Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Sony Hackers Knew Details Of Sony's Entire IT Infrastructure
Oldest First  |  Newest First  |  Threaded View
Page 1 / 4   >   >>
johnwinning12
50%
50%
johnwinning12,
User Rank: Apprentice
12/4/2014 | 9:56:45 PM
Also mentioned on Unfilter
They talked about the Sony hacks I see on this weeks episode of Unfilter by Jupiter Broadcasting titled Putin's Pipe Dream"
BillB031
50%
50%
BillB031,
User Rank: Strategist
12/4/2014 | 11:24:34 PM
insider?
Could it have been a disgruntled insider doing this or assisting?  Almost sounds to extensive for it not to be
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/5/2014 | 9:44:13 AM
Re: insider?
The Verge interview certainly implies that access was gained with the help of an insider..Hard to be sure, not knowing whether the anonynmous source is credible or not. More to come, I hope.

 
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
12/5/2014 | 10:19:43 AM
Attribution
Unlike government organizations, which are unencumbered by shareholder wealth, commercial organizations have an incentive to dilute the reputational impact associated with a breach of this magnitude. An easy way to do this is to attribute the breach to a sophisticated adversary, which clevely offsets a certain amount of responsibility. This would have worked in Sony's favor had the attack more closely resembled nation-state activity. But the post mortem analysis that shows disclosure of social security numbers, contracts, passport photographs, etc. is not a national interest. Nor is an entertainment company, regardless of the underlying "they made a bad move about us" tall tale that has been floated.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
12/5/2014 | 10:28:25 AM
Re: insider?
@Marilyn What struck me about the Verge interview was that the source said "Sony doesn't lock their doors, physically," which makes me think that the attackers got physical access to Sony's systems -- which, they couldn't do from North Korea. It also would have made it much easier for them to walk out with data on portable storage media and install malware without having the usual monitoring software pick up on it.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/5/2014 | 10:54:31 AM
Re: insider?
Excellent points, Sara! You are good detective! If that 's the case  I would hope that at the very minimum, Sony's physical plant security team are locking the doors now.
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
12/5/2014 | 11:01:08 AM
Re: insider?
Yeah, I can't really agree with this. Risk vs. return on a black bag job is far worse than phishing an unsuspecting techniican.
Adam Boone
50%
50%
Adam Boone,
User Rank: Apprentice
12/5/2014 | 1:14:12 PM
Re: insider?
Great article, Sara. Your take on the anonymous source's comments to The Verge seems very logical to me. But I also wonder if maybe it is not some misdirection. By making it seem like they had the help of an insider and physical access, are the attackers hiding some other vector? So it might be compromised remote access to some internal system and then hopping through Sony's infrastructure