Attacks/Breaches
8/26/2014
02:55 PM
Sara Peters
Sara Peters
Quick Hits
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Sony, XBox Victims Of DDoS, Hacktivist Threats

Hacktivists from Anonymous and from a presumed Islamic extremist group targeted a variety of online gaming services.

Services are up and running again after a denial of service took down Sony's PlayStation Network for much of Sunday, coinciding with a bomb threat on American Airlines flight 362, which carried John Smedley, president of Sony Online Entertainment. The threats caused the airline to divert the flight.

Other online gaming services -- including Microsoft's XBox Live, Eve Online, and the services that host World of Warcraft and Diablo III -- also experienced disruptions. The culprits seem to be hacktivists, but just which hacktivists is unclear, because several are trying to take credit for the attack, citing different motives.

One group, Lizard Squad, took credit for the attacks and presented two motives on Twitter. One tweet Sunday morning said that Sony "aren't spending the waves of cash they obtain on their customers' PSN service. End the greed." A subsequent tweet stated, "Kuffar [non-believers] don't get to play videogames until bombing of the ISIL [Islamic State of Iraq and the Levant] stops." The account made many references to the Islamic extremist group ISIS.

On Sunday afternoon, Lizard Squad also tweeted the cryptic message ".@AmericanAir We have been receiving reports that @j_smedley's plane #362 from DFW to SAN has explosives on-board, please look into this."

The group tweeted at Smedley with the hashtag #PrayForFlight362 and a video from 2001 of a plane crashing into the World Trade Center.

On a separate account, a hacker associated with Anonymous claimed responsibility for the attack, showing screen shots to prove the work and stating that the attack was launched to highlight vulnerabilities in the PlayStation Network.

Microsoft confirmed that some customers were experiencing disruptions. However, it seems that Lizard Squad found that Microsoft's XBox Live network was sturdier than Sony's. The group tweeted Monday, "Microsoft props to you for giving us a challenge, good work. Sony, smh [shaking my head]."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
9/3/2014 | 10:14:20 AM
LizardSquad disbanding
Looks like the Lizard Squad people have decided to stop operating. And they're being very blase about it and patting themselves on the back a lot. http://www.theregister.co.uk/2014/09/02/lizard_squad_disbands/
Whoopty
50%
50%
Whoopty,
User Rank: Moderator
8/28/2014 | 3:12:22 PM
Re: Last time he'll tweet flight info
Yup, though I feel a bit like I'm victim blaming by saying it. Still, that's an unfortunate price that celebrities and high profile individuals pay for their success I suppose. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/27/2014 | 3:57:30 PM
Re: DDoS
I don't know if this was divulged in the report, but what made Sony easier to exploit than Microsoft?
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
8/27/2014 | 3:21:32 PM
Re: Last time he'll tweet flight info
@Whoopty You are exactly right!  It doesn't make any since why you would provide people with all the information they need to track you.  If you are the CEO of one of the largest corporations in the world you shouldn't provide your flight information via social media. 
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
8/27/2014 | 12:40:46 PM
Re: DDoS
Gaming platforms are a privileged target for hackers for different reasons. Gaming networks manage a huge amount of user data and their resources could be abused for further attacks.

The number of cyber attacks against gaming industry and gamers will increase exponentially in the next months.

 
Whoopty
50%
50%
Whoopty,
User Rank: Moderator
8/27/2014 | 12:15:01 PM
Last time he'll tweet flight info
I imagine this is the last time Mr Smedley, or any other gamer centric executives will tweet out information about their flight plan. Even just a threat of something like that is a scary concept. 

I was a bit dissapointed to see some of the news organisations publicising thee name of the hacker groups claiming responsibility though. Giving them publicity isn't a great way to discorouge such actions. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/27/2014 | 7:03:32 AM
DDoS
Glad I am a Microsoft Gaming Supporter. This just shows that DoS attacks are just as prevalent as ever and will continue to be so, even for large organizations, until hardware changes and packet methodology is changed.

I am writing a research paper for SANS regarding this topic so if anyone would like to delve more deeply into methodology changes, please don't hesitate to ask.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5312
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

CVE-2012-6662
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

CVE-2014-1424
Published: 2014-11-24
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw."

CVE-2014-7817
Published: 2014-11-24
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".

CVE-2014-7821
Published: 2014-11-24
OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?