Slashdot Mirror
Sony Pictures Computer Sytems Shut Down After Ransomware Hack
MojoKid writes: It appears that Sony Pictures has become the victim of a massive ransomware hack, which has resulted in the company basically shutting down its IT infrastructure. According to an unnamed source, every computer in Sony's New York Office, and every Sony Pictures office across the nation, bears an image from the hacker with the headline "Hacked By #GOP" which is then followed by a warning. The hacker, or group, claims to have obtained corporate secrets and has threatened to reveal those secrets if Sony doesn't meet their demands.
#GOP has just become a top-10 target for US Offensive cyber-operations...
One can only hope it hits the right people. Those fucking idiots who demand we open the network to the "bring your device from home" crowd.
Remember when your network admin told you that it is a stupid idea - well here you go.
Everyone who buys Wild Hunt will receive 16 specially prepared DLCs absolutely for free, regardless of platform.
Not to worry. After working 24x7 for a week or two trying to rebuild the entire spaghetti-heap of an internal IT setup that took years to get as crufty(but familiar and functional-ish) as it was; being fired and thus allowed to go home and drink yourself to sleep will seem like a hell of a perk!
A car? Why would anyone get a car because of this?
Couldn't happen to a "nicer" bunch.
Would I be right to believe the Sony Pictures, being part of the Sony conglomerate, are infected with the same high-handed corporate arrogance that we have seen at Sony Music? "cough" root kit "cough"
I shall be wearing the smile today, all day.
"Cock Up Your Beaver" does not mean what you think. This sig is intended to clog filters and annoy do-gooders
He'll probably become a soon to be deported retroactive rapist.
Sony is being on the receiving end of malware for a change? The irony...
Hundreds of workers will get laid off so that Sony can make up for this blunder and stay out of the red. Then the CEO will get a huge bonus for "cutting expenses".
Yes, something went wrong so it must be because of my pet peeve. Clearly all the evidence points to this being an infection caught off a dodgy iPad. *facepalm*
Can't they fight this with the DMCA or something for abusing the GOP hasthag? I bet those hackers will have shit running through their pants when they hear this!
Young man, Are you listening to me
I said, young man, what do you want to be
I said, young man, you can make real your dreams,
but you've got to know this one thing.
No man, does it all by himself
I said, young man, put your pride on the shelf
And just learn to play with the D.M.C.A.
I'm sure they can help you today
It's fun to play with the D.M.C.A.
It's fun to play with the D.M.C.A.
They have everything for young men to enjoy.
You can hang out with all the boys.
It's fun to play with the D.M.C.A.
It's fun to play with the D.M.C.A.
You can get yourself clean
You can have a good meal
You can do whatever you feel.
all the evidence points to this being an infection caught off a dodgy iPad.
I KNEW IT!
Told you so.
good old fashioned cracker extortion. I would have prefered it happen to EA, Comcast, or Haliburton.
Seriously, what important, secret information does a film studio have, besides salary, and royalty numbers?
Creative accounting. Maybe even fraudulently creative.
Someone clicked on "photos.zip".
No, you blamed BYOD, which remains to be seen. I take it you've never seen a corporate iPad? I assure you they exist & while they can be infected just like corporate laptops can, it happens a lot less often...
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
What if I told you this "ransom ware" attack was caused by network admins who were logged in as DOMAIN ADMINISTRATORS? Ransomware is usually the result of poor security practices by admins adding DOMAIN ADMIN to their groups in group policy. So, infect one DOMAIN ADMIN and ransomware is off and running through the entire network, encrypting and trashing as it goes. With ransomware the worst a nonadmin user can do is take out their own files, but infect an account with DOMAIN ADMIN and you can take out a network.
As for your ignorant remarks on BYOD. BYOD is a very low risk, especially if you keep them on a limited wifi then limit devices to iPhones & Windows PC with latest security updates, sorry droids.
And, I based on post with the (sic) advanced literary skills and complex reasoning ability, I bet you are an admin that logs in with DOMAIN ADMINISTRATOR credentials, because you aren't the security problem, you are an all knowing GENIUS!
"Clever is easy, simple is hard." -me
Embarassing "creative accounting", heavier than expected use of offshore tax shelters and chip-shuffling, two sets of books, other illegal accounting, illegal campaign contributions, those are a lot more likely than the sort of "secrets" you're thinking of. They probably stand a lot more to lose there than from theft of R&D files.
