Attacks/Breaches
8/26/2014
02:55 PM
Sara Peters
Sara Peters
Quick Hits
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Sony, XBox Victims Of DDoS, Hacktivist Threats

Hacktivists from Anonymous and from a presumed Islamic extremist group targeted a variety of online gaming services.

Services are up and running again after a denial of service took down Sony's PlayStation Network for much of Sunday, coinciding with a bomb threat on American Airlines flight 362, which carried John Smedley, president of Sony Online Entertainment. The threats caused the airline to divert the flight.

Other online gaming services -- including Microsoft's XBox Live, Eve Online, and the services that host World of Warcraft and Diablo III -- also experienced disruptions. The culprits seem to be hacktivists, but just which hacktivists is unclear, because several are trying to take credit for the attack, citing different motives.

One group, Lizard Squad, took credit for the attacks and presented two motives on Twitter. One tweet Sunday morning said that Sony "aren't spending the waves of cash they obtain on their customers' PSN service. End the greed." A subsequent tweet stated, "Kuffar [non-believers] don't get to play videogames until bombing of the ISIL [Islamic State of Iraq and the Levant] stops." The account made many references to the Islamic extremist group ISIS.

On Sunday afternoon, Lizard Squad also tweeted the cryptic message ".@AmericanAir We have been receiving reports that @j_smedley's plane #362 from DFW to SAN has explosives on-board, please look into this."

The group tweeted at Smedley with the hashtag #PrayForFlight362 and a video from 2001 of a plane crashing into the World Trade Center.

On a separate account, a hacker associated with Anonymous claimed responsibility for the attack, showing screen shots to prove the work and stating that the attack was launched to highlight vulnerabilities in the PlayStation Network.

Microsoft confirmed that some customers were experiencing disruptions. However, it seems that Lizard Squad found that Microsoft's XBox Live network was sturdier than Sony's. The group tweeted Monday, "Microsoft props to you for giving us a challenge, good work. Sony, smh [shaking my head]."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
9/3/2014 | 10:14:20 AM
LizardSquad disbanding
Looks like the Lizard Squad people have decided to stop operating. And they're being very blase about it and patting themselves on the back a lot. http://www.theregister.co.uk/2014/09/02/lizard_squad_disbands/
Whoopty
50%
50%
Whoopty,
User Rank: Moderator
8/28/2014 | 3:12:22 PM
Re: Last time he'll tweet flight info
Yup, though I feel a bit like I'm victim blaming by saying it. Still, that's an unfortunate price that celebrities and high profile individuals pay for their success I suppose. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/27/2014 | 3:57:30 PM
Re: DDoS
I don't know if this was divulged in the report, but what made Sony easier to exploit than Microsoft?
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
8/27/2014 | 3:21:32 PM
Re: Last time he'll tweet flight info
@Whoopty You are exactly right!  It doesn't make any since why you would provide people with all the information they need to track you.  If you are the CEO of one of the largest corporations in the world you shouldn't provide your flight information via social media. 
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
8/27/2014 | 12:40:46 PM
Re: DDoS
Gaming platforms are a privileged target for hackers for different reasons. Gaming networks manage a huge amount of user data and their resources could be abused for further attacks.

The number of cyber attacks against gaming industry and gamers will increase exponentially in the next months.

 
Whoopty
50%
50%
Whoopty,
User Rank: Moderator
8/27/2014 | 12:15:01 PM
Last time he'll tweet flight info
I imagine this is the last time Mr Smedley, or any other gamer centric executives will tweet out information about their flight plan. Even just a threat of something like that is a scary concept. 

I was a bit dissapointed to see some of the news organisations publicising thee name of the hacker groups claiming responsibility though. Giving them publicity isn't a great way to discorouge such actions. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/27/2014 | 7:03:32 AM
DDoS
Glad I am a Microsoft Gaming Supporter. This just shows that DoS attacks are just as prevalent as ever and will continue to be so, even for large organizations, until hardware changes and packet methodology is changed.

I am writing a research paper for SANS regarding this topic so if anyone would like to delve more deeply into methodology changes, please don't hesitate to ask.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8921
Published: 2015-03-01
The IBM Notes Traveler Companion application 1.0 and 1.1 before 201411010515 for Window Phone, as distributed in IBM Notes Traveler 9.0.1, does not properly restrict the number of executions of the automatic configuration option, which makes it easier for remote attackers to capture credentials by c...

CVE-2014-9676
Published: 2015-02-27
The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.

CVE-2014-9682
Published: 2015-02-27
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

CVE-2015-0655
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.

CVE-2015-0884
Published: 2015-02-27
Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.