Slashdot Mirror
The Sony Pictures Hack Was Even Worse Than Everyone Thought
An anonymous reader writes with today's installment of Sony hack news. "It's time to take a moment of silence for Sony Pictures, because more startling revelations about leaked information just came out and employees are starting to panic. BuzzFeed raked through some 40 gigabytes of data and found everything from medical records to unreleased scripts. This is probably the worst corporate hack in history. Meanwhile, Fusion's Kevin Roose is reporting on what exactly happened at Sony Pictures when the hack went down. The hack was evidently so extensive that even the company gym had to shut down. And once the hackers started releasing the data, people started 'freaking out,' one employee said. That saddest part about all of this is that the very worst is probably still to come. Hackers say they stole 100 terabytes of data in total. If only 40 gigabytes contained all of this damning information, just imagine what 100 terabytes contains."
I mean it seems likely they got everything. Even the model numbers of the kitchen sinks.
How long was the attack taking place? What kind of Internet connection does Sony Pictures have? To ex-filtrate 100 TB of data is going to take a while, no matter how you cut it. My guess is that number is significantly inflated.
100 terabytes of data is easily consumed by the raw uncut footage of a few movies, easily. So it could be a whole bunch of stuff that really hurts them or it could just be a couple movies that were shot by M. Night Shyamalan that suck so hard no one cares.
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
So Sony with its rookits and DRM get owned. Good. How does it feel, Sony? How does it feel?
Hope this causes massive losses for them and horrors for its employees.
http://en.m.wikipedia.org/wiki... TL, DNR: 9 years ago, Sony was root kitting the machines of people who bought their CDs, and living about it.
I think what happened most likely was, NK officials went to China, hired "internet baddies", and paid them to fuck Sony Pictures in the ass with their biggest internet broomstick.
No technical expertise or infrastructure needed.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
At first they thought the data was fake; all the scripts read like movies everyone has seen already.
This is Sony Pictures. The raw video for movies that they are shooting are stored online for editing equipment. One or two movies could easily take up 100TB of disk.
I mean it seems likely they got everything. Even the model numbers of the kitchen sinks.
I would expect they also got some fairly damning privileged information--emails exchanged with lawyers on everything from sexual harassment to copyright infringement suits. It's a BIG firm.
Plus Patents. Sony files THOUSANDS of patents a year. If that patent information (or research that could be patented) is published to the wild before SONY patents it, you have a LOT of new prior art and a fortune in IP at risk... SONY would have to patent everything within a year in the US; I am not sure that you even have that grace period everywhere else.
(a) NOVELTY; PRIOR ART.—A person shall be entitled to a patent unless— (1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention ...
(b) EXCEPTIONS.— (1) DISCLOSURES MADE 1 YEAR OR LESS BEFORE THE EFFECTIVE FILING DATE OF THE CLAIMED INVENTION.—A disclosure made 1 year or less before the effective filing date of a claimed invention shall not be prior art to the claimed invention under subsection (a)(1) if—
(A) the disclosure was made by the inventor or joint inventor or by another who obtained the subject matter disclosed directly or indirectly from the inventor or a joint inventor; or
(B) the subject matter disclosed had, before such disclosure, been publicly disclosed by the inventor or a joint inventor or another who obtained the subject matter disclosed directly or indirectly from the inventor or a joint inventor.
think what happened most likely was, NK officials went to China, hired "internet baddies", and paid them to fuck Sony Pictures in the ass with their biggest internet broomstick.
No technical expertise or infrastructure needed.
My guess is that a manager with too much access recklessly inserted a 2005-era music CD from Sony...
No expertise at all required to be a manager.
Was this hack the result of poor security, or will every single company in the world now see what has happened, over-react, and unleash draconian security measures that far exceed the point of diminishing returns?
No matter what you think of Sony, this will not be good for the productivity of the corporate working world.
"Who are you?" "No one of consequence." "I must know." "Get used to disappointment."
With all the state-sponsored corporate & military espionage caused by China & Russia, with the never-ending probes from government agencies like the NSA/DHS/GCHQ/etc., with malware & ransomware attacks that can encrypt data in (generally) unbreakable forms, with criminal hacking organizations making off with millions of credit card numbers from retailers, with apparently no network controls as to how much data leaves company firewalls & where it goes, and so on, why aren't there more internal air-gapped networks in companies???
This has hit the point of absurdity. If you are working on military plane designs, working on your next corporate acquisition, or even making movies or music worth tens of millions of $$$, why would you put your prized, unreleased digital files on computers that have Internet access? What kind of batshit stupidity is that? What, so your employees can browse Facebook & check Outlook e-mail at the same time? Such an air-gapped network would easily become an island--one that doesn't need Windows Updates, can stay on an old service pack, gets no software updates that solves 2 problems and but makes a new one (e.g. we know the bugs), and the like. And if those employees really need their Outlook e-mail, IM, or the Inter-Webs where they work, they can have a 2nd very low-end PC, connected to the main network, with a KVM between the two. Might even increase efficiency, given the mind's inability to multitask well. Or give them freaking iPads on a wireless network that's not connected to their "sensitive" work computer.
It boggles the mind that given all these problems, which are increasing in frequency & cost every day, we still have little more than software firewalls & hardware routers between a company's most highly-sensitive assets (files & computers) and the big-bad-Wild-West-no-holds-barred-Internet.