Nowadays your accounting department needs to be the most heavily defended portion of your network, and not due to direct theft. (unless you're in the business of mining bitcoins anyway)
I work for the Department of Redundancy Department.
Hopefully the IT department have strong hearts. Employee fitness programs probably should be made part of the disaster readiness planning.
Pink slip? It's a Japanese company. Failure has more serious consequences.
So, Sony isn't just incompetent and unsafe with our data, they're apparently unqualified to run an internal network?
Unbelievable.
I can't think of many instances where a company as big as Sony had to shut down all of their IT stuff on this scale.
Bummer, dudes. But, it's Sony, so I'm not feeling overly bad about it.
Lost at C:>. Found at C.
It's more likely domain admins that didn't apply MS14-068.
One can only hope it hits the right people. Those fucking idiots who demand we open the network to the "bring your device from home" crowd.
Remember when your network admin told you that it is a stupid idea - well here you go.
Remember when your network admin couldn't figure out how to segregate the wifi network, or set up mobile device policies in exchange? Well here you go.
No he didn't, Skylinux did.
Sorry, teleporters just kill you and then make a copy. A perfect, soul-less copy.
On the one hand, I despise extortionists, and the perpetrators ought to be hung out to dry. On the other hand, the folks at Sony arguably have engaged in extortion and fraud on a few occasions in the past, so part of me feels this is simply their just desserts. If it wasn't for the inevitable collateral damage I'd be tempted to say "let 'em all kill each other and God will sort them out".
It does seem kind of unfair that nobody at Sony was ever imprisoned for the Rootkit scandal or the OtherOS clusterfuck, whereas people behind #GOP will likely serve time in jail if they are ever caught. I guess "Corporate Immunity" is just as real in law as "Diplomatic Immunity" - 'the law' just won't openly admit it.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
comcast save up for a big hack that gives people free tv. Starting with HBO, NHL CI, NBA LP, MLB EI, and more.
Don't you hate it when people disagree with your blind, error filled assertions? I bet you wanted to print this post off and show it to your boss and say, "SEE, LOOK, IT'S THOSE PEOPLE WITH BYOD!" when in reality YOU, Mr. Site Admin are the biggest security threat to your organization.
I was at least expecting you to lie and respond, "I am not logged in as DOMAIN ADMIN."
On a serious note, I would strongly suggest you look at your teams security practices before you end up in the same shape as SONY. Ransom ware is running wild right now. Making sure you have air-gapped backups, your servers are patched with all out of band patches, users and admins are NOT logged in as DOMAIN ADMIN, strong passwords with a password saved in a password manager like KEYPASS.
"Clever is easy, simple is hard."
I'm stealing this; I hope you don't mind. (o:
Love sees no species.
Maybe they should make a movie about this.
I really hope they don't pay!
Try reading a little more carefully next time. No one blamed an iPad.
The real gross and net numbers would be my guess, having been an associate producer/performer with points in the past.
Even though I had no computer vulnerable, and I did not buy one of Sony's malware-laden Music CDs, I remember the event so clearly and strongly I still refuse to consider buying any Sony product whatsoever, including their cameras. Is there some malware hidden within those proprietary, compressed RAW image files?
So I am of two minds. I don't like the use of ransomware. And I don't like Sony. This reminds me of the old joke where the guy sees his mother-in-law drive off a cliff in his new Bentley.
I thought BYOD was an excuse to let HR refuse to hire people who aren't in the socioeconomic group likely to already subscribe to smartphone service without appearing racist.
First see if Disney offers a discount on a new copy with the exchange of a broken authentic disc. If not, a workaround is to find a decent adaptation of the same story not distributed by Disney. I can think of a half dozen versions of The Adventures of Pinocchio, and there are probably plenty of "Rapunzel" and "The Snow Queen" adaptations that aren't Tangled or Frozen. Yes, mockbusters exist; read reviews to avoid the worst. And when they get old enough, show them the other Tangled with Rachael Leigh Cook.
When I say something like this, I mean it. Yes, there would be a temporary disturbance (in the force?) if Sony went under tomorrow. But the world would eventually be a better place for it. Same with most corporations, honestly.
Flamebait means what you think I was doing, which also isn't what I was doing. Trolling is making shit up to make people angry. I was expressing heartfelt beliefs. I know many here agree with me. But I guess you're still humping your PS4
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Ransomware sometimes uses TOR to avoid detection and serious encryption that no techie can undo. I am starting to get really worried that ransomware will become as common as IE-hijacking browser toolbars. It is easy money. This will be a huge problem. I'm even went through the trouble of logging in to ask how we can fight to nullify ransomware.
