Slashdot Mirror
HBO Hacker Leaks Message From HBO Offering $250,000 'Bounty Payment' (variety.com)
The HBO hacker has struck yet again. From a report: Variety has obtained a copy of another message released Thursday by the anonymous hacker to select journalists in which HBO is apparently responding to the initial video letter that was sent informing the Time Warner-owned company of the massive data breach. The message from HBO, dated July 27, features the network's offer to make a "bounty payment" of $250,000 as part of a program in which "white hat IT professionals" are rewarded for "bringing these types of things to our attention." While the message takes a curiously non-confrontational tone in response to a hacker out to damage HBO, a source close to the investigation who confirmed the veracity of the email explained it was worded that way to stall for time while the company attempted to assess the serious situation.
Only someone who wanted to watch the world burn for the lulz or a rebellious 12yr old would mock his victims in such a manner.
Of course, these two are not mutually exclusive
I was going to submit the WSJ/Fox News article under my alias when the Variety story popped up, which has more insight on what HBO is doing.
When the hackers came forward late last month, an HBO technology-department employee sent them a letter offering $250,000 to participate in the company's "bug bounty" program, in which technology professionals are compensated for finding vulnerabilities, according to a person familiar with the matter.
HBO was buying time with that response and isn't in negotiations with the hackers, the person said. The hacker has demanded a ransom of around $6 million.
The network has also been working with the Federal Bureau of Investigation and other law-enforcement agencies and cybersecurity firms to address the matter, people familiar with the matter say.
WSJ (paywalled): https://www.wsj.com/articles/hbos-hack-hollywood-is-under-siege-1502443802
Fox News: http://www.foxbusiness.com/features/2017/08/11/hbos-hack-hollywood-is-under-siege.html
MY BALLS!!! Suck 'em, nerds!
I've been working in IT for over 20 years, and the thing I've seen over and over again is that organizations that cheap out on IT get stung by things like these more frequently. I've been through multi-hour company-wide outages because someone said there was no reason to keep a core application in more than one data center. We constantly see companies where "IT is not our core competency" getting breached when their lowest-bidder contractors leave an open hole exposed, or when the entire company is run on a massive tower of outsourcers that don't communicate with each other. If I remember correctly, that's how the Target breach happened...a contractor running the HVAC for the stores had a security hole in the systems connected to the store networks, which attackers were able to use to get to the registers and credit card terminals.
You will never convince companies to do this, but in my opinion the only way to prevent breaches from happening or to minimize their damage is to pay in-house IT staff who *actually* understand what's being deployed. Staff who are paid well and not worked to death are going to be a lot more interested in keeping your business alive than some disinterested offshore firm or body shop who cares only about fulfilling the minimum terms in the contract. (The other thing that has to happen is that everything has to be secure by default, but almost nowhere I've worked has been able to wrap their heads around this. Too many places assume that there's an "outside" and an "inside" and spend all their effort defending the perimeter.)
What's interesting is that $250K is pretty low for a first offer. I haven't looked through the archive of data these hackers claim to have, but summaries say they were able to get access to sensitive corporate data as well as unreleased content. Some group of people at HBO must be going through all the access logs and figuring out what kind of damaging information they may have exposed. Given that they're an entertainment company, just a dump of the company's email should reveal some very interesting exchanges with various high-profile individuals. Worth way more than a quarter million in my opinion....
HBO is "leaking" their own content to generate hype as a way to offset the lower quality content now that it's all HBO writers and 0% GRRM.
Or lose them.
How any system, internal or external, has access to the systems where "valuable" information/data/media content exists without multiple levels of authentication, encryption and access controls seems to be something HBO shareholders should be seriously investigating.
When someone has proof theyve penetrated your network security and is holding your bread and butter hostage you have two choices: 1. pay the bounty and reassess the network. 2. dont pay, eat the loss, and still reassess the network.
There isnt a CISSP section on stalling for time by bullshitting people who are clearly far more intelligent than you. If anything, you've just hardened their resolve to leak more out of sheer animosity.
Good people go to bed earlier.
Get payment in bitcoins.
Or that 'voluntary $250k bounty reward for white hat IT professionals' will suddenly become an 'illegally extorted $250k blackmail payment for black hat hackers' as soon as they can trace your bank details :P
Would the mods mind please "leaking" the original article link instead of just linking back to the slashdot page? I guess it is too much work for a company that is 169% focused on advertising.
also pay for good infrastructure not well we can't do X to make it very secure as that will cost to much to have the infrastructure set up to be super secure
why does the link in the story go back to the story
3-send out a hit squad.
They shall reap what they have sown.
What giving IT PE powers with big fines that will get PHB asses in line.
HBO is a subscription based service. Do they think people will stop signing up or quit because there is a chance some of their shows may be leaked early? Anything they show is pirated within an hour after first showing. While they certainly should make an effort to try to do better and stop this, I don't think there were a ton of 2am meetings discussing it.
You have described the wave.
Now you ask why the successful surfers work with what it gives them and ride it, instead of fighting it.
Pay for good IT people ... lowest-bidder contractors
Unfortunately some companies pay incompetent people huge sums and promoting them to upper management, while ignoring their own good lower-level people that are aware about the problems but not empowered to fix them.
in fact i even have motive.....warner brothers screwed me form starting a business i had a local city wiling to invest into me in.....for 3d special affects and animations. ya see warner was using slave labour in canada at less then min wage and got caught, then subbed it out to there buddies on other side of nation to sony where i never bothered to see what happened cause why bother they are screwing us all
they al deserve to go bankrupt
They should've sent out the bounty notice to all their employees and coded in slight variations in each. Like a word change, or a few extra spaces here and there, or something basically unnoticeable. Then they could narrow down their leak.