Sony Compromised, Again
Konsalik writes "The hacker group LulzSec on Thursday posted information it took from Sony Entertainment and Sony BMG on its site, called the LulzBoat. Lulz Security said it broke into servers that run SonyPictures.com. The information includes about a million usernames and passwords of customers in the US, the Netherlands and Belgium and is available for download and posted on the group's site."
...if sony came out and apologized for being asshats and promising to never do it again.
Groan...
Certainly Sony has some major responsibility here...
But when will people stop trusting the Intertubes security implicitly and just blindly dumping all their personal info into various "secure" web sites and Internet connected systems?
People are just blind...
If you want news from today, you have to come back tomorrow.
That the hacking community has 0 sense of morality at this point? That is more and more the impression I'm getting. This isn't going to help. If anything it is going to be more fuel to the camp that wants our governments to have insane legal powers to combat this stupidity.
Personally I'm pretty tired of hearing this shit.. at this point is it really even worth the effort? SQL injections? Script-kiddies leeching off of unsecured websites.. this shit happens every day. Any else suspicious about the line "said that the group has more, but can’t copy all of the information it stole." Why can't they copy all the data? Probably because the "hack" wasn't as big as they want everyone to believe.
In most cases people don't really have much choice.
You go to register to do something, and marketing department demands that registration form has a mandatory City, Address, Zip, blah blah, whatever their data appetite demands (and probably with data validation too, so doing New York, Blah Street, won't work).
Sure, some people will stop right there. But if "free" thing you gain access to by filling out registration form seems compelling enough, people will fill in the address.
And only a few of them will be clever enough to give some other (easily remembered, in case of site's trickery) address.
That data will live in archive forever, because marketing will never ever allow deleting anything.
Until it gets stolen (heck, probably afterwards too, but there will be a marketing blurb about being very secure, tested daily for hacker intrusions and stuff like that, wash, rinse, repeat)
Hyperom.com
Sony company culture of indifference won't change over a few hacks. It may have made them look stupid (and that's got to hurt their ego) but ultimately the data being lost doesn't contain those of their officers, and frankly I don't think Sony gives a flying f_ck what happens to their customers (as demonstrated by rootkit) or their rights (demonstrated by repeatedly removing features from products and lied about it despite being caught lying.)
ELOI, ELOI, LAMA SABACHTHANI!?
How is that a money quote?
Or do you mean showing the stupidity of the person asking the question?
Yeah, this'll hurt them like Kazaa hurts the MPAA - it won't. In fact, it'll more likely lead to the govt giving more public companies "emergency" legal powers to smack down anyone they suspect of being against them. Especially since today CNN had a "are your passwords safe online? Are YOU safe online?" special earlier today.
I don't know. . . repeatedly losing this much customer data or really any customer data is a serious public relations blunder. Sony Computer Entertainment already lost this console generation. I don't know if it can handle too much more egg on its face. At some point this is going to start making a serious dent in the bottom line.
I wanted to go to the site to see if my name was on the list, but then I realized they're the types that would probably have the latest version of MacDefender just waiting for me.
Taking guns away from the 99% gives the 1% 100% of the power.
The hackers don't give a flying fuck about the customers either by releasing all their personal information on the Internet.
If they really cared about the customers, they would have released the information to a trusted 3rd party to verify instead of to the public. They decided not to do that because they knew releasing it to the public would cause a much greater financial loss to Sony at the expense of its customers. The Hackers have no moral high ground here.
It has been said that criminals try to rationalize their crimes often times by thinking that they are just playing by the rules of life, even if its not the rules of society. An example would be a car thief who finds a car unlocked in downtown New York. They might steal the vehicle and rationalize it as a sort of "finders keepers", where if they didn't steal it, someone else would come along and steal it instead. "If I don't, someone else will, so I might as well benefit". You might say that is a ridiculous assertion to make, but if you found a $50 laying in the parking lot, you would probably pick it up and keep it thinking that someone else would take it if you didn't, and any hope of the original owner finding their missing $50 is a lost cause.
So when someone does virtual breaking and entering because the virtual back door was virtually unlocked, you have to ask what line of thought is crossing their minds. When my neighbor's door is unlocked, should I enter it and steal their TV because I think someone else is bound to do it instead?
