LulzSec Hacks SonyPictures–1,000,000 Customer Accounts Compromised

Quoting DrJBHL,

You won't get very far on WinCustomize by advocating piracy and a backed up game is not the same as a pirated one. I can assure you that starkers will be the last person in the world who would agree about what you said about software piracy.

TWhile it might suit your sense of (and incorrect definition of) "justice", your equating hackers with Robin of Locksley is way off base: They are nothing but criminals out for their own gain and nothing else.

I'm not on WinCustomize, I'm on Elemental.

I'm not advocating piracy. Just saying it's cool that people fight the system and also that it's nothing strange with it.

You don't know if they're GeoHots friends or a criminal organization.

Successfully updated karma reason!

Quoting DrJBHL,

reply 25

What are the qualifications for getting a job in their IT Security Dep’t.?

50 cents and a night with the boss apparently.

Successfully updated karma reason!

Quoting Phoon,

reply 15

Quoting Jafo, reply 11Don't blame Sony OR their hapless customers.

You outta be in Healthcare IT in the US.

The healthcare providers are responsible for the security of patient health information and there are SEVERE penalties involved if data is compromised.

As a matter of fact, by 2013 patients will have the right to see exactly who has accessed their information and for what purpose. Similar to a free credit report.

This is putting one hell of a burden on we in I.T.

That was my first thought when this stuff started coming out, too, Phoon. Somebody needs to start expanding HIPAA and HITECH laws to other businesses besides healthcare, and maybe there wouldn't be quite so much identity theft going on.

Successfully updated karma reason!

neone6

Join Date 12/2010

+942

Successfully updated karma reason!

Jafo

Join Date 03/2001

+1846

Quoting Campaigner,

reply 26

I'm not on WinCustomize, I'm on Elemental.

Think "Stardock's sites/forums".

We don't discriminate/differentiate....

So....

It's OK to enter an unlocked building...it ain't trespass.

It's OK to break feeble locks and enter a building ....it ain't B & E.

It's OK to rape and pillage if the victim is defenseless....it ain't a crime....then.

Defenseless people need to be locked up....evil swine they are. The use of cheap locks should be a hanging offence.... and anyone leaving a property totally unsecured needs to be summarily shot on sight.

It's good we are clear about just who the criminal is.

For a moment there I thought it might have been the hacker.....

Successfully updated karma reason!

Jafo, if "law" were that easy, there would be no need for attorneys or judges. I don't know how things are in Australia, but in the US, a person CAN break into an unlocked building, and if they slip on a wet floor while in the unlocked building, they can sue the building owner for negligence (in civil court). The same can be said if the building was locked. And as far as things being OK to rape...well, there are some states in the US where it's OK to do that, if the victim is dressed inappropriately.

I know you would LIKE the world to be black and white, and all people to perceive things the way you see them, but it's simply not that way, and what The_Monk said is 100% spot on! Sony made themselves a target. It's not against the law to make yourself a target, but it doesn't make a lot of business sense to do it, and that's what Sony is finding out. Being hit, when you make yourself a target, doesn't mean that you're a criminal, and the person/persons who hit you ARE criminals, but you still, as a business interest, need to take care of your customers and by not putting as much concern into your customers as you do about your product means you may be hit with law suits because you were negligent with their data.

Successfully updated karma reason!

Uvah

Join Date 05/2006

+874

Quoting k10w3,

reply 31

.well, there are some states in the US where it's OK to do that, if the victim is dressed inappropriately.

Now this I have a problem with. I don't know of any state that would condone 'rape' whether or not the person is dressed inappropriately. Rape is an offense against the individual. A serious violation of that person's civil liberties not to mention a heinous crime. Please tell me where such a thing is allowed.

Successfully updated karma reason!

Quoting Uvah,

reply 32

Please tell me where such a thing is allowed.

Colorado http://www.huffingtonpost.com/2010/10/12/ken-buck-refused-rape-victim-case-audio_n_758890.html

Toronto: http://www.msnbc.msn.com/id/42927752/ns/us_news-life/t/cops-rape-comment-sparks-wave-slutwalks/

Successfully updated karma reason!

Jafo

Join Date 03/2001

+1846

Quoting k10w3,

reply 31

I don't know how things are in Australia, but in the US, a person CAN break into an unlocked building, and if they slip on a wet floor while in the unlocked building, they can sue the building owner for negligence (in civil court). The same can be said if the building was locked.