1 employee inside our company saw some form of ransomware a year ago. I'm sure he lost all the business data. We are not the NSA and therefore can't decrypt it after purging the "virus" exe without the private key on their servers... period. Most random people online do not realize this, from the desperate forum posts I find.
When ransomware has all your local documents for work encrypted, you will have enough motive to pay the 500 Euros to Cryptolocker and Cryptowall 2.0. Backups are rarely if ever applied on homes and laptops. Laptops are a huge business driver, and the above employee was using one. I hear from forums that sometimes ransomware snags your *shared* network drives, so you lose gigs of crucial data.
Now, most of us still haven't been affected, thankfully. Let's speak from a point of view of "how do I keep this from ever becoming a reality?" What's best?
- Backups? We will get hit. Same as spyware hits the most conscientious of users. Does anyone know of an OSS backup where you can "hide" the target USB drive or partition from the user (so the ransomware won't just up and pave it over along with the My Documents, Desktop, D:, Local network drive targets)
- Prevention: Do we double up on freeware options despite the performance penalty? (malwarebytes, Windows defender or whatever it's called today)
- "Shadow files" apparently get saved automatically on Windows 7 (don't know if you need to have paid for Ultimate like I did). This is great because you can revert an encrypted document, but Windows' GUI isn't equipped to fix files en-masse and utilities are required. The one I saw still gave you some cumbersome folder GUI that wasn't as easy as "revert all in this folder". Are there any savvy things out there to make this easier? I haven't explored Time Machine for MacOS. And this is windows
This is my Scientific Linux box. Much ransoming won't be happening here, but one of my neighbors got hit a few weeks ago on Windows, despite running some form of protection. I heard of one other person who apparently lost files, but I haven't personally confirmed what hit them.
-vlueboy
... up for some security?
Actually, I think this is an inside job where admin access was given to an outsider.
It little behooves the best of us to comment on the rest of us.
Companies typically run two sets of books, one for the IRS, one for stockholders. It's legal.
What if I said it was much more likely that they weren't domain admins, but merely members of groups that had rights over local workstations -- like, you know, like every person in ever field-service/desktop-support group in every major company is.
The right to install software is granted to field-service level staff in nearly every major company, and that doesn't make you a domain admin.
No offense to the actual IT workers at Sony, as I'm sure their hands are as tied as management allows, but it does make me wonder how this kind of shit gets through IT and not only infects one office, but nationwide, without garnering any attention from the IT pros getting paid to stop things like this?
If you were me, you'd be good lookin'. - six string samurai
Couple years ago I interviewed at SOE (Sony Online Entertainment) in San Diego... I chose not to work for them simply because they were being hammered by Anonymous about the fact that Sony was taking legal actions against a 17 year old for jailbreaking their PS....
... but at the same time, I want them to stop being such mean and hateful to people who are able to crack the PS devices... or whatever other devices they make... Jailbreaking is legal remember?
Now this... Boy I'm glad I'm not a Sony employee... looks like they've been making lots of enemies with the general public and now it's the time that everything pays back... I want them to be able to recover and keep offering employment
They should have used something proprietary. Maybe an ATRAC or MagicGate algorithm? ;)
We run with two accounts one for normal use and one for software installation (admin/root). In my opinion, it is bad practice to run any machine LINUX, MAC, or WINDOWS logged in as admin/root. Having to type a username/password into sudo or the windows/mac popup is minor compared to software "accidentally" getting installed. :)
Hey I heard from some guy that hates BYOD that SONY was taken down by an infected iPad. It had nothing to do with that last Microsoft patch that Sony didn't apply.
No, they will get a corner office.
BYOD done right is *more* secure than not. Done wrong is worse. That's the same with almost anything.
Learn to love Alaska
While I don't know if it's legal or not to show your shareholders fraudulent books, I do know it's illegal to try to pull on the tax man. Federal charge of "keeping books" refers to keeping two separate sets of accounting, one for tax purposes and the other being an accurate reflection of your earnings. Basically it's ironclad proof of "premeditated tax evasion".
In many ways, the EPA and IRS have more destructive authority than any other government agencies. So exposing a company's wrongdoings to either of them typically leads to catastrophic results. And you almost never get to cut a deal with them, they'll take you to the cleaners because they know they can.
I work for the Department of Redundancy Department.
Oh come on. That's hardly a proof.
http://blogs.cfainstitute.org/... Just read the first two paragraphs.