Windows 3.1x calc: 3.11 - 3.10 = 0.00
There's a lot of talk going around right now, mainly from Sony itself, that North Korea is likely behind it. Seriously though - would expect a bunch of people who don't know what Internet is, who likely don't live and breathe IT, security - basically everything capitalism stands for, let alone having a pipe fast enough to rip 100TB of data... Now I understand they could be trained and based elsewhere, but might as well say the Martians did it...
You obviously don't understand North Korea. Despite their terrible economy, widespread hunger, and stunning lack of technology in the hands of citizens, they still have an active standing army of over one million people, and count many, many more as available reserves. "Defense" spending is big there, so if they decide to hack, they can hack, and they will put government resources behind with little trouble because they have no fear of internal or national backlash. I doubt North Korea publishes accurate statistics, but it is a safe bet that they spend a much higher proportion of their GDP on defense (which includes hacking, propaganda, and internal oppression) than most countries. Militarily they are relatively weak on a per man basis due to most units being woefully equipped (and fed), but when they get the notion to do something (think nukes), they do it.
This may not have been North Korea, and I have no idea really, but one can't assume it wasn't them because simply because they are poor and uber-wacky.
This is a hacked account, for which the owner can not be held responsible.
I employ people in the USA in small IT and EE/IC specialty design shops. Most expert-level employees seem to come with white or grey hair. One of my IT geeks is a "MT Dew Diabetic." Avoiding the maintenance of medical records is simply not an option in the USA, given our laws and court rulings. We have to comply with ADA (Americans with Disabilities Act), keep records of workman's comp medical restrictions, including very specific information, on what an employee may and may not do as well as provide emergency information to first responders. While often inconvenient, these are requirements I cannot avoid. Some of my employees have medical conditions (heart conditions, organ replacement, severe allergies, diabetes, unusual prescriptions of controlled sumstances, etc.) that they want known and available to first responders showing up at the office if they collapse clutching their heart or go into a sugar coma. Complicating this, if one of your customers is a Federal agency or Defense, you must, by law, have a "zero tolerance policy" for controlled substances. All this requires records to prove or excuse. For government accusations, corporations are "effectively guilty" until they prove themselves innocent with appropriate record keeping. Making this even more difficult, USA court rulings say we're also not allowed to store this information in their personal files, but must keep it in a separate, access controlled file, otherwise we could get sued if that person missed a pay raise or promotion because it was available to anyone reviewing their service and discipline records. The separate files seem silly when the teams are small enough that everyone knows each other very well anyway. Also, what if the employee who first greets the medics from the ambulance don't have easy access the secured medical files? Isn't that an even worse problem? Sued if you do. Sued if you don't. Sued if you didn't do it the nuanced way a team of $300/hr attorneys thinks you should have half-way done it. Nuisance suits are common in the USA.
As a practical matter, a lot of valuable talent is not healthy. Many experts are experts because they have been at a speciality for 30-60yrs. If you have an employee that has an epileptic seizure, you don't want the rest of the team to stand there confused and gawking. You want them to recognize it and intervening to protect that individual's head and spine from injury. I had an employee with mental health issues under the care of a psychiatrist. While she was physically 100% capable (she was young and athletic) yet she was restricted from certain emotionally triggering situations. You want their supervisor trained know what those are and how to avoid it. You want a written record, periodically refreshed, that her supervisor knows and understands. You could say "I don't want to deal with that" but then you lose out on some great talent. Imagine a physics institute that didn't want to deal with maintaining medical records for Stephan Hawking.
As you yourself said, "their connections, the power they have to move the industry" carry a lot of weight. A lot of people inside and outside Sony could have their reputations ruined by these leaks. The film industry is full of gossip and jealousy, and people often say things in private that can be incendiary if they get loose. If someone with big clout is offended, a lot of current and future deals could go out the window. Grudges are real, and can last a lifetime.
And even non-bigwigs can be wrecked. Suppose someone takes time off, or has other issues from stress and uses prescription medication as a result. This could easily end up in personal records. This gets out, and that person could find themselves unemployable anywhere. Not even able to get a minimum wage job in retail or fast food, much less the entertainment industry. Remember, there are a lot of show hires and workers are transient, so there are a lot of ex-employees with records at Sony.
Sony could be on the hook for a huge class actions suit, particularly if you consider ex-employees. No matter how long ago it was, if you name shows up online as a result of this breach you have a valid reason to sue.
And Sony is not a well regarded company in Hollywood. They are known for squeezing the life out of people and then giving them the boot. They routinely have layoffs while they are advertising for new hires. (Everyone in Hollywood does this, but Sony is a prime example.)
They keep a few people around but nobody lasts because it's cheaper, and transient workers are no threat to bad upper (or middle) management. Bad practice can be hidden if there is no one around to complain or remind anyone of previous mistakes. (Just ask anyone who has been cycled through Disney about this.)
Given the combination of ill will and a lot of ex-workers, don't be surprised when the civil actions start. Sony doesn't have a leg to stand on, particularly on personal records. They had no partitioned networks/systems, no encryption, and didn't detect the breach until they were screwed. It's going to be just like drug lawsuits: there will be multiple late night commercials fishing for anyone who worked at Sony to join in.
Hollywood is a schadenfreude kind of town. There will be a lot of movie industry types who will derive a lot of satisfaction from watching Sony suffer mightily because of this.
Why is Snark Required?