Slashdot Mirror
Sony Officially Blames Anonymous For PSN Hack
H_Fisher writes "In a letter to Congress, Kazuo Hirai, chairman of Sony's board of directors, blames hacker group Anonymous for making possible the theft of gamers' personal information. 'What is becoming more and more evident is that Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack designed to steal personal and credit card information for illegal purposes,' Hirai wrote. He also indicated that Sony waited two days before notifying the FBI of the theft."
I officially blame Sony for being PSN hacked.
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
They're on to us!
"carefully planned, very professional, highly sophisticated"
These are not words I think of when discussing Anonymous. Give me a break.
-------
"Every artist is a cannibal, every poet is a thief."
Dont have the competency or skill to run your network correctly?
Dont know who else to blame when your on the hook for a class action and liability in the billions?
Blame Anonymous.
hey!
I didn't do crap!
The fact that the attack involve the theft of credit card data, as opposed to just shutting down the network, screams "not Anonymous" to me. You know, given how Anonymous tends to just shut things down with DDoS attacks, or occasionally overwrite a web page with one that spreads some message.
Palm trees and 8
Some how none of that seems to point to Anonymous in any way.
Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco.
The attack that stole the personal data of millions of Sony customers was launched separately, while the company was distracted protecting itself against the denial of service campaign, Sony said.
Sony said it was not sure whether the organizers of the two attacks were working together.
So they know Anonymous DDOS'ed them, and Anonymous have admitted this too.
They also were attacked separately where the theft took place. They don't know if these groups were working together. They blame the latter on Anonymous too. How did they draw that final conclusion??
Beware: In C++, your friends can see your privates!
Whilst I was admiring the gentle sway of her shapely derriere somebody stole my laptop!
More likely, Anonymous has become a convenient name to throw around whenever someone cracks a security system. Poorly designed security system? Just blame Anonymous when someone pulls off a successful attack. The media makes Anonymous sound like some sort of invincible, unstoppable hacker/wizard/demigod army (or should I just say, "Hackers on steroids"), so nobody will blame you when you blame Anonymous.
If people only knew that Anonymous is just a bunch of teenage script kiddies...
Palm trees and 8
Fox was right! Anonymous is a bunch of hackers on steroids!
There is no official "anonymous" and there is no leadership or command structure. It's a concept, an idea to describe an emergent system of hacktivism. Saying anonymous is responsible for this (or anything) is like saying democracy is responsible for causing the wars in the middle east. You're mixing up an idea, an ethos, with an organization.
If you build it, nerds will come. Soylentnews.org
There is no 'Anonymous.' It's just a term that's been widely co-opted. Sort of like 'Al Qaeda.'
One man's -1 Flamebait is another man's +5 Funny.
you know if Anonymous is actually responsible i want Sony to provide Proof of that - else it's just slander.
'...if only "Jumping to a Conclusion" was an event in the Olympics.'
Except they didn't. They posted company emails to show the incompetence of the CEO and claimed credit for it. They didn't steal credit card, address, or other personally identifiable information and then denied it.
Sony may have blamed Anonymous for the attack, but they're not accusing Anonymous of executing the attack itself. They said the following:
Granted, Sony can say anything to cover their butts, but Hell... The hackers could have just as easily left an "Osama wuz here" file. Would that mean Al Qaida definitely did it? Could they abandon any further investigation and blog posting because the dude is shark food now?
Anonymous disagrees with you.
"The attackers went one better than this, however: they dumped the user database for rootkit.com, listing the e-mail addresses and password hashes for everyone who'd ever registered on the site."
There was also the little bit about posting personal info about spouses and children of HBGary employees.
I find being offended by me offensive.
I got a letter in the mail yesterday May 3rd advising me my info may have been hacked. Weird since I don't have a play station and have not played an online Sony game in over a decade (12 years maybe more) and then I canceled my subscription. Which brings me to a question why is information that old still being kept where it can be cracked?
There is no official "anonymous" and there is no leadership or command structure. It's a concept, an idea to describe an emergent system of hacktivism. Saying anonymous is responsible for this (or anything) is like saying democracy is responsible for causing the wars in the middle east. You're mixing up an idea, an ethos, with an organization.
