Slashdot Mirror
Sony Running Unpatched Servers With No Firewall
ewhenn writes "Security experts monitoring open Internet forums learned months ago that Sony was using outdated versions of the Apache Web server software, which 'was unpatched and had no firewall installed.' The issue was 'reported in an open forum monitored by Sony employees' two to three months prior to the recent security breaches."
Well THERE'S your problem.
IANAL, but shouldn't users have the reasonable expectation that their data would be secured? Is there a suit here?
Sent from my CR-48
Isn't that the typical response in situations like this, clearly the crackers figured it out because you mentioned that we're unpatched without a firewall.
Doing It Wrong!
Normally I would find it unbelievable but Sony continues to surprise me in all of the worst ways.
I mean who puts Windows (any flavor) servers public facing to the internet without a firewall..
Well apparently the Jeopardy answer would be- Who is Sony?
Aren't there privacy laws in the US that mandate fines for this kind of incompetence?
*SARCASM*
Sony's defense will be that this state is "standard industry practice" and to expect Sony to have taken more elaborate steps at being secure like updating the software or running firewalls and other protection services as well as things like honeypots and other intrusion detections measures is just not done by major internet service providers.
... I thought the super hackers at Anonymous are all to blame! I mean, sure, most members of Anonymous are the ones spending hours ENJOYING the PSN. But, you mean to tell me that Sony, a multinational corporation, covered up their own culpability and then lied and blamed it on an innocent (in this case) group of hacktivists? Like, Wooo, just like Cereal Killer from the movie Hackers told us!
I8-D
What a pile of tools. Ya know, Sony made a pile of money in the early sixtys ripping off German Reel to Reel tape machines. Yes, that`s counterfeiting.
Yeah, yeah... It's still illegal to break(?) into someone's house even if they leave the door open, but it does really make Sony look a bit foolish. Bring on the lawsuits!
OMG My lvl 75 Warrior Mage Presit was hacked, and I'm missing 3 bags of plenty and all my GOLD!!!!! (lol)
Encryption: I may not agree with what you say, but I will defend your right to encrypt it...
they can show there are some commonly accepted best practices
According to Spafford, security experts monitoring open Internet forums learned months ago that Sony was using outdated versions of the Apache Web server software, which "was unpatched and had no firewall installed."
Which version?
And what do they mean where not running a firewall? And this was reported on a forum?
You know that I heard that CmdrTaco is running Slashdot on an unpatched Windows 95 box using Boa 1.0 and isn't using a firewall.
Can we not repeat unsubstantiated rumors? I really hope this is just really bad reporting and our that Congress is not taking statements like "It was reported on a forum" as evidence. Now if they have proof that this is true and it was reported on a forum it is interesting but just reported a forum is junk.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
As someone who works in protecting a large environment, I would never allow a server to run "open" on the internet without restricting access to the machine via a firewall. Any exploit that works against the machine could give external users access to other ports - which with a firewall in place, wouldn't cause instant chaos. There are definitely other avenues that you could work against here - but by whitelisting only what's needed from outside to inside, you'll be an order of magnitude safer against attacks you may not be knowledgeable about.
Karnal
after the disarmament is even further underway, so many resources will be freed up, that the real atmosphere might even return to quell the unending atmostfear of discomfort caused by the chosen ones life0cidal holycost activities. the citizen 'bailout' oddly enough, would cost 1/10th of the bank rescues, 1/100th of the unproven war efforts, & leave each citizen with more 'stability', than ever before, it's all gone, again
Ok, so it was specifically in regard to their internet forums but it does tend to suggest a fair amount of complacency regarding security which would extend beyond those forums.
Well that would seem to be proven.
They first had to get around the impenetrable wall set up by sony. Then they had to find the data, which sony hid in the most secure place they could. What better place to hide something than right in plain sight labeled "Credit Card Info". Sony you sly fox, using reverse psychology on hackers.
Sony took more care to lock the customer out of equipment the customer owned on the customers premises to "protect Sony's IP" than they took to protect the customers data running only Sony's servers at Sony's premises.
Looks like they need to move their security staff to the hosting side.
Sam
blog.sam.liddicott.com
Are you also not keeping it up to date? It's the combination that makes it really bad.
which is totally what she said
This just keeps getting better and better!
reported in an open forum monitored by Sony employees
Why the hell they only posted it on a forum, made assumptions that Sony employees monitor and didn't actually report directly to Sony, if there was something actually wrong?
