Slashdot Mirror
Sony Running Unpatched Servers With No Firewall
ewhenn writes "Security experts monitoring open Internet forums learned months ago that Sony was using outdated versions of the Apache Web server software, which 'was unpatched and had no firewall installed.' The issue was 'reported in an open forum monitored by Sony employees' two to three months prior to the recent security breaches."
Well THERE'S your problem.
IANAL, but shouldn't users have the reasonable expectation that their data would be secured? Is there a suit here?
Sent from my CR-48
Isn't that the typical response in situations like this, clearly the crackers figured it out because you mentioned that we're unpatched without a firewall.
Doing It Wrong!
Normally I would find it unbelievable but Sony continues to surprise me in all of the worst ways.
Aren't there privacy laws in the US that mandate fines for this kind of incompetence?
*SARCASM*
Sony's defense will be that this state is "standard industry practice" and to expect Sony to have taken more elaborate steps at being secure like updating the software or running firewalls and other protection services as well as things like honeypots and other intrusion detections measures is just not done by major internet service providers.
The problme was with unpatched Apache - maybe if they had been running IIS they would have been OK :)
... I thought the super hackers at Anonymous are all to blame! I mean, sure, most members of Anonymous are the ones spending hours ENJOYING the PSN. But, you mean to tell me that Sony, a multinational corporation, covered up their own culpability and then lied and blamed it on an innocent (in this case) group of hacktivists? Like, Wooo, just like Cereal Killer from the movie Hackers told us!
I8-D
What a pile of tools. Ya know, Sony made a pile of money in the early sixtys ripping off German Reel to Reel tape machines. Yes, that`s counterfeiting.
they can show there are some commonly accepted best practices
According to Spafford, security experts monitoring open Internet forums learned months ago that Sony was using outdated versions of the Apache Web server software, which "was unpatched and had no firewall installed."
Which version?
And what do they mean where not running a firewall? And this was reported on a forum?
You know that I heard that CmdrTaco is running Slashdot on an unpatched Windows 95 box using Boa 1.0 and isn't using a firewall.
Can we not repeat unsubstantiated rumors? I really hope this is just really bad reporting and our that Congress is not taking statements like "It was reported on a forum" as evidence. Now if they have proof that this is true and it was reported on a forum it is interesting but just reported a forum is junk.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
As someone who works in protecting a large environment, I would never allow a server to run "open" on the internet without restricting access to the machine via a firewall. Any exploit that works against the machine could give external users access to other ports - which with a firewall in place, wouldn't cause instant chaos. There are definitely other avenues that you could work against here - but by whitelisting only what's needed from outside to inside, you'll be an order of magnitude safer against attacks you may not be knowledgeable about.
Karnal
Ok, so it was specifically in regard to their internet forums but it does tend to suggest a fair amount of complacency regarding security which would extend beyond those forums.
Well that would seem to be proven.
They first had to get around the impenetrable wall set up by sony. Then they had to find the data, which sony hid in the most secure place they could. What better place to hide something than right in plain sight labeled "Credit Card Info". Sony you sly fox, using reverse psychology on hackers.
Sony took more care to lock the customer out of equipment the customer owned on the customers premises to "protect Sony's IP" than they took to protect the customers data running only Sony's servers at Sony's premises.
Looks like they need to move their security staff to the hosting side.
Sam
blog.sam.liddicott.com
Are you also not keeping it up to date? It's the combination that makes it really bad.
which is totally what she said
This just keeps getting better and better!
my firewall log would beg to disagree
Hack the planet!
The thread was deleted for "security reasons" and nothing else happened.
No, I did not read TFA, but I know Sony.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Am the only one running apache without a firewall ?
No, we're all running your machine, too!
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
If your house is holding many people's credit card details, and more, in a supposedly secure fashion, then it makes you look a bit more than foolish.
which is totally what she said
The problme was with unpatched Apache - maybe if they had been running IIS they would have been OK :)
I thought Apache was only meant for casino websites ran off the reservation.
A whitelist that protects what's needed from outside to inside, does nothing against an exploit that spawns an internal shell listening from inside to out. Even then depending on the configuration and the level that the server was compromised a web page with a pass-through script will run most anything from within a web browser and the Apache server on port 80 again useless firewall.
I am Bennett Haselton! I am Bennett Haselton!
Did you say LOL just in case some tool took your statement seriuosly :P
Have you fscked your local propeller head today?
I mean who puts servers using any operating system public facing to the internet without a firewall..