Yes, same here....but in BOTH places the act of trespass is still a crime. The ability to sue needs to be revoked, however if/when it can be demonstrated reasonable effort was made on the part of the property owner to exclude a person from potential injury...ie the actual LOCKS in place.

Quoting k10w3,

reply 31

And as far as things being OK to rape...well, there are some states in the US where it's OK to do that, if the victim is dressed inappropriately.

Ah....the US is such an enlightened country. ...

Successfully updated karma reason!

DrJBHL

Join Date 04/2002

+4263

Quoting k10w3,

reply 31

And as far as things being OK to rape...well, there are some states in the US where it's OK to do that, if the victim is dressed inappropriately.

Your example is a story about a Ken Buck? No, dear. He was put to ridicule because of his refusal to prosecute. It is NOT ok to rape in that state.

Quoting k10w3,

reply 33

Toronto: http://www.msnbc.msn.com/id/42927752/ns/us_news-life/t/cops-rape-comment-sparks-wave-slutwalks/

That's another example of case law? What are you talking about??? A Canadian cop's remark?

OK.. doc says the world is flat.

Now you can go murder someone. Use that sentence as your excuse.

Quoting k10w3,

reply 31

I don't know how things are in Australia, but in the US, a person CAN break into an unlocked building, and if they slip on a wet floor while in the unlocked building, they can sue the building owner for negligence (in civil court). The same can be said if the building was locked.

In the USA, you can sue for any reason. You won't win, though. In fact, if someone is negligent, and that CAUSES damage, then a suit is justified. That's a far cry from what you're asserting: "A guy pushes someone under a bus. Therefore, he can sue the bus driver." WRONG. He will have it tossed out.

Your examples, and the_Monk's are off, because if a company cannot guard the data, they have no business keeping it. If a person is hurt as a result:

1. The one CAUSING the damage is directly responsible criminally and civilly. (the hacker)

2. The one holding the data insecurely has cotributory negligence (the degree of which is set CIVILLY by a jury and a Judge can negate, affirm or change it).

Successfully updated karma reason!

Quoting k10w3,

reply 31

I don't know how things are in Australia, but in the US, a person CAN break into an unlocked building, and if they slip on a wet floor while in the unlocked building, they can sue the building owner for negligence (in civil court).

That crap works in Sweden as well!

Quoting k10w3,

reply 31

And as far as things being OK to rape...well, there are some states in the US where it's OK to do that, if the victim is dressed inappropriately.

Do you really mean rape as in normal peoples version of it or the courts technical version? Cause in Sweden those terms are changing (being corrupted) so you can't be sure.

Quoting k10w3,

reply 31

Sony made themselves a target. It's not against the law to make yourself a target, but it doesn't make a lot of business sense to do it, and that's what Sony is finding out.

Got that right! They piss off people and are now paying the price for it! It's good in the way that people will go back to PCs since they can't pirate anymore on consoles and I believe they'll buy atleast SOME games on the PC.

But....there's ONE thing wrong with the statement that it doesn't do much business sense to make yourselves a target.

How do you explain bobby kotick???

You know DAMN well who this is!

Successfully updated karma reason!

the_Monk

Join Date 01/2008

+222

Quoting DrJBHL,

reply 35

Your examples, and the_Monk's are off, because if a company cannot guard the data, they have no business keeping it. If a person is hurt as a result:

1. The one CAUSING the damage is directly responsible criminally and civilly. (the hacker)

2. The one holding the data insecurely has cotributory negligence (the degree of which is set CIVILLY by a jury and a Judge can negate, affirm or change it).

What example of mine? Maybe try quoting me next time so you can accurately address something/anything I say instead of lumping my point (totally different) together with someone else?

I stated that if someone wants in (badly enough)........they're going to get in. My point was refuting the "horror expressed" at the fact that things weren't even encrypted! Oh my.....so there was no encryption......you think encryption would have changed anything in this TARGETED ATTACK other than making the whole thing take longer? Seriously, encrypted things always need to be able to be decrypted.......through that nature alone they will never be "safe".

The point of my entire post revolved around "if you become a target (for whatever reason) then you're screwed".

Not necessary to have an example for such a statement. We all know it's true/fact.

Successfully updated karma reason!

starkers

Join Date 05/2004

+1153

Quoting DrJBHL,

reply 16

I don't like the way they do business either, starkers - so I'll not be disagreeing with you on that account (good pun, wot?).