Yes, but when an organization runs around saying they are attacking targets, and when that organization has no real leadership (collective/mob), they also can't cry foul if someone co-opts their name, claims to be part of them (since they have no real membership requirement or leadership, whose to say), and decides to either:
1) Partake in the attack even though it has been officially "called off" (hey, just because most of Anonymous might be clueless, doesn't mean some of it can't hack/crack with the best of them.
2) Use your name as a convenient scape goat to pin their crime on (okay, we take as much data as we can, and point the finger at THOSE guys over there).
Either which way, saying "Anonymous Denied all Responsibility, It MUST BE SONY'S FAULT!" is the biggest LOL of them all.
Its the fault of the malicious idiot who attacked and broke into the network. Yeah, Sony should have done a better job securing the data, but that does not absolve the THIEF of responsibility (in spite of what most slashdotters seem to think).
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco.
Meanwhile in reality:
Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony attacking a hacker in a hopeless attempt to control information that had already slipped far out of it's control in federal court in San Francisco.
Looking for credit card info? Anonymous tends to do things for idealogical reasons, AFAIK. There may be some overlap, but this sounds like organized crime. And yes, known vulnerabilities are things you should not be vulnerable to if you have credit card info for even two million people.
Getting anonymous mad at them might not be the best strategy for beefing up the image of their security, though.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
FTFA:
We also informed the subcommittee of the following: ...
- We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named "Anonymous" with the words "We are Legion." ...
Well, it may be slander, but they claimed (Under Oath?), that they were informed that Anonymous was responsible for the break-ins on the SOE servers. I don't think they actually said "Anonymous is behind the attacks", they just listed the evidence they have found since then.
Sony itself freely admits that Anonymous may have not been involved in the attack itself, but states that the initial intrusion seems to have happened at the same point that the initial Anonymous DoS attack did, and that the initial attack, knowingly or not, helped provide concealment for the breach.
Specifically read the last 3-4 paragraphs on:
http://www.flickr.com/photos/playstationblog/5687533298/in/set-72157626521862165/lightbox/ and the first one on http://www.flickr.com/photos/playstationblog/5687532796/in/set-72157626521862165/lightbox/
(I'd copy and paste the relevant paragraphs, but its tough to do that with pictures, so if you really care, go read what they wrote).
If Anonymous ISN'T behind these attacks and just patsies/dupes (as Sony admits is possible), then they should probably use much of their world renowned internet ability to help track down who ACTUALLY broke into the servers, if for no other reason than to clear their name.
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
I hate linking to this POS paper but here's the story http://www.theprovince.com/life/Privacy+czar+scolds+Sony+calls+power+levy+heavy+fines/4725743/story.html
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
not sure if there's a paywall up, but WSJ has an article entitled 'Sony Says Hacker Left Taunting Message' in it, it says Sony is claiming the hackers left a file on the server entitled Anonymous, with contents saying 'We are Legion'.
Sony said on Wednesday that Anonymous targeted it several weeks ago using a denial of service attack in protest of Sony defending itself against a hacker in federal court in San Francisco. The attack that stole the personal data of millions of Sony customers was launched separately, while the company was distracted protecting itself against the denial of service campaign, Sony said. Sony said it was not sure whether the organizers of the two attacks were working together.
If Anonymous had stolen the data, it would be on TPB/Bittorrent right now. Remember HBGary?
Sony would have blamed Bin Laden had he not been killed by the US earlier this week. They had to find some other scapegoat so that's why it took so long for their official blaming.
Saying anonymous is responsible for this (or anything) is like saying democracy is responsible for causing the wars in the middle east. You're mixing up an idea, an ethos, with an organization.
Are you equating the loosely-affiliated group Anonymous with a concept like democracy, or are you redefining the common definition of Anonymous as a loosely-affiliated group to now mean anyone involved in hacking or online attacks for an ideological reason other than financial gain? I've never heard proponents of democracy, or any other ethos, say something as cheesy as "We are [ethos]. We are Legion. Expect Us." The words "we" and "us" clearly identify people as a group. That is, even Anonymous thinks they're a group and not just an ethos. They are not an ethos, they are a group of people with some common world views, regardless of whether or not they have an official roster.