Hack the planet!
The thread was deleted for "security reasons" and nothing else happened.
No, I did not read TFA, but I know Sony.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Am the only one running apache without a firewall ?
No, we're all running your machine, too!
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
A whitelist that protects what's needed from outside to inside, does nothing against an exploit that spawns an internal shell listening from inside to out. Even then depending on the configuration and the level that the server was compromised a web page with a pass-through script will run most anything from within a web browser and the Apache server on port 80 again useless firewall.
I am Bennett Haselton! I am Bennett Haselton!
If this is indeed true then I suspect a very strong case can be made for willful negligence:
Willful Negligence. Intentional performance of an unreasonable act in disregard of a known risk, making it highly probable that harm will be caused. Willful negligence usually involves a conscious indifference to the consequences. There is no clear distinction between willful negligence and gross negligence.
According to Spafford, security experts monitoring open Internet forums learned months ago that Sony was using outdated versions of the Apache Web server software, which "was unpatched and had no firewall installed."
Just unpatched Apache HTTP server and absence of firewall could hardly be a reason/means for a successful intrusion/exploitation. I know a lot of popular web servers which have not so fresh apache server and they don't run any sort of firewall, yet user' data is safe and no intrusions have occured.
It's more likely their platform contained SQL injection vulnerabilities or other vulnerable/outdated software 'cause apache web server has a good record of being immune to attacks.
One should always remember that a properly configured web server should never expose any unnecessary services to the WAN in case your firewall rules are not correct or they are not properly enforced. E.g., if you run a usual web server, theoretically and in the best case scenario you should have the only listening port: 80 (or/and 443 for SSL connections) and maybe port 22 for incoming SSH connections (but I personally always reconfigure SSH daemon to listen on any other port other than 22).
Right now I am glad that I don't use PS3, PSN, or SOE products or services as I am a computer gamer & wasn't interested in SOE games. I don't use Sony hardware in my PC since the Sony rootkit issue. I did have some respect for the Sony brand when it came to electronics and non-PC hardware but after this fiasco I will take my money elsewhere. As I register my products I don't want a company with lax security & little respect for my information to handle my any of my data. The only way for Sony to make a little face is to terminate all employees (individual contributor & management) who had a part in securing systems with user data. That would mean all the way up the management chain if high level execs had a part, even a small part.
it's Anonymous's fault! Hacking poor Sony's vulnerable servers...the gall! [/sarcasm]
Doesn't putting your web server behind a firewall rather defeat the point of a web server?
Is this like how it was fact 77 million unencrypted credit cards were stolen and all were damned to fraud ruination? I mean thats what all the news sites were declaring. But come to find out sony had them encrypted and didnt have the ccv codes with them.
Come on you guys, this is just crap meant to get site hits and nothing else. Do you really, honestly think a multi billion dollars worldwide company thats been around as long as sony would be running old software with no protection? Idiots.
When this first happened you all hated and bashed sony, then you sided with sony and now your bashing them again. Your all just limp idiots who will ride on whatever bandwagon is popular at that second. You have no minds of your own and just want a reason to complain and give your pathetic armchair legal information out like you actually know what your saying because you have no self esteems and giant egos.
You guys are pathetic.
... if they're sending a letter to my old address in the dorms, when I used to play EverQuest 1 on my old P3-450 running Windows 98 (First Edition).
Too bad mail forwarding for that address ended 9 years 6 months ago.
About a year ago, My credit card was billed 150$ for Playstation repairs by Sony. I don; town a playstation. The only credit card info Sony had on me was for an everquest account that I had.
I contacted Sony and let them know that I did not pay for repairs as I do not own a playstation. I was told that they would not remove the charge and that I would have to contest it thought the credit card company. They also informed me that if the charge was contested, they (Sony) would cancel the playstation network account associated with the playstation that was repaired.
I contested the charge through the credit card company and went through the whole hassle of changing ALL credit cards and notifying all business that I do transactions with.
Maybe Sony is charging people for 150 here and there to pay for their lawyers. Now that people are calling Sony on the fraudulent charges, they can say that they were hacked....
(Yea, I know, Who would steal credit card numbers from Sony and use the same info to buy Sony stuff.)
I had stopped buying everything sony, cancelled my EQ, etc when the Rootkit fiasco hit and I was burned by that for putting a CD in my computer.
Bastards.