FTFY.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Right now I am glad that I don't use PS3, PSN, or SOE products or services as I am a computer gamer & wasn't interested in SOE games. I don't use Sony hardware in my PC since the Sony rootkit issue. I did have some respect for the Sony brand when it came to electronics and non-PC hardware but after this fiasco I will take my money elsewhere. As I register my products I don't want a company with lax security & little respect for my information to handle my any of my data. The only way for Sony to make a little face is to terminate all employees (individual contributor & management) who had a part in securing systems with user data. That would mean all the way up the management chain if high level execs had a part, even a small part.
it's Anonymous's fault! Hacking poor Sony's vulnerable servers...the gall! [/sarcasm]
Lemme know when you graduate high school, and you're looking for a sysadmin job, so I don't hire you.
Haida Manga
You laugh, but when you think about it and weigh PSN against XBox Live, Sony failed so hard they made Microsoft's security look good by comparison.
That's a special kind of failure. That's the full retard, if you will.
About a year ago, My credit card was billed 150$ for Playstation repairs by Sony. I don; town a playstation. The only credit card info Sony had on me was for an everquest account that I had.
I contacted Sony and let them know that I did not pay for repairs as I do not own a playstation. I was told that they would not remove the charge and that I would have to contest it thought the credit card company. They also informed me that if the charge was contested, they (Sony) would cancel the playstation network account associated with the playstation that was repaired.
I contested the charge through the credit card company and went through the whole hassle of changing ALL credit cards and notifying all business that I do transactions with.
Maybe Sony is charging people for 150 here and there to pay for their lawyers. Now that people are calling Sony on the fraudulent charges, they can say that they were hacked....
(Yea, I know, Who would steal credit card numbers from Sony and use the same info to buy Sony stuff.)
I had stopped buying everything sony, cancelled my EQ, etc when the Rootkit fiasco hit and I was burned by that for putting a CD in my computer.
Bastards.
~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
"First things first -- but not necessarily in that order"
-- The Doctor, "Doctor
> You realise the basis for this claim is an IRC chat log...
> Hardly a reliable source of information..... Slashdot epic fail....
If anyone takes them to court--almost impossible if they wrote their agreements well, but possible, perhaps for family members' whose credit cards were used without having signed the agreements or the like--they can get much better proof in discovery.
> I have to wonder, are ALL Americans as dumb as the poster of this "news"?
TFA points to Congressional testimony. Even if it was based on what a security expert mentioned in an IRC channel--or is even more remote than that--that doesn't make it wrong. Also, TFA doesn't mention an IRC channel, so whoever posted the slashdot article can hardly be called a dumb American for posting it, even if we were to grant that having IRC as a source necessarily makes posting a story dumb, AND even if we were to take for granted that doing something dumb makes a person necessarily dumb.
-- IANAL, this isn't legal advice, and definitely isn't legal advice for you. Also, Squee!
Everytime a new PS3 firmware comes out, with "security updates" you are almost forced to install it or you lose PSN, plus other features, but they don't care about updating and securing their servers?
It's likely that Sony went off-line not because they wanted to, but because VISA International and/or MasterCard Worldwide ordered them to. See my post on "What To Do if Compromised". The contract that merchants must sign to accept credit cards gives the credit card companies the right to send in a VISA fraud team, a Cardholder Information Security Team, and a computer forensics team. VISA can insist that compromised systems containing credit card data be taken off line until examined. For a big breach, VISA probably invoked their right to do all that.
The process is expensive for the merchant who doesn't have the VISA-required security measures in place. They get hit with fines from VISA, the cost of the forensics work, and chargebacks from compromised credit cards. "If a Visa member fails to immediately notify Visa Inc. Fraud Control of the suspected or confirmed loss or theft of any Visa transaction information, the member will be subject to a penalty of $100,000 per incident. Members are subject to fines, up to $500,000 per incident, for any merchant or service provider that is compromised and not compliant at the time of the incident." Worse, from a business perspective, they can't accept credit cards again until VISA's team says they're secure.
Then comes the "Account Data Compromise Recovery phase. For the next 13 months, the merchant gets hit with charges related to compromised credit cards.
A merchant-side compromise of credit card data means the merchant gets stuck with all the costs of the breach.
PCI compliance can be a cover up, and a cover story over many troubled companies. I work at one, where I was instructed to be creative when it came to giving answers. Patching was always an annual affair, generally before the auditor came onsite. As for external pens tests, they can be faked. At one stage we pointed the pen testers at a non-production test system, with a completely different version of software. Thank god I am out of that sector now. Sony are liable for costs from the Credit card companies. I was told it was $100 an exposed card number. So they could be liable for billions.
A month ago Sony could also say no intrusions had occured user data was safe.
