Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Sony Reports 24.5 Million More Accounts Hacked

After a second breach, the company suspends all Sony Online Entertainment multiplayer games as the number of compromised user accounts exceeds 100 million.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
Sony on Tuesday disclosed that another 24.5 million user accounts were compromised by attackers in mid-April, this time in a breach of its Sony Online Entertainment (SOE) division systems. The division is best known for its massively multiplayer games, which include EverQuest II and Clone Wars Adventures.

According to a notice posted on the SOE website, Sony has temporarily suspended all online multiplayer SOE games "until we could verify their security."

The newly discovered breach is the latest security setback for the consumer electronics giant, which saw sales of $77.8 billion for its 2010 fiscal year. All together, the total number of accounts compromised by attackers in the past month now stands at more than 100 million.

In a statement released on Tuesday, Sony said that "we had previously believed that SOE customer data had not been obtained in the cyber-attacks on the company, but on May 1st we concluded that SOE account information may have been stolen and we are notifying you as soon as possible." Stolen information may include a user's name, address, email address, gender, birth date, and phone number--if supplied by the user--as well as their login name and a hashed password.

Some credit card data also was compromised in the SOE breach. Surprisingly, Sony said the data was from "an outdated database from 2007 containing approximately 12,700 non-U.S. customer credit or debit card numbers and expiration dates (but not credit card security codes) and about 10,700 direct debit records listing bank account numbers of certain customers in Germany, Austria, Netherlands, and Spain may have also been obtained." Sony says it is notifying affected customers as quickly as possible.

Security experts reacted with surprise at Sony's rolling disclosures. "How many locations on your network are housing other 'lost' financial data?" said Chester Wisniewski, a senior security advisor at Sophos Canada, in a blog post. "Do you even know where my information is to check whether it has been stolen?"

Sony's disclosure of the newly discovered breach at SOE come as the company is still investigating the extent of the previously reported breach of its PlayStation Network and Qriocity services, which affected 77 million users and has already been the subject of a U.S. lawsuit that seeks class action status.

Sony said on Monday that while passwords stolen in the PlayStation Network and Qriocity intrusions weren't encrypted, they also weren't stored in clear text. Rather, "they were transformed using a cryptographic hash function," said Sony's senior director for corporate communications and social media, Patrick Seybold, in a website statement.

But hashing doesn't automatically equal unbreakable security, said Wisniewski at Sophos. "Sony was quick to note that the passwords had been hashed, but has not disclosed which hashing algorithm was used and whether they used a salt when calculating the hashes."

Earlier this year, for example, to show that the SHA1 secure hashing algorithm is weak, German security researcher Thomas Roth rented $2.10 of computing power from Amazon Elastic Compute Cloud (EC2) to crack 14 SHA1 hashes.

John P. Pironti, president of IP Architects, said in a telephone interview that the worry is that attackers will recover valid username and password credentials, which they can apply to websites en masse. "People only use one password for a lot of sites," he said. Another worry is that the information may end up built into a botnet, as with Waledac, which uses stolen but legitimate credentials to bypass spam filters and security defenses.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .