through obscurity," there is a lot to be said for not having a target the size of Montana painted on your servers.

  • Karma's a bitch, Sony. (Score:4, Insightful)

    by jaskelling ( 1927116 ) on Monday May 23, 2011 @12:17AM (#36213984)
    Years of half baked products, poor reliability, hostile customer service, lazy innovation, and a general disdain for security are what your customers have had to deal with. I really don't care who is doing it to you or why - but I applaud them teaching you the hard lessons of the evolving technological age. You can't keep repeatedly flipping people the finger anymore and tell them to deal with it. Evolve or die. And no, my loathing isn't related to just the recent PS3 debacle. It extends to experiences with consumer audio, professional theatrical projection equipment, and so on right down the line. The fact that you're being taken out by the simplest of attacks in most cases just makes my smile grow a little more.

    • Re: (Score:2, Insightful)

      by rrohbeck ( 944847 )

      +5.
      Remember when Sony products were cool because they were innovative? Today you're outing yourself as a mindless consumer if you buy anything Sony.

      • Re:Karma's a bitch, Sony. (Score:5, Insightful)

        by Opportunist ( 166417 ) on Monday May 23, 2011 @12:49AM (#36214172)

        Remember when Sony products were cool because they were innovative?

        Yes, I'm actually that old.

        I guess we should explain for the kids here since I guess they can't even imagine it: Sony was cool. Not just like Apple today, with fanboys liking it and everyone else hating it, it was THE cool brand. They had innovative products with never seen before features and a kickass support that didn't bother to ask for details, they just threw a new model at you if the old one croaked, which was actually unlikely because, hey, it was a SONY, they don't fall apart! People were proud to have Sony speakers and Sony radios in their cars, they were proud to have a Sony walkman (as if you could get any others, after all it was a brand name) and they had every right to be proud, they bought something of lasting value!

        I admit, it's very hard to believe that today.

        • Remember when Sony products were cool because they were innovative?

          Yes, I'm actually that old.

          That's OK. I'm old enough to remember before Sony meant good. I remember when Sony meant cheap knock-off from Japan.

        • Re: (Score:3)

          by SuperQ ( 431 ) *

          Yup, I loved my walkman and and then discman. And decent earbuds. I tried to love minidisc, but it was just too painful to keep using sony's proprietary bullshit. Between the minidisc fail, the memory stick fail, and the general shit-tastic quality of stuff these days I've just given up.

        • I have two Sony Walkmans (Walkmen?) and they are very good and solidly built (quite a lot of metal parts, compared to today's mostly plastic devices). Whatever they make now will most likely break beyond repair before the cassette players do. Yes, the players needed a belt change, but that was relatively easy to do and the new belts should last a long time. I still listen to cassette, since I have a lot of tapes so it makes sense to record new stuff to tape instead of copying all tapes to a digital format,

    • Re: (Score:3, Insightful)

      by seanvaandering ( 604658 )
      Other than getting a free Sony Blu-Ray player recently, I really try to avoid Sony products as a rule. I used to LOVE them, their receiver line was one of the best ten years ago, but the only thing I would entertain buying these days is MAYBE a LCD TV. There is just so much better choices out there these days and i'm not into buying name brand for the name anymore.. having a family will do that to ya :)

    • Re:Karma's a bitch, Sony. (Score:5, Informative)

      by _xeno_ ( 155264 ) on Monday May 23, 2011 @01:50AM (#36214416) Homepage Journal

      professional theatrical projection equipment

      There was an interesting story in the Boston Globe [bo.st] this weekend about how Sony projectors are projecting 2D digital movies up to 85% darker than they should.

      The reason? It turns out to be Sony DRM, although the article doesn't ever come out and say it directly. Basically, there's a special 3D lens required to display 3D movies, but this lens reduces the brightness of 2D movies.

      So why aren't theater personnel simply removing the 3-D lenses? The answer is that it takes time, it costs money, and it requires technical know-how above the level of the average multiplex employee. James Bond, a Chicago-based projection guru who serves as technical expert for Roger Ebert's Ebertfest, said issues with the Sonys are more than mechanical. Opening the projector alone involves security clearances and Internet passwords, "and if you don't do it right, the machine will shut down on you."

      In other words, you have to deal with Sony DRM. Rather than jump through the Sony-imposed hoops, theaters just leave the 3D lens on all the time.

      Why bother with Sony projectors at all if they have this problem and others don't?

      The reason appears to be a basic business quid pro quo. Sony provides projectors to the chains for free in exchange for the theaters dedicating part of their preshow ads to Sony products.

      So, yeah. Another wonderful example of Sony in general and Sony DRM in specific giving customers an inferior product.

      Obviously the theaters deserve some blame for this too.

      • "Opening the projector alone involves security clearances and Internet passwords"

        Is it a projector or an ATM?

        • It is a Sony product. Do not open/disassemble Sony Products without the proper authorization. You are just a mere customer who purchased the product. You do not own it.

      • And to get a digital movie to play also requires security clearances and internet passwords, it won't simply play on any projector, you need to get it authorized. So not changing the lens at the same time is a problem with incompetence or sloth.

        No, it isn't the Sony DRM giving customers an inferior product, it is the theaters. Analog projection showed us they don't really see image quality as a big factor in their business success. You were lucky to get a projector with the film held steady in the gate, wel

        • Re: (Score:2)

          by makomk ( 752139 )

          And to get a digital movie to play also requires security clearances and internet passwords, it won't simply play on any projector, you need to get it authorized.

          The normal theater staff have the authorizations for that, though. I'm not sure what Sony, theater chain or distributor policy is on giving access to projector innards, and I suspect this is a closely guarded secret.

    • Re: (Score:3)

      by siddesu ( 698447 )

      That's what American management does to you.

  • Sony = Consistent (Score:5, Insightful)

    by alphax45 ( 675119 ) <kyle.alfred@nOSPAM.gmail.com> on Monday May 23, 2011 @12:22AM (#36214012)
    Well at least they are consistent - none of their systems seem to have more than basic security.

    • Re: (Score:2)

      by Ecuador ( 740021 )

      Yeah, because "basic security" does not involve sanitizing your sql queries...

  • From TFA, some curious speculation:

    While it's cruel to kick someone while they're down, when this is over, Sony may end up being one of the most secure web assets on the net.

    Is there any evidence to back this up? I keep thinking of counter examples, the best one being Sony. They've been attacked how many times now, and they are still leaving security holes of this nature up? One would think after the first attack a company wide IT effort to harden their servers would have been given something other than

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Yes, and you would think the airlines would strengthen the door after the first cockpit invasion back in the 30s or 40s, whenever it was, but we had to wait until the mother of all hijackings before this most basic move was undertaken.. What we will probably get is some kind of 'TSA' for the internet instead. History repeats itself in many ways.

    • Give Sony a bit of a break, it's only been a month, and SCE & Sony Music are far enough apart within the overall Sony group for it to not necessarily have filtered all the way to testing the vulnerabilities in Hungary.

  • Like it matters. (Score:5, Interesting)

    by MrQuacker ( 1938262 ) on Monday May 23, 2011 @12:28AM (#36214042)
    Anyone who's ever visited Greece knows nobody buys music there. For 2euro an hour you can visit an internet cafe, get the password from the guy at the front desk, and connect to the cafes local file server. Last time I was there they had something like 20TB+ worth of movies, music, tv shows, games, and porn.

    They decided that since people download stuff anyways, might as well save on the bandwidth and store it locally. Any time you download a file its mirrored in the cafes file server, so others can copy it without having to re-download.

    And if you dont go that route, you can buy bootleg copies from any number of African immigrants on the street for just a few euro. Many times for better quality than available in stores for retail price.

    • Re:Like it matters. (Score:4, Interesting)

      by Eravnrekaree ( 467752 ) on Monday May 23, 2011 @01:11AM (#36214280)

      Especially about the better quality, is the ironic truth. Remember those who were copying Star Wars Laserdiscs and making them into movie files, because the DVDs were often so slow in coming, and then the DVD releases were only of the new doctored versions and the original versions of star wars were impossible to purchase? The Laserdiscs of Star Wars were also reported to have better special features compared to the later DVD releases.Often times its impossible to get movies on DVDs from the companies, which basically is the companies tell fans, screw you, so fans just share the copies with themselves. For years companies have treated their customers like shit, and they then expect people to love them?

      • I can verify that if you have the fat boxed set there are some nifty features. It also came with a big picture book if you bought the extra-fat boxed set.

        I only wish I had an LD player that would play more than 1 disc 2 sides. All the LD players which play 2 discs that I see any more are Karaoke units and they want real money for them... as if that were a selling point.

    • I don't think the music piracy is the point. I think that the point is that the public perception on Sony is being degraded; it has nothing to do with piracy as far as I can see. This is being reported in mainstream media now... would I trust Sony with any of my details? Not a chance. Additionally, these "attacks" must be costing Sony money... probably a lot of money due to not only customer's trusting them less, but the extra employees (or current employees overtime) and resources they need to spend to fix

  • Plain text passwords?? (Score:5, Informative)

    by wvmarle ( 1070040 ) on Monday May 23, 2011 @12:31AM (#36214060)

    The linked article also provides a screen shot with obscured personal information.

    It appears the passwords are stored in plain text, not as hash: formatting makes it unclear but it seems the length varies, and the password fields are short (6-10 characters or so), while hashes are much longer than that.

    Bad bad security! No wonder they also fall victim to the age-old SQL injection attack... which I thought most SQL interface libraries can automatically intercept by adding the appropriate escaping... many years ago I used Pythons MySQLdb and they were doing that for very very long already... so there should be no excuse for allowing this to happen still.

  • expect more (Score:3)

    by smash ( 1351 ) on Monday May 23, 2011 @12:36AM (#36214094) Homepage Journal
    Evidently, the playstation 3 firmware/network isn't the only instance where sony totally fails at securing their shit. SQL injection? Really? In this day and age? I'm simply shocked that it hasn't happened a lot earlier; they've been pissing people off for years now, its amazing its taken this long for a collective group to make a serious effort to try and break in.

  • "Is Sony's network being used as ..." (Score:5, Insightful)

    by QuasiSteve ( 2042606 ) on Monday May 23, 2011 @12:39AM (#36214120)

    Is Sony's network being used as the world's largest public penetration test?

    No, every other scriptkiddie is just joining in on teh lulz of flogging the dead horse. "ZOMG I sql injectioned a SONY site! Yeah, it's got nothing to do with PS3 or PSN, and yeah it's some site in Greece, but lulz amirite!?"

    It's even in the bloody article, isn't it?

    As I mentioned in the Sophos Security Chet Chat 59 podcast at the beginning of the month, it is nearly impossible to run a totally secure web presence, especially when you are the size of Sony. As long as it is popular within the hacker community to expose Sony's flaws, we are likely to continue seeing successful attacks against them.

    It appears someone used an automated SQL injection tool to find this flaw. It's not something that requires a particularly skillful attacker, but simply the diligence to comb through Sony website after website until a security flaw is found.

    I mean.. honestly?

    They could be running this against $random_site and try to hit the news with it, too.. but they wouldn't.. because nobody cares about a random hack at a random site right now.. but if it's got SONY attached to it.. well.. lulz rules the news.

    None of which excuses the poor security.. but none of which excuses the submitter from his choice of words either.

    • Re: (Score:2, Insightful)

      by flimflammer ( 956759 )

      Jesus Christ, man. How far did that stick get wedged up your ass?

    • Re:"Is Sony's network being used as ..." (Score:4, Insightful)

      by DurendalMac ( 736637 ) on Monday May 23, 2011 @01:06AM (#36214248)
      Kinda makes you wonder why Sony was vulnerable to exploits that could be found in skiddie tools. If someone had to actually dig for an exploit or found a new one to use against them, then that would be something, but when skiddies can breach your network then you seriously need to fire the guys in charge of security because they suck at their jobs.

    • Re:"Is Sony's network being used as ..." (Score:5, Insightful)

      by LordLucless ( 582312 ) on Monday May 23, 2011 @01:14AM (#36214290)

      As long as it is popular within the hacker community to expose Sony's flaws, we are likely to continue seeing successful attacks against them.

      It almost seems as if deliberately screwing people over doesn't really pay off, doesn't it?

    • There's a difference between "running a totally secure web presence" and "exploited by an automated SQL injection tool". If an auomated tool could find it, then you have to wonder why the hell Sony hadn't just run the damn tool themselves. There are levels of insecurity, and this level is well below what a company like Sony should be at.

  • I almost feel bad for Sony.

    Almost.

  • public penetration test (Score:3)

    by n1hilist ( 997601 ) on Monday May 23, 2011 @01:33AM (#36214362)

    Heh heh, Sony's gettin' shafted!

  • This never gets old to me.
    http://xkcd.com/327/ [xkcd.com]

  • Is Sony's network being used as the world's largest public penetration test?"

    No more than HB Gary was.

    To wit: This is the prescription for being attacked mercilessly, for months on end:

    1. 1. Produce an item that is clearly advertised as having feature X, where feature X is useful only to really, really good programmers. You know - the ones who spend their time cracking the hardest problems using array of specialised parallel processors.
    2. 2. Sell the item to lots of people, who hand over their money on the basis of having feature X.
    3. 3. Some years later, withdraw feature X, so the all the software these people have invested years in creating is blown away.
    4. 4. When said programmers then fairly legitimately, extract your secret keys so they can restore feature X, unleash a phalanx of lawyers to peruse them within an inch of their financial lives, until they recant.

    At that point you will discover what sort of damage a bunch of really pissed off top notch programmers can do.

    With luck all the other psychopathic mega corporations around the world are watching and learning. The lesson is simple: don't poke a hornets nest.

  • How does this even happen? (Score:4, Insightful)

    by rebelwarlock ( 1319465 ) on Monday May 23, 2011 @02:37AM (#36214618)
    One of the first things you learn about web programming is to clean any string a user touches. If there's even a remote possibility that a user submitted something, clean it before putting it in your query. How is it even possible that someone would be given money for web programming before learning this? That's not even a rhetorical question; I'm genuinely interested in the answer.
  • ...they used my scanner. It would be so fitting. Sony BMG Greece hacked by a vulnerability found by a scanner written by a Greek dude.
    That would be completely worth the development effort.

  • I'm going to stop being a blatant sony fanboy and defend the ridiculous shit they've done, but, only six?

    between PSP releases 1.50 and 6.20, there's way more than just six points for the hacker team.

Slashdot Top Deals

"If it ain't broke, don't fix it." - Bert Lantz

Close