In many ways, the MPAA has lost. We have to keep in mind what they were really trying to hold on to, the same old way of doing things. They have lost that battle, have been forced to change and are slowly doing so. It isn't that Kazaa or Napster or any one thing caused it, nor that it was some kind of unified (or righteous) movement. It was a bunch of factors mixed together. Their rigidity and shortsightedness being the largest culprit.
Basically, the MPAA has been forced into a change they should have been making anyway.
I see the same thing going on here, actually. There are multiple things going on, on different levels, simultaneously. The main thing going on here is this: "lulz", Removing a promised functionality from a device. Telling Sony to stop doing business the way it has. People are fed up.
Remember the timeline of what has transpired here.
1.) Sony removes OtherOS option from PS3. A gaff. A small number of people bought the PS3 for this feature alone. They were forced into either a) upgrading firmware and losing said ability in order to keep using the console for games, etc. or b) buying ANOTHER ps3. Basically, they fucked over some people (not new for Sony).
2.) Communities of customers begin seeking a way to return this functionality (one that was a selling point for many and one that shouldn't have been removed in the first place.) No big deal, no one really cared.
3.) GeoHot gives people back the ability to do this. Again, not many people cared. Except Sony.
4.) Sony opts for the unpopular and morally wrong thing to do - sue (bully) GeoHot. A major gaff. This outrages people even further AND does nothing to fix the problem of this workaround. People who didn't previously care, now care a lot.
5.) Now that their customers have been pissed on multiple times, some of them decide to piss off Sony.
6.) They decide to perform a DDoS and to bit of a nuisance to Sony. ("lulz" ensue)
7.) Once they do this, someone decided to perform a SQL injection. (fuck it!)
8.) From this, according to them, they got access to EVERYTHING. Also, according to them, they are shocked and appalled. According to them, they decide to expose this negligence on the part of Sony in order to warn its customers. ("lolholyshitwtfbbq - guize, look!")
This also
A) embarrasses Sony ("lulz")
B) gains the attention of mass media ("lulz")
C) gets various figures up in arms about some (non-existent) "dangerous hacktivist group" ("lulz")
As for the customers whose data has been compromised or released, it is an unfortunate side-effect; collateral damage, if you will.
In the process, a couple of valuable and enlightening things have been learned by many parties:
1) Sony has shitty security. - This is news to many people who had assumed that Sony would be pretty safe to deal with, being such a large company. Surprising, a bit unsettling, but somewhat forgivable being that corporations often look to cut costs. For those with some knowledge it is disturbing in and of itself since they aren't PCI compliant. This may be illegal (criminal) in some states. (AFAIK there is no federal law regarding PCI compliance).
2) Sony keeps customer data in the clear. - (I am glad I'm not a customer. - They REALLY must not care about their customers). Not only is this not PCI compliant it is JUST STUPID. It also has me convinced (along with everything else, including their history of rootkits, etc..) to NEVER be a customer of Sony.
3) Sony is a bully who either hates its customers, or doesn't want them anymore.
As for the release of the customer I see it as a positive, not a negative. Those who have had their data compromised can now know this for certain, see it in black and white even, and take appropriate action to protect themselves from possible wrongdoing. Besides, who knows whether or not this data had already been compromised? Apparently, it was trivial to do so and thus it would not surprise me if it had already been compromised before all of this. No one would have known this had
Posting people's emails and passwords?
It's not comedic. These people are stealing user info and posting it and you say Sony looks like arrogant nincompoops?
Uh-huh.
http://lkml.org/lkml/2005/8/20/95
Sony has been begging to be smacked around by mob justice for a LONG time. Now it's finally happening. I say good.
how is babby formed?
This criminal organization LulzSec hurt the end user. Isn't that what the Slashdot crowd claims to be for? LulzSec exhibited utter lawlessness that, if perpetrated by Sony or Apple or Google or the Department of Homeland Security, it would have all the supposed Slashdot "Libertarians" howling. Read my sig for more details.
I can't believe how many people here are defending the action of LulzSec (not the hack, the posting of info, utterly and completely indefensible).
Slashdot "libertarians": Small government for me, big government for those I disagree with. -1, I disagree with you