I wish things were as you say. However, many applications written in e.g. LAMP stacks allow the web server full read access on the entire database, and often even write access.
I would hope Sony isn't so stupid, but for example you will often find a configuration file which contains this username/password and can connect to the database. This file often needs to permit read access by the webserver because the application itself needs this access. Hence, given access to the webserver, it would be fairly trivial to gain access to the entire database on such a simple setup. This is sadly true in just about every PHP application you can install, as well as every custom-made software stack I have seen used in small organizations.
However, note that I said small organizations. Having a single database server in a company as large as Sony would make sense, so they would have to design a better system. Plus, sending SQL over the clear in a large network is a horrible idea. I would expect better security, in which access to the webserver would only compromise transactions going through that system and not the whole database (you would steal 100 credit card numbers, not 10 mil). For example, using a very narrow layer between the webserver (which is accessible to the outside) and the database service, where you only have commands for valid actions, e.g. "purchase(sessionID, game)" or "login(username, password)"
Furthermore, using virtualization, user account isolation, and operating-system sandboxes like SELinux, you should be able to restrict any damage should the webserver itself be compromised. I would expect any large tech company to have this level of security.
Web servers do not need firewalls. If your servers are only providing public facing services there is no need to firewall them. In fact, firewalling them can make them more vulnerable to DDoS attack.
They were depending on Anonymous to keep the servers patched, hence the blame. "Expect Us" was logicaly taken to mean "Expect us between 2 to 5 on Friday to apply the service packs".
The merchant's external ASV and internal vulnerability assessments should have had red flags all over them, so ignorance is certainly no excuse. The QSAs may never know the difference as you say, and it's up to the merchant to specify scope for the external scans. These things should make a large difference if followed in good faith.
OK, I realize you're a tremendous troll, but for a lark I did the math. A million dollars for each citizen of just the US is 300 trillion dollars. That's about four times the GDP of the entire world. That's worlds away from the cost of every war, and bank bailout in US history combined. Possibly world history.
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
As a long-time subscriber to SOE games, I can say that I am just flat-out disappointed.
It's not just anger, it's not just disbelief... it's disappointment. As if I just found out that my kid is the bully at school, steals lunch money, and spouts hate speech.
I know that the people I know, personally, in SOE (devs, community relations) didn't have control over this, but some people at most levels had to know.
Ouch, guys. Ouch.
(http://t0.gstatic.com/images?q=tbn:ANd9GcQngiRrhTv_0WdVtJjX3aUV8a4o7zuyAY_CTUwHPpFdmtZ9_897&t=1)
This is exactly what you should expect from a free service. What where they thinking? The console cost at least $300. The games are $60, users would not mind paying the $50 a year to have a secure network. This is the direct result of "free" service. You get what you pay for....
if it was "unpatched" that generally means that there were security bugs in the version of apache that was running (otherwise they would have just said it wasn't up to date which wouldn't matter). If this web server was within the same scope as their cc processing system that would probably be a pci failure (not sure what vulnerability was). No one is saying that this was some vulnerability that would have allowed an attacker to run arbitrary code as root on the server however it may have given an attacker information on how their network was set up allowing them to find a more dangerous security vulnerability. Also apache httpd server doesn't have a good record of being immune to attacks, it's just not known to have more than expected.
The following is a list of security vulnerabilities that have been fixed in just apache httpd server 2.2
http://httpd.apache.org/security/vulnerabilities_22.html
The Sony executives can't have things both ways. They are quick to put themselves forward as the reason for the companies successes so conversly they must also take the blame for the failures. While they weren't the ones who setup the servers they are the ones who hold the overall responsibility for safeguarding our personnal information.
I AM A SEXY SHOELESS GOD OF WAR!!!
The ad for a free copy of "Vulnerability Management for Dummies" that appeared beside this article when I first clicked on it was a nice touch.
Someday, you're going to die. Get over it.
In a letter to the committee, Sony said it has added automated software monitoring and enhanced data security and encryption to its systems in the wake of the recent security breaches.
After reading the above I just wanted to scream! All of those things should have been setup to begin with not added after a breach. What they should be doing now is firing all of their admins and hiring some who actually know what they are doing rather than people they found wandering around the local Walmart.
I AM A SEXY SHOELESS GOD OF WAR!!!
it shows that the company wasn't concerned with security. If a company was doing everything in it's power to keep it's networks/data secure it would be hard to fault them... if there is proof that they knowingly ignored security problems then they would have more liability for any security failures.
