Attacks/Breaches
8/26/2014
02:55 PM
Sara Peters
Sara Peters
Quick Hits
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Sony, XBox Victims Of DDoS, Hacktivist Threats

Hacktivists from Anonymous and from a presumed Islamic extremist group targeted a variety of online gaming services.

Services are up and running again after a denial of service took down Sony's PlayStation Network for much of Sunday, coinciding with a bomb threat on American Airlines flight 362, which carried John Smedley, president of Sony Online Entertainment. The threats caused the airline to divert the flight.

Other online gaming services -- including Microsoft's XBox Live, Eve Online, and the services that host World of Warcraft and Diablo III -- also experienced disruptions. The culprits seem to be hacktivists, but just which hacktivists is unclear, because several are trying to take credit for the attack, citing different motives.

One group, Lizard Squad, took credit for the attacks and presented two motives on Twitter. One tweet Sunday morning said that Sony "aren't spending the waves of cash they obtain on their customers' PSN service. End the greed." A subsequent tweet stated, "Kuffar [non-believers] don't get to play videogames until bombing of the ISIL [Islamic State of Iraq and the Levant] stops." The account made many references to the Islamic extremist group ISIS.

On Sunday afternoon, Lizard Squad also tweeted the cryptic message ".@AmericanAir We have been receiving reports that @j_smedley's plane #362 from DFW to SAN has explosives on-board, please look into this."

The group tweeted at Smedley with the hashtag #PrayForFlight362 and a video from 2001 of a plane crashing into the World Trade Center.

On a separate account, a hacker associated with Anonymous claimed responsibility for the attack, showing screen shots to prove the work and stating that the attack was launched to highlight vulnerabilities in the PlayStation Network.

Microsoft confirmed that some customers were experiencing disruptions. However, it seems that Lizard Squad found that Microsoft's XBox Live network was sturdier than Sony's. The group tweeted Monday, "Microsoft props to you for giving us a challenge, good work. Sony, smh [shaking my head]."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
9/3/2014 | 10:14:20 AM
LizardSquad disbanding
Looks like the Lizard Squad people have decided to stop operating. And they're being very blase about it and patting themselves on the back a lot. http://www.theregister.co.uk/2014/09/02/lizard_squad_disbands/
Whoopty
50%
50%
Whoopty,
User Rank: Moderator
8/28/2014 | 3:12:22 PM
Re: Last time he'll tweet flight info
Yup, though I feel a bit like I'm victim blaming by saying it. Still, that's an unfortunate price that celebrities and high profile individuals pay for their success I suppose. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/27/2014 | 3:57:30 PM
Re: DDoS
I don't know if this was divulged in the report, but what made Sony easier to exploit than Microsoft?
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
8/27/2014 | 3:21:32 PM
Re: Last time he'll tweet flight info
@Whoopty You are exactly right!  It doesn't make any since why you would provide people with all the information they need to track you.  If you are the CEO of one of the largest corporations in the world you shouldn't provide your flight information via social media. 
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
8/27/2014 | 12:40:46 PM
Re: DDoS
Gaming platforms are a privileged target for hackers for different reasons. Gaming networks manage a huge amount of user data and their resources could be abused for further attacks.

The number of cyber attacks against gaming industry and gamers will increase exponentially in the next months.

 
Whoopty
50%
50%
Whoopty,
User Rank: Moderator
8/27/2014 | 12:15:01 PM
Last time he'll tweet flight info
I imagine this is the last time Mr Smedley, or any other gamer centric executives will tweet out information about their flight plan. Even just a threat of something like that is a scary concept. 

I was a bit dissapointed to see some of the news organisations publicising thee name of the hacker groups claiming responsibility though. Giving them publicity isn't a great way to discorouge such actions. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/27/2014 | 7:03:32 AM
DDoS
Glad I am a Microsoft Gaming Supporter. This just shows that DoS attacks are just as prevalent as ever and will continue to be so, even for large organizations, until hardware changes and packet methodology is changed.

I am writing a research paper for SANS regarding this topic so if anyone would like to delve more deeply into methodology changes, please don't hesitate to ask.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.