Slashdot Mirror
Sony Music Greece Falls To Hackers
xsee writes "Hackers: 6, Sony: 0. It appears an attacker has performed a SQL injection attack against SonyMusic.gr. The latest attack has exposed usernames, real names, email addresses and more. Is Sony's network being used as the world's largest public penetration test?"
The most preventable of all security holes. How sad.
Well at least they are consistent - none of their systems seem to have more than basic security.
K Man
In this case....I don't feel sorry for anyone doing business with sony. From my point of view, they made their bed, now they get to lay in it.
They decided that since people download stuff anyways, might as well save on the bandwidth and store it locally. Any time you download a file its mirrored in the cafes file server, so others can copy it without having to re-download.
And if you dont go that route, you can buy bootleg copies from any number of African immigrants on the street for just a few euro. Many times for better quality than available in stores for retail price.
The linked article also provides a screen shot with obscured personal information.
It appears the passwords are stored in plain text, not as hash: formatting makes it unclear but it seems the length varies, and the password fields are short (6-10 characters or so), while hashes are much longer than that.
Bad bad security! No wonder they also fall victim to the age-old SQL injection attack... which I thought most SQL interface libraries can automatically intercept by adding the appropriate escaping... many years ago I used Pythons MySQLdb and they were doing that for very very long already... so there should be no excuse for allowing this to happen still.
No, every other scriptkiddie is just joining in on teh lulz of flogging the dead horse. "ZOMG I sql injectioned a SONY site! Yeah, it's got nothing to do with PS3 or PSN, and yeah it's some site in Greece, but lulz amirite!?"
It's even in the bloody article, isn't it?
I mean.. honestly?
They could be running this against $random_site and try to hit the news with it, too.. but they wouldn't.. because nobody cares about a random hack at a random site right now.. but if it's got SONY attached to it.. well.. lulz rules the news.
None of which excuses the poor security.. but none of which excuses the submitter from his choice of words either.
I suspect that it will be a while before we see a real fix to the SQL injection problem as well.
It's called a paramterized query and pretty much every language on the planet supports this mechanism.
SQL injection is mostly a solved problem, except for programmers.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Remember when Sony products were cool because they were innovative?
Yes, I'm actually that old.
I guess we should explain for the kids here since I guess they can't even imagine it: Sony was cool. Not just like Apple today, with fanboys liking it and everyone else hating it, it was THE cool brand. They had innovative products with never seen before features and a kickass support that didn't bother to ask for details, they just threw a new model at you if the old one croaked, which was actually unlikely because, hey, it was a SONY, they don't fall apart! People were proud to have Sony speakers and Sony radios in their cars, they were proud to have a Sony walkman (as if you could get any others, after all it was a brand name) and they had every right to be proud, they bought something of lasting value!
I admit, it's very hard to believe that today.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Yes, but to be fair to Sony (which really pains me), they are currently the focus of every bored script kiddie in the world right now, as well as most of the legitimately pissed-off, skilled hackers. While there may not be such a thing as "security through obscurity," there is a lot to be said for not having a target the size of Montana painted on your servers.
My sister opened a computer store in Hawaii. She sells C shells by the seashore.
So your saying, by doing this they're going to drive customers away from Sony, reduce their income stream, and eventually remove them from the world of global commerce?
Wow, that sounds...terrible
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
professional theatrical projection equipment
There was an interesting story in the Boston Globe this weekend about how Sony projectors are projecting 2D digital movies up to 85% darker than they should.
The reason? It turns out to be Sony DRM, although the article doesn't ever come out and say it directly. Basically, there's a special 3D lens required to display 3D movies, but this lens reduces the brightness of 2D movies.
So why aren't theater personnel simply removing the 3-D lenses? The answer is that it takes time, it costs money, and it requires technical know-how above the level of the average multiplex employee. James Bond, a Chicago-based projection guru who serves as technical expert for Roger Ebert's Ebertfest, said issues with the Sonys are more than mechanical. Opening the projector alone involves security clearances and Internet passwords, "and if you don't do it right, the machine will shut down on you."
In other words, you have to deal with Sony DRM. Rather than jump through the Sony-imposed hoops, theaters just leave the 3D lens on all the time.
Why bother with Sony projectors at all if they have this problem and others don't?
The reason appears to be a basic business quid pro quo. Sony provides projectors to the chains for free in exchange for the theaters dedicating part of their preshow ads to Sony products.
So, yeah. Another wonderful example of Sony in general and Sony DRM in specific giving customers an inferior product.
Obviously the theaters deserve some blame for this too.
You are in a maze of twisty little relative jumps, all alike.
No more than HB Gary was.
To wit: This is the prescription for being attacked mercilessly, for months on end:
At that point you will discover what sort of damage a bunch of really pissed off top notch programmers can do.
With luck all the other psychopathic mega corporations around the world are watching and learning. The lesson is simple: don't poke a hornets nest.
ohh, wait I have to say something about this!!!!
I was in a bank once, while it was being robed! Ok, it wasn't the nicest experience I ever had and I might have been inconvenienced a bit.
Did I lose the money I had in the bank? No.
Did I loose the info I had stored in it? No.
Did I manage to do the jobs I had with the bank? Yes, I just went to another branch.
So if you are going to create a service infrastructure that hasn't enough failsaves and backup plans to deal with a simple digital break in then you damn well deserve to be reduced to the economic equivalent of decarbonized organic material... And all people who trusted your Services (including Yours truly) deserve a very big refund for your incompetence and a big slap in the face for being such fools!
-- no sig today
endlessly
ftfy
No, that is just the polarising lens/filter combo needed for passive 3D glasses. Like sunglasses polarisation makes the image darker.
Yes, that would be the technical reason why the image is darker, but that's not the DRM part. The DRM is the reason that the projectionist doesn't simply replace the lens: if they do, they risk tripping Sony's DRM and locking the projector out.
Rather than risk that, they just leave the lens on. Thereby making the movie look absolutely horrible.
So it may not be DRM making the movie dark directly, but DRM is the root cause: Sony doesn't trust the people who own the projector to change the lens, and it's DRM that enforces that policy.
You are in a maze of twisty little relative jumps, all alike.