Yeah, the rootkit debacle did it for me, but my son has done nothing illegal with regard to piracy - his tunes were purchased via emusic - yet Sony treat him as one by making his MP3 player non-compatible via an update he didn't want. That, to me, is no better than home invasion because Sony used covert means to invade his PS3 console... they entered without consent.

Quoting DrJBHL,

reply 16

However, I feel they were substandard in their security. This means they are guilty of negligence with respect to their customers imo.

I agree 100% If a hacker is dead set determined to get in, I guess it's going to be near impossible to keep him out at the end of the day, but Sony still has an obligation to its customers to make their information as safe as it possibly can be. Failing to apply encryption is negligent to say the least... criminal, even.

Quoting DrJBHL,

reply 16

starkers... make sure your son takes care of the credit/personal data stuff. You and he certainly don't want further exploitation of his data.

That's just it, my son never plays online and does not have an account with Sony for anything. The forced update that changed his user experience was encoded into the disc of a new game he'd purchased. I won't repeat his reaction to it for fear of Jafo sitting me in the corner for a while for the extreme use of expletives. Anyway his PS3 is never, ever connected to the net so his details being hacked should not be of concern.

.......................................................................................................................................................

Quoting Campaigner,

reply 24

Sony messes with people by invalidating their pirated/backuped games and what Starkers said so Sony getting punished for it is gleefully delighting (don't know any other way to say it in english).

Um, I only repeated what I had heard, orright? Regardless of Sony's actions I do not advocate what these hackers have done and it is not gleefully delightful in any way shape or form. Let's just say the hackers got hacked [and don't say it can't happen] by more malevolent hackers who are just out to get rich quick off others credit card details, then the victims of Sony's inept, inadequate security measures are hit with a double whammy, aren't they? Not only are their personal details in the hands of unauthorised persons, their hard earned is also in the hands of others who were not intended to receive it. Tell me how that is gleefully delightful!

Quoting DrJBHL,

reply 25

You won't get very far on WinCustomize by advocating piracy and a backed up game is not the same as a pirated one. I can assure you that starkers will be the last person in the world who would agree about what you said about software piracy.

Right on, Doc! Strangely enough... and despite my Cap'n starkers alter ego, I don't advocate piracy even on the high seas. One only has to look at what the Somali pirates are doing to see that Long John Silver [played by Jack Hawkins] and Jack Sparrow {Johnny Depp] are just romanticised characters and bear absolutely no resemblance to real life pirates whatsoever. Aaarrrggghhhh!!!!

.................................................................................................................................................................

Quoting the_Monk,

reply 22

Oh and starkers......you think PC gaming is immune from what's happening to the consoles?

Nope, not at all. As far as I'm concerned most big business is slimy and far too greedy to snaffle your hard earned dollar at any cost, so no, PC games would not be immune to such manipulation. Thing is, I don't have any modern games that have all this DRM crap and other stuff encoded into them. All my games are old school [Riven and Myst, stuff from that bygone era] so I am not affected by any of it, really.... being I'm never ever tempted to go for the latest and greatest in high-end games.

I have absolutely no patience for any DRM that interferes with the user experience, so I leave that to those gluttons for punishment who choose to negotiate it.

Successfully updated karma reason!

Disturbedcomputer

Join Date 02/2007

+137

Quoting DrJBHL,

reply 35

1. The one CAUSING the damage is directly responsible criminally and civilly. (the hacker)

Sony should be to blame here too..

cause here in Kansas and Missouri

if you go outside of your house (Home) and start your car to let it warm up and go back inside and some ass hole steals it YOU ARE liable if the A-Hole runs someone over, use your car to rob a bank, etc. So yes SONY should be just as guilty as the Hackers.

oh and it don't have to be at your home.. Ex if you leave your car running at a convenient store. etc.

so if you do it (at home) have your spouse hit you over the head with something then call the cops to report it stolen .. ha ha

Successfully updated karma reason!

DrJBHL

Join Date 04/2002

+4263

Quoting the_Monk,

reply 37

I stated that if someone wants in (badly enough)........they're going to get in. My point was refuting the "horror expressed" at the fact that things weren't even encrypted! Oh my.....so there was no encryption......you think encryption would have changed anything in this TARGETED ATTACK other than making the whole thing take longer? Seriously, encrypted things always need to be able to be decrypted.......through that nature alone they will never be "safe".