I apologize, I should also state there are explicit rules inside to outside too. Businesses should not run their servers like a home network to where the server has unfettered access outbound - or to other network areas, if necessary. Also - deep packet inspection on the firewall can nail a lot of what could be seen as unexpected protocols running across common ports (someone attempting ftp/SMB over port 80 for instance.)
Karnal
Far more likely is some beleaguered sysadmin made pointed comments and emails to management who were too "busy" with their "meetings" at the 19th hole to act on. A sysadmin can only do what his PHB's give him/her time and budget to accomplish. Been there, done that, got the T-shirt and the other kitsch. Lemme say, I don't miss the having my name associated with such idiocy.
There is no right to feel safe thru security vaudeville at the expense of everyone's freedom, privacy and tax money.
And it was a genius idea to put the credit cards on a webserver !
You never expose your important data.
If you really need to store credit cards, you put them on your local network, and provide web services to validate the data, but never store anything on the web server.
Everybody knows you never go full retard.
GUTEN TAG, Wii Gehts, Wednesday (NTN) — Sony has revealed that the Playstation Network security breach, which compromised 24.6 million credit cards, was entirely the work of evil hackers from Anonymous, and nothing to do with their own incompetence, honest.
"We discovered a file making a clear reference to 'Username unknown,'" the company said in a letter to the US Congress on Wednesday, "and a blank user icon which therefore was anonymous. D'you see what that means? It means George Hotz and his hacker friends are loathsome criminal masterminds! So obviously we can't be held liable for negligence in the face of forces like these. In conclusion, give us money."
The letter details the company’s actions over the past two weeks. It says Sony acted with "care and caution" in deciding how to act and how long it thought it could get away without telling anyone. "We did not want to cause confusion and cause customers to take unnecessary actions, such as stopping their credit card payments to us."
"We have suffered a very carefully planned, very professional, highly sophisticated criminal cyberattack, which has led to people committing the heinous hate crime of jailbreaking their PS3s. In accordance with our campaign contributions, we ask that you impose the death penalty for such offenses."
The letter concluded that the breakin was quite definitely the work of Anonymous. "We were going to blame Al-Qaeda, but we figured after Monday that you probably wouldn't buy that."
http://rocknerd.co.uk
Well, I know that when I had to go through it regularly, we did have to complain about some of the remote scanning.
Here's a few of the BS items that we had been flagged with. These are from memory, so I may be wrong on some of the wording.
The server does not respond to ICMP (red flag). Well, the server blocked all unexpected traffic, including ICMP. So we opened the firewall a little for that.
They complained that they were not getting refused connection messages to known ports (telnet, SMTP, etc), so we were flagged for that. That's where I started complaining.
They wanted the firewall completely opened for "testing". This was current production, so I refused. I told them I could allow a single IP for them to test with, but they wouldn't oblige. Since we were always under attack, their IP was one of several hundred during the period where they were most likely testing. 1 tester, and a few hundred attackers. Hmm, no.
They proceeded to search the surrounding network. They red-flagged us for having a server on the network that responded to DNS requests. Oddly enough, that was a DNS server. Then they hit us for having a mail server that accepted mail. Sure, it accepted mail. It only relayed for us, but we did (oh my gosh) receive mail. They didn't receive an instant refusal, because we accepted and dropped those messages.
I passed the word back through our accounting guy that they could go fuck themselves, and to give us a real auditor...
The second auditor wasn't quite so bad. They hit us for not being able to fingerprint the OS. I congratulated them on that, and then told them specifically the OS, distro, and kernel version. They had a few yellow flags for non-broken stuff, such as not responding to ICMP. They didn't mark points against us on that one, it was just a mention. They questioned our remote access ability, since the only ports that responded were 80 and 443. I told them the port number (unusual port) and method, so they beat on that for a while and couldn't touch it. Then they gave us a pass.
We were fully compliant. I wasn't hiding anything from them. I was hiding everything from the constant barrage of hackers who wanted in. People knew we made millions. They knew we had a whole bunch of machines on multiple GigE circuits. If they could compromise just one machine, they'd have a very fast platform to attack from, and I wasn't going to allow that.
We were very successful in never losing any personal info, but we always maintained doing better than PCI compliance required.
Serious? Seriousness is well above my pay grade.
No, because the firewall is obviously configured to allow incoming connections on port 80.
Kirk Lazarus: Everybody knows you never go full retard. Ask Sean Penn, 2001, "I Am Sam." Remember? Went full retard, went home empty handed.