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
"First things first -- but not necessarily in that order"
-- The Doctor, "Doctor
> You realise the basis for this claim is an IRC chat log...
> Hardly a reliable source of information..... Slashdot epic fail....
If anyone takes them to court--almost impossible if they wrote their agreements well, but possible, perhaps for family members' whose credit cards were used without having signed the agreements or the like--they can get much better proof in discovery.
> I have to wonder, are ALL Americans as dumb as the poster of this "news"?
TFA points to Congressional testimony. Even if it was based on what a security expert mentioned in an IRC channel--or is even more remote than that--that doesn't make it wrong. Also, TFA doesn't mention an IRC channel, so whoever posted the slashdot article can hardly be called a dumb American for posting it, even if we were to grant that having IRC as a source necessarily makes posting a story dumb, AND even if we were to take for granted that doing something dumb makes a person necessarily dumb.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
Everytime a new PS3 firmware comes out, with "security updates" you are almost forced to install it or you lose PSN, plus other features, but they don't care about updating and securing their servers?
So they're using Debian then?
(Just kidding...Debian, I love you.)
It's likely that Sony went off-line not because they wanted to, but because VISA International and/or MasterCard Worldwide ordered them to. See my post on "What To Do if Compromised". The contract that merchants must sign to accept credit cards gives the credit card companies the right to send in a VISA fraud team, a Cardholder Information Security Team, and a computer forensics team. VISA can insist that compromised systems containing credit card data be taken off line until examined. For a big breach, VISA probably invoked their right to do all that.
The process is expensive for the merchant who doesn't have the VISA-required security measures in place. They get hit with fines from VISA, the cost of the forensics work, and chargebacks from compromised credit cards. "If a Visa member fails to immediately notify Visa Inc. Fraud Control of the suspected or confirmed loss or theft of any Visa transaction information, the member will be subject to a penalty of $100,000 per incident. Members are subject to fines, up to $500,000 per incident, for any merchant or service provider that is compromised and not compliant at the time of the incident." Worse, from a business perspective, they can't accept credit cards again until VISA's team says they're secure.
Then comes the "Account Data Compromise Recovery phase. For the next 13 months, the merchant gets hit with charges related to compromised credit cards.
A merchant-side compromise of credit card data means the merchant gets stuck with all the costs of the breach.
I know slashdot likes to bash sony, but this time sony exec are not at fault, it's not like they are the one who choose to run a server without a firewall, so it's some sysadmin that did something stupid, also it was probably the same sysadmin who went rogue, after all sony is moving its datacenter to a new location, yeah they were probably planning to do that from quite some time, but now instead of restoring the psn as fast as possible they want to move everything too
PCI compliance can be a cover up, and a cover story over many troubled companies. I work at one, where I was instructed to be creative when it came to giving answers. Patching was always an annual affair, generally before the auditor came onsite. As for external pens tests, they can be faked. At one stage we pointed the pen testers at a non-production test system, with a completely different version of software. Thank god I am out of that sector now. Sony are liable for costs from the Credit card companies. I was told it was $100 an exposed card number. So they could be liable for billions.
Qualified Security Assessors perform a certain task at a certain time. They check for compliance to the numbered PCI requirements. What they check for when it comes to "patch level" is typically a report generated from a patch system. They don't typically have time to compare *all systems* to a patch report. They read the data that the organization compiles for them. They could very well have been given a list of systems, the required artifacts for those systems, and signed off on the assessment based on that information.
The problem is, there's no requirement for *real* testing of the systems, they are required to review what has been provided. Sony could very well have done a crappy job documenting their Credit Data Environment, or deliberately left components they know weren't compliant out of the provided information to the QSAs.
Not to mention, the QSA work is often done by the lowest bidder, in short timelines (just before the requirement is due etc) and bullying from the client because they "disagree" with a finding is common. This often results in erroneous "passed" pci audits.
Web servers do not need firewalls. If your servers are only providing public facing services there is no need to firewall them. In fact, firewalling them can make them more vulnerable to DDoS attack.
They were depending on Anonymous to keep the servers patched, hence the blame. "Expect Us" was logicaly taken to mean "Expect us between 2 to 5 on Friday to apply the service packs".
Its nice how media now links this kind of information to the recent breach by using sentences like "they [Sony] knew about this [outdated Apache] months before PSN breach" but what I'm missing here is how (and if) this actually affected the breach itself.