There is encryption that would require a super-cray months to decrypt, if at all. Fact - self encoding HDD's when 'violated' render themselves impervious to decryption by simply erasing their key.

Quoting DisturbedComputer,

reply 39

Sony should be to blame here too..

You should have gone on to "2.", DisturbedComputer.... btw, it's also in the block of text quoted by starkers above.

Successfully updated karma reason!

Quoting the_Monk,

reply 37

I stated that if someone wants in (badly enough)........they're going to get in. My point was refuting the "horror expressed" at the fact that things weren't even encrypted! Oh my.....so there was no encryption......you think encryption would have changed anything in this TARGETED ATTACK other than making the whole thing take longer? Seriously, encrypted things always need to be able to be decrypted.......through that nature alone they will never be "safe".

You're wrong. Passwords should be hashed so that when you get them, they're not usable. This isn't some kind of esoteric super-bizzare requirement that only the NSA uses. It's standard industry best practice that even open-source forum software does. Second year CS students know it. There is never a valid excuse for not doing it.

And SQL Injection? Really? Again, that attack is completely preventable simply by following what has been best practice for a decade (at least!). It doesn't require fancy tools or advanced training. Do they not have a senior developer looking over what the new guy is doing over there?

The point of my entire post revolved around "if you become a target (for whatever reason) then you're screwed".

Not necessary to have an example for such a statement. We all know it's true/fact.

No it's not, and claiming it is doesn't make it so. While it is bordering on impossible to stop the most professional and advanced criminal operations (see Syria, or Operation Aurora against Google), these guys aren't that. You CAN stop random script kiddies who only know how to do what is #1 on the top 10 vulnerability list. These guys could have been thwarted if somebody at Sony wasn't dangerously incompetent.

What you're saying is the online equivalent of "the CIA can get into my house if they really want to, so locks on the doors are a waste of time." And that's what happened here. Sony left the front door open and a pile of gold sitting in it, and is now upset that someone stole it. That doesn't justify the criminals, but they didn't exactly put much effort into protecting themselves. If a bank left themselves open like this and lost peoples money, you wouldn't hear people going "oh that poor bank!" You'd have an army of lawyers suing for negligence to get peoples money back.

Hell, the only way this thing could have been easier to attack is if it was setup as a honeypot.

Successfully updated karma reason!

Quoting DrJBHL,

reply 16

As for the hackers? I don't care what reason they give publicly for their illegal behavior. They are GUILTY of computer crime. END OF STORY.

Well, hackers are useful... without them, you will not have the "Internet"... by the way, these guys are not Hackers but Crackers who is something very different...

Please, read the section "What is a hacker" at http://catb.org/~esr/faqs/hacker-howto.html#what_is ( and read more if you have time )

Successfully updated karma reason!

Quoting the_Monk,

reply 37

.....so there was no encryption......you think encryption would have changed anything in this TARGETED ATTACK other than making the whole thing take longer? Seriously, encrypted things always need to be able to be decrypted......

Well, a 40 bit key will need 0.015 millisecond ( using a cracking computer with 1800 custom processor )... a 56 bit key will take 1 second... a 64 bit key will take 4 min 16 sec... a 128 bit key will take 149745 billion years ( age of the earth is 4.54 billion years, age of the universe is 13.75 billion years )...

Now, in the case of the 128 bit key, let say that we have no limit in the processing speed... in order to simply flip through the possible values for a 128-bit symmetric key (ignoring doing the actual computing to check it) would theoretically require 2¹²⁸ − 1 bit flips on a conventional processor. If it is assumed that the calculation occurs near room temperature (~300 K) the Von Neumann-Landauer Limit ( http://en.wikipedia.org/wiki/Landauer%27s_Principle ) can be applied to estimate the energy required as ~10¹⁸ joules, which is equivalent to consuming 30 gigawatts of power for one year... so, be sure to install your own personal nuclear power unit...

Actual computer ( Intel/AMD processor made after 2008 ) have processor who allow the use of AES 256 bit key in real time, cracking these will need 50,955,671,114,250,100,000,000,000,000,000,000,000,000,000,000,000,000 years...

So, yes, encryption can make thing more longer, a lot more longer... legit computer have the key, who make the encryption/decryption process to be real time... Cracker need to find the key, it is these process who take a lot of time... and without key, the data collected is useless...

Successfully updated karma reason!