I wonder if Kirk has a newsletter that I can subscribe to... http://www.youtube.com/watch?v=SgHITc1OL-c
If the exploited flaw allowed arbitrary commands to be sent via Apache but did not result in output from Apache that was useful to the hacker (and needed to hack in further to get the target data, they would need to send the output by some other means. In this instance a firewall would be able to help by blocking outgoing connections that were not to a set whitelist of destinations.
While closing off all unneeded services does not protect you from many attack vectors without the need for a firewall, it is conceivable that there are a number that it would not necessarily block and a well configured firewall would. Single level security is more likely to fail, particularly in the presence of a previously unknown flaw though that is not the case here, than security in depth.
Until the recent hack of nearly 100 million accounts, no one had heard of Sony, so they were secure by being obscure. That's always a good IT decision.
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert
IT
ONLY
DOES
'; union select cc_num from customers; -- (TM)
They likely could be PCI compliant by claiming that "old versions" were still secure and any "known" issues had their fixes backported. The whole PCI compliance thing is just a bunch of crap in my experience, where somebody magically decides that old versions are automatically vulnerable, so using the latest RHEL or CentOS won't automatically pass compliance. You have to file exceptions for everything saying fixes are backported. They just take your word for it and sign off, letting you basically claim compliance no matter what.
Morphing Software
Why am I not surprised? Incompetence of this nature seems like just cause to destroy the Sony corporation and liquidate its assets.
I write sci-fi for metalheads
people who can competently configure a server?
Come on you guys, this is just crap meant to get site hits and nothing else. Do you really, honestly think a multi billion dollars worldwide company thats been around as long as sony would be running old software with no protection? Idiots.
Yes, we do. Because we've either witnessed it first hand or heard the reports of when it happens time and time again.
To get large and old, a company doesn't have to do anything other than keep costs significantly below revenue for a sustained length of time. Its possible to do that by without the boys in the basement being on top of their game.
Sony has a terrible attitude toward its customers. We entrust Sony to protect our information and they leave it on the Internet, without a firewall and possibly even unencrypted. The corporate officers need to do much more than bow to restore our confidence. Do the right thing: åè....
Based on some past articles at Consumerist that were sensationalized lies, I'm always suspicious when they make a claim like this. Anyone got a more reliable source for this?
"I disagree with you" does not equal "flamebait."
Unless they're talking about an application level firewall like mod_security what the hell good is a firewall gonna do? As long as port 80 is open it's going to be exploitable.
Yea, it only has port 80 open.. until you're done hacking apache..
Soooo,
Sony should put a firewall on their web server to protect apache. How does this work?
Sony Exec: We are running old software that can be compromised what should we do?
Sony IT Manager: Lets put up a firewall and block users from port 80. That should fix it.
Seriously, did Sony's servers have other services running with ports exposed to the internet? Or is it really being suggested that Sony should have blocked the ports that were necessary for their customers.
"For I desired mercy, and not sacrifice" -- God
Thanks for that apache security vulnerability link. I went through each one listed. The majority cause crashes or denial of services, so we can rule those out. There were two vulnerabilities that allowed arbitrary code execution. One of these was patched in 2.2.3, so I don't think it applies. The other vulnerability was in the mod_isapi module, so it only affects windows versions of apache. This one, though, affected apache version 2.2.15, which seems to comply with reports of what Sony was running.
So, therefore, it seems likely that Sony were running apache on windows, and using isapi modules with it. I bet they're wishing they were running apache on linux instead.
The other day I posted this...
Though here's a question: How many other companies have the backbone to own up quite so readily, instead of trying to cover it up to save face?
what I am saying is that I generally don't trust businesses to keep secure personal and credit card information, which is why I didn't give Sony my credit card details (but sadly had to give my personal information.)
I still stand by that part, in that I expect that databases are cracked more often than we realise due to poor security, but that businesses keep dishonestly quiet about it.
But this part is such an understatement that I regret standing up for Sony at all...
it seems thay they're finally getting help to make their system more secure, implying that their efforts were not solid enough to start with
I mean, the sheer stupidity is astounding.
Not say this isn't a dumb move on Sony's part, but in reality I think this is pretty common. I know that in some small - medium sized companies, there are miles of red tape in the form of change management processes that you have to go through in order to install software patches. You have to fill out the form, get it approved by your supervisor, then it goes up to the dept head and they sit on it for a month, then finally they send it back with a stupid question that you already addressed in your request, so then you point that out and it goes back up the chain and sits for another month. A lot of sysadmins may have the desire to install the latest patches, but their hands are tied by management that wants to have a nice paper trail that documents the justification for each and every system change. I think you'll continue to see stuff like this happen until someone can make the pencil pushers realize that it's not the sysadmins fault, it's their fault for making the patch process take two months.