Without that kind of information stories like these are hardly worth the attention because all they do is speculating.
As a long-time subscriber to SOE games, I can say that I am just flat-out disappointed.
It's not just anger, it's not just disbelief... it's disappointment. As if I just found out that my kid is the bully at school, steals lunch money, and spouts hate speech.
I know that the people I know, personally, in SOE (devs, community relations) didn't have control over this, but some people at most levels had to know.
Ouch, guys. Ouch.
(http://t0.gstatic.com/images?q=tbn:ANd9GcQngiRrhTv_0WdVtJjX3aUV8a4o7zuyAY_CTUwHPpFdmtZ9_897&t=1)
This is exactly what you should expect from a free service. What where they thinking? The console cost at least $300. The games are $60, users would not mind paying the $50 a year to have a secure network. This is the direct result of "free" service. You get what you pay for....
Posting AC on purpose, so I don't get my butt sued.
There's something inaccurate about this report.
I don't work there currently, but I did. I can say with absolute certainty that the PSN web servers *were* behind firewalls and not open to the open internet. Not only were they behind firewalls, many of the outtages over the years on PSN and SOE servers were a direct result of those firewalls. The system admins were so uptight, they regularly closed off firewall holes that were necessary. Like the ability for servers to talk to each other. It was a constant headache, as it would always take an hour for them to backtrack the issue and find out what hole got closed and repair it.
I'm not sure what servers this report is referring to, but understand Sony is a HUGE entity. It *is* possible that there were Sony servers from a different group run this way. But the PSN servers and SOE servers were not. Someone has their information wrong. Also, understand that all Sony data centers are not connected to each other. So the argument that a single server like this is enough doesn't play.
The ad for a free copy of "Vulnerability Management for Dummies" that appeared beside this article when I first clicked on it was a nice touch.
Someday, you're going to die. Get over it.
In a letter to the committee, Sony said it has added automated software monitoring and enhanced data security and encryption to its systems in the wake of the recent security breaches.
After reading the above I just wanted to scream! All of those things should have been setup to begin with not added after a breach. What they should be doing now is firing all of their admins and hiring some who actually know what they are doing rather than people they found wandering around the local Walmart.
I AM A SEXY SHOELESS GOD OF WAR!!!
I apologize, I should also state there are explicit rules inside to outside too. Businesses should not run their servers like a home network to where the server has unfettered access outbound - or to other network areas, if necessary. Also - deep packet inspection on the firewall can nail a lot of what could be seen as unexpected protocols running across common ports (someone attempting ftp/SMB over port 80 for instance.)
Karnal
And it was a genius idea to put the credit cards on a webserver !
You never expose your important data.
If you really need to store credit cards, you put them on your local network, and provide web services to validate the data, but never store anything on the web server.
from the SWG days I dub this as "WORKING AS INTENDED" eff you SOE you deserve it. you scum bags remember remember the 15th of november.
Things like this are just glimpses of Sony's disfunction. Their "technical practices" internally, are just, if not more grievous. Test/prod envs, what are those? How to test CC transactions, live "fake" CCs? Backup/restore, huh? What a joke, thankfully none of it matters, it's just a game.
What is a firewall going to do? If the admins have just a tiny bit of sense (apparently not), they disable non-essential services. That means: the only thing accessible remotely is ports 80 and 22. If there is a separate database server, then a firewall could make sense, but they could still password-protect it and restrict it to local IPs.
There is *nothing* a firewall can do! There could be a bug in the TCP/IP stack on the server, but there could equally well be a bug in the stack or packet processing on the firewall, which is *just another computer to target*! They would have another choke-point in the network, where if a hacker takes down the FW, then all of the network is down.
Running vulnerable software is unforgivable, not running a firewall is just a design choice. Peole get too excited by pre-packaged security "solutions" -- they have their place, but they aren't the only way of achieving security.
GUTEN TAG, Wii Gehts, Wednesday (NTN) — Sony has revealed that the Playstation Network security breach, which compromised 24.6 million credit cards, was entirely the work of evil hackers from Anonymous, and nothing to do with their own incompetence, honest.
"We discovered a file making a clear reference to 'Username unknown,'" the company said in a letter to the US Congress on Wednesday, "and a blank user icon which therefore was anonymous. D'you see what that means? It means George Hotz and his hacker friends are loathsome criminal masterminds! So obviously we can't be held liable for negligence in the face of forces like these. In conclusion, give us money."