DrJBHL

Join Date 04/2002

+4263

Quoting Thoumsin,

reply 42

Quoting DrJBHL, reply 16As for the hackers? I don't care what reason they give publicly for their illegal behavior. They are GUILTY of computer crime. END OF STORY.

Well, hackers are useful... without them, you will not have the "Internet"... by the way, these guys are not Hackers but Crackers who is something very different...

Please, read the section "What is a hacker" at http://catb.org/~esr/faqs/hacker-howto.html#what_is ( and read more if you have time )

"...that which we call a rose

By any other name would smell as sweet;..." - Romeo, Romeo and Juliet, W. Shakespeare

They are criminals. Period...

I should thank the Axis powers for WWII... it gave us Penicillin.

Successfully updated karma reason!

Quoting starkers,

reply 38

Quoting Campaigner, reply 24

Sony messes with people by invalidating their pirated/backuped games and what Starkers said so Sony getting punished for it is gleefully delighting (don't know any other way to say it in english).

[end of Campaigners quote]

Um, I only repeated what I had heard, orright? Regardless of Sony's actions I do not advocate what these hackers have done and it is not gleefully delightful in any way shape or form. Let's just say the hackers got hacked [and don't say it can't happen] by more malevolent hackers who are just out to get rich quick off others credit card details, then the victims of Sony's inept, inadequate security measures are hit with a double whammy, aren't they? Not only are their personal details in the hands of unauthorised persons, their hard earned is also in the hands of others who were not intended to receive it. Tell me how that is gleefully delightful!

What a poor way of argumenting....using possible examples and being dramatic about it....

I said that Sony getting hacked (and thus getting into trouble) is gleefully delighting because they mess with their users.

Successfully updated karma reason!

Jafo

Join Date 03/2001

+1846

Quoting Campaigner,

reply 45

I said that Sony getting hacked (and thus getting into trouble) is gleefully delighting because they mess with their users.

Two wrongs don't make a right....

Successfully updated karma reason!

DrJBHL

Join Date 04/2002

+4263

The reason they're being hacked/cracked (wtf-ever) is the same reason MS and it's products get it, and now it's starting for Apple as well: FOLLOW THE MONEY: In other words "shoot at where the most targets congregate". That way the most is gotten for the least effort (the principle guiding hackers/crackers lives).

These are nothing but criminals whom vulnerable people misidentify as heroes. They (the hackers/crackers) are in fact narcissistic, manipulative parasites.

Successfully updated karma reason!

I love labels.

They do wonders as they are not only used to create divisiveness among us, but are subjective and purely relative in that they are not absolute.

So are the criminals the ones who do wrong against the system? Or are the criminals actually the ones who created the system in the first place?

If the label 'criminal' can be interchangeable within two parties, then so would the term 'heroes'. Glorify the evil-doers? Who would imagine such a thing? Well, that is exactly what we have been conditioned to do....and are doing.

I've been asked to not bring up religion in these forums. I actually don't "bring it up", but you people do that without me. I simply call it for what it is and make reference to the most likely etiological basis for certain related concepts. But little do most of you people realize, that the topics/concepts, whether openly mentioned verbatim here or not, are wholly credited as being created by religion.

These thought-formers have given us a system which we have come to perceive as just, ethical and real. The system gives us the perception of having the potential in material worth (i.e., how we measure ourselves against others...... often at the expense of others; ie narcissism, the underlying attribute of all who engage in commerce) and this in turn is used to keep us at odds with each other, not to mention the multitude of languages the thought-formers have created and the laws they have written to further divide/suppress all of humanity.

We are all parasites in this system.

"Reality", it seems, is the only word in the human language that should always be used in quotes.

-.-

Successfully updated karma reason!

Jafo

Join Date 03/2001

+1846

How many sociologists does it take to change a light globe?

Just one...but the light globe has to WANT to change....

Successfully updated karma reason!

Jafo

Join Date 03/2001

+1846

Quoting aeligos,

reply 48

"Reality", it seems, is the only word in the human language that should always be used in quotes.

....and "sanity" is an attribute that cannot be presumed.

Successfully updated karma reason!

LulzSec Hacks SonyPictures&ndash;1,000,000 Customer Accounts Compromised

LulzSec Hacks SonyPictures–1,000,000 Customer Accounts Compromised

LulzSec Hacks SonyPictures–1,000,000 Customer Accounts Compromised