Slashdot Mirror
Sony Music Greece Falls To Hackers
xsee writes "Hackers: 6, Sony: 0. It appears an attacker has performed a SQL injection attack against SonyMusic.gr. The latest attack has exposed usernames, real names, email addresses and more. Is Sony's network being used as the world's largest public penetration test?"
The most preventable of all security holes. How sad.
Isnt every network exposed to the public (esp. mid size or larger commercial ones) continously under attempted attack?
Years of half baked products, poor reliability, hostile customer service, lazy innovation, and a general disdain for security are what your customers have had to deal with. I really don't care who is doing it to you or why - but I applaud them teaching you the hard lessons of the evolving technological age. You can't keep repeatedly flipping people the finger anymore and tell them to deal with it. Evolve or die. And no, my loathing isn't related to just the recent PS3 debacle. It extends to experiences with consumer audio, professional theatrical projection equipment, and so on right down the line. The fact that you're being taken out by the simplest of attacks in most cases just makes my smile grow a little more.
I would classify this as part of the more general category of "in band signalling." The telephone network learned the hard way why such a design is bad when people began to use blue boxes, but it still took decades for them to fix the problem. I suspect that it will be a while before we see a real fix to the SQL injection problem as well.
Palm trees and 8
Well at least they are consistent - none of their systems seem to have more than basic security.
K Man
And you're egging them on?
They aren't just doing this to Sony, they're doing this to the people who use the services too.
Take it from a person had a gawker account. When they were hacked, it caused a great inconvenience for me.
http://lkml.org/lkml/2005/8/20/95
Is there any evidence to back this up? I keep thinking of counter examples, the best one being Sony. They've been attacked how many times now, and they are still leaving security holes of this nature up? One would think after the first attack a company wide IT effort to harden their servers would have been given something other than the lowest priority...
They decided that since people download stuff anyways, might as well save on the bandwidth and store it locally. Any time you download a file its mirrored in the cafes file server, so others can copy it without having to re-download.
And if you dont go that route, you can buy bootleg copies from any number of African immigrants on the street for just a few euro. Many times for better quality than available in stores for retail price.
The linked article also provides a screen shot with obscured personal information.
It appears the passwords are stored in plain text, not as hash: formatting makes it unclear but it seems the length varies, and the password fields are short (6-10 characters or so), while hashes are much longer than that.
Bad bad security! No wonder they also fall victim to the age-old SQL injection attack... which I thought most SQL interface libraries can automatically intercept by adding the appropriate escaping... many years ago I used Pythons MySQLdb and they were doing that for very very long already... so there should be no excuse for allowing this to happen still.
Evidently, the playstation 3 firmware/network isn't the only instance where sony totally fails at securing their shit. SQL injection? Really? In this day and age? I'm simply shocked that it hasn't happened a lot earlier; they've been pissing people off for years now, its amazing its taken this long for a collective group to make a serious effort to try and break in.
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
No, every other scriptkiddie is just joining in on teh lulz of flogging the dead horse. "ZOMG I sql injectioned a SONY site! Yeah, it's got nothing to do with PS3 or PSN, and yeah it's some site in Greece, but lulz amirite!?"
It's even in the bloody article, isn't it?
I mean.. honestly?
They could be running this against $random_site and try to hit the news with it, too.. but they wouldn't.. because nobody cares about a random hack at a random site right now.. but if it's got SONY attached to it.. well.. lulz rules the news.
None of which excuses the poor security.. but none of which excuses the submitter from his choice of words either.
SONY now knows 1 good thing from this: How to stop it from happening again on this and other sites/domains they own & host websites from.
How to stop this particular attack.
Available evidence suggests they have no shortage of dailyWTF-worthy screwups that people can continue to exploit.
upon the advice of my lawyer, i have no sig at this time
SONY now knows 1 good thing from this: How to stop it from happening again on this and other sites/domains they own & host websites from.
Well, if the recent weeks told us one thing then that they do NOT learn anything from the penetrations. PSN was penetrated and they took it down, but it seems they didn't really learn much from it, since SOE followed. PSN went back up, only to be torn down again near instantly because it was AGAIN penetrated with an allegedly similar attack. And now that. An SQL injection, the one attack that can be prevented the easiest and with the least hassle (hell, there's even free frameworks for nearly every script language in the world that do it automatically for you).
I'd say if one thing's certain, then that Sony doesn't learn jack from the attacks.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I suspect that it will be a while before we see a real fix to the SQL injection problem as well.
It's called a paramterized query and pretty much every language on the planet supports this mechanism.
SQL injection is mostly a solved problem, except for programmers.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Heh heh, Sony's gettin' shafted!
i'm sorry, but was the phrase: "world's largest public penetration test?" really necessary?
Sony acts like the world's largest orifice so it's only fitting.
John
No more than HB Gary was.
To wit: This is the prescription for being attacked mercilessly, for months on end:
At that point you will discover what sort of damage a bunch of really pissed off top notch programmers can do.
With luck all the other psychopathic mega corporations around the world are watching and learning. The lesson is simple: don't poke a hornets nest.
One of the first things you learn about web programming is to clean any string a user touches. If there's even a remote possibility that a user submitted something, clean it before putting it in your query. How is it even possible that someone would be given money for web programming before learning this? That's not even a rhetorical question; I'm genuinely interested in the answer.
It's cheaper not to hire or pay for information security.
And when they do they probably don't hire the best. Let's face it, Sony is not innocent and I could care less what happens to Sony. I don't own Sony stock, I don't work for Sony, and I don't own any Sony products except for an old PSX. So I just don't care what happens to Sony.
Maybe other companies will now give a shit about information security.
endlessly
ftfy
But he could care less: He could care so little that he wouldn't even bother to post about how little he cares about it.
The Tao of math: The numbers you can count are not the real numbers.
Anybody who trusts Sony after all the various customer-rapings Sony has committed in the last ten or fifteen years deserves to have their data stolen.
Fool me once, shame on you. Fool me twice, shame on me. If you buy Sony you're begging to be abused.
Free Martian Whores!
It comes from the full phrase "I know naught and could care less." So when people say they could care less, they mean they could care less than naught. People who are unfamiliar with the classics hear "I could care less," and get confused and angry because they aren't familiar with the actual quote. But their anger just displays their ignorance. "I could care less" is the original and correct, and "I couldn't care less" is the ignorant "correction."
I know you were trying to make a joke, but since about 2-3 weeks ago, if I click my username in the top right, I get "The user you requested does not exist, no matter how much you wish this might be the case. "
It's just a theory, but I think the != in the middle of my username has something to do with it.
This sentence no verb.
Just because a phrase becomes idiomatic and loses its full context when spoken or written does not mean you need to get on the internet and "correct" people for using the idiom simply because you do not understand where it came from.
In other news, when people say they "literally" did something when obviously they didn't, they don't misunderstand what the word "literally" means, they are just exaggerating. By correcting them you either come off as a jackass, or you come off as somebody that really struggles with the meaning of the word yourself.
Nothing is worse than a know-it-all who doesn't.
If I can just reach out with my words and touch a butthole, just one, it will all be worth it.