The letter details the company’s actions over the past two weeks. It says Sony acted with "care and caution" in deciding how to act and how long it thought it could get away without telling anyone. "We did not want to cause confusion and cause customers to take unnecessary actions, such as stopping their credit card payments to us."
"We have suffered a very carefully planned, very professional, highly sophisticated criminal cyberattack, which has led to people committing the heinous hate crime of jailbreaking their PS3s. In accordance with our campaign contributions, we ask that you impose the death penalty for such offenses."
The letter concluded that the breakin was quite definitely the work of Anonymous. "We were going to blame Al-Qaeda, but we figured after Monday that you probably wouldn't buy that."
http://rocknerd.co.uk
Until the recent hack of nearly 100 million accounts, no one had heard of Sony, so they were secure by being obscure. That's always a good IT decision.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
IT
ONLY
DOES
'; union select cc_num from customers; -- (TM)
They likely could be PCI compliant by claiming that "old versions" were still secure and any "known" issues had their fixes backported. The whole PCI compliance thing is just a bunch of crap in my experience, where somebody magically decides that old versions are automatically vulnerable, so using the latest RHEL or CentOS won't automatically pass compliance. You have to file exceptions for everything saying fixes are backported. They just take your word for it and sign off, letting you basically claim compliance no matter what.
Morphing Software
I don't know if they were that old, see them discussed in #ps3dev on feb 16th:
http://173.255.232.215/logs/efnet/ps3dev/2011-02-16
apache 2.2.1
linux 2.6.9-2.6.24
Why am I not surprised? Incompetence of this nature seems like just cause to destroy the Sony corporation and liquidate its assets.
I write sci-fi for metalheads
Sony has a terrible attitude toward its customers. We entrust Sony to protect our information and they leave it on the Internet, without a firewall and possibly even unencrypted. The corporate officers need to do much more than bow to restore our confidence. Do the right thing: åè....
Based on some past articles at Consumerist that were sensationalized lies, I'm always suspicious when they make a claim like this. Anyone got a more reliable source for this?
"I disagree with you" does not equal "flamebait."
Serious question.... If you're only running apache with ports 80 and 443 open, what difference does a firewall make?
I wonder if it has anything to do with recent vacancies advertised in the Playstation division in San Diego. I had a couple of job ads in my email recently for DBA and Operational positions within that area. Nothing like a disgruntled BOFH to mess things up!
You realize that posting bullshit stories like this (and it's bullshit and you know it) is going to get you sued for slander right?
Unless they're talking about an application level firewall like mod_security what the hell good is a firewall gonna do? As long as port 80 is open it's going to be exploitable.
Soooo,
Sony should put a firewall on their web server to protect apache. How does this work?
Sony Exec: We are running old software that can be compromised what should we do?
Sony IT Manager: Lets put up a firewall and block users from port 80. That should fix it.
Seriously, did Sony's servers have other services running with ports exposed to the internet? Or is it really being suggested that Sony should have blocked the ports that were necessary for their customers.
"For I desired mercy, and not sacrifice" -- God
Is there a suit here ?
Indeed
Gross Negligence
The other day I posted this...
Though here's a question: How many other companies have the backbone to own up quite so readily, instead of trying to cover it up to save face?
what I am saying is that I generally don't trust businesses to keep secure personal and credit card information, which is why I didn't give Sony my credit card details (but sadly had to give my personal information.)
I still stand by that part, in that I expect that databases are cracked more often than we realise due to poor security, but that businesses keep dishonestly quiet about it.
But this part is such an understatement that I regret standing up for Sony at all...
it seems thay they're finally getting help to make their system more secure, implying that their efforts were not solid enough to start with
I mean, the sheer stupidity is astounding.
Not say this isn't a dumb move on Sony's part, but in reality I think this is pretty common. I know that in some small - medium sized companies, there are miles of red tape in the form of change management processes that you have to go through in order to install software patches. You have to fill out the form, get it approved by your supervisor, then it goes up to the dept head and they sit on it for a month, then finally they send it back with a stupid question that you already addressed in your request, so then you point that out and it goes back up the chain and sits for another month. A lot of sysadmins may have the desire to install the latest patches, but their hands are tied by management that wants to have a nice paper trail that documents the justification for each and every system change. I think you'll continue to see stuff like this happen until someone can make the pencil pushers realize that it's not the sysadmins fault, it's their fault for making the patch process take two months.