It's perfectly reasonable that a not-for-profit attacker would in fact steal valuable information just to steal it, not necessarily to release or sell it. It makes Sony look much worse, and costs them more, to have their customers' financial and personal data stolen, even if that information never actually gets used or released. In addition, it's not Sony's customers that Anonymous wants to attack, it is Sony itself. It doesn't serve their goals to release customer information, all they need to do is steal it. In other words, it would fit in with the idea of revenge against Sony to simply do as much damage to them as possible even if you don't plan on benefiting directly from the attack.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
It is entirely Sony's fault. Once a company has decided to protect my personal property and fails to do so, it's that company's fault. Completely. If I put valuables in a bank vault and the bank gets broken into I blame the bank, not the thief. Thievery like this isn't random, it's a statistical inevitability that Sony didn't prepare for. They were happy taking the money of the people using their service and didn't uphold their end of the bargain: secure their $#!+.
i wonder if sony can sink lower. default, problem-free blaming - screwed up ? blame anonymous. nuclear accident ? blame anonymous. martian invasion ? blame anonymous. i can see unlimited use for this 'blame anonymous' thing.
Read radical news here
Now, I'm not saying that this was sophisticated attack. I don't know. But the fact remains that any network/server can fall to this kind of stuff.
Most security admins acknowledge it too which is why logging is enabled, roles are separated out, teams perform penetration testing an so forth.
I have no idea how sophisticated the attack against Sony was but the way they're talking of moving their data centers and that they had defence at the perimeter suggests to me that someone broke in through their intranet or wifi (e.g. sitting in their carpark) to gain access rather than through a public facing interface to the service.
It sure would be.
<xml><I><am><so><damn>Web 2.0</damn></so></am></I></xml>
Because there are different ways to approach the problem and heavy-handed lawyer-inflicted abuse makes you look like a total jerk.
Marcon hacks Wii and adds the "Homebrew Channel", which has never enabled piracy (although some others have built upon it to do so). Nintendo releases a firmware update. Marcon re-opens Homebrew Channel. Ninetendo releases another firmware update, which bricks a few Wiis on accident. Marcon re-opens Homebrew Channel and finds a way to un-brick some of the bricked Wiis. Nintendo pretty much just leaves the issue alone, not wanting to harm their customer base even more.
Note, at no time did Nintendo sue Marcon, remove features that were advertised with the product, etc. And when they realized their strategy was doing more harm than good, they backed off a little. Nintendo is still making a fortune off of Wii, BTW.
Contrast Sony. They said you could install Linux on your Playstation, but not use about half the hardware. GeoHot figures out how to use ALL the hardware. Instead of realizing what's best for everyone involved, in a control-freak driven rage they remove OtherOS. GeoHot casually puts it back. Sony removes it again, makes it so future firmware updates are forward-only, and requires all their game and BluRay partners to do a firmware check on all new releases. And they drag GeoHot into court on what should be freedom of speech. Then, they subpoena all visitors to GeoHot's website, everyone who ever gave him money, etc., etc., really making enemies of millions of unrelated people. All this in addition to their track record of installing a rootkit on customers' PCs when listening to music (a 5-10-year felony if you or I did it) and taking back purchases from thousands of customers and refusing to lift a finger to give them back.
Sony is NOT the victim here. And they are being punished for legitimate crimes (hacking, theft) by vigilante justice because the courts and governments haven't done their job.
Peter predicted that you would "deliberately forget" creation 2000 years ago...
very carefully planned, very professional, highly sophisticated
Is this supposed to be the same "Anonymous" that's supposed to have its home on 4chan's Random board? 'Cause none of these qualities bring those users to mind.
I suggest Sony look elsewhere. I'm pretty sure "very carefully planned, very professional, highly sophisticated" and "Anonymous" are mutually exclusive possibilities.
Let q be a radix > 1. I am in ur base-q, killing 10 d00ds.
due entirely to Sony's fuckwitted lack of security concerning sensitive data, I have had to take measures to protect my identity
Fuckwitted, indeed. By making this (dubious sounding) claim, they have just poked anon with a stick after it has just been demonstrated that they have a major security problem. There is a fair chance that anon has a sizable population of already irritated PSN users. In light of the whole HBGary fiasco, does this REALLY seem like a wise thing to do?
GG Sony, you are proving to be more entertaining by the day...
HA! I just wasted some of your bandwidth with a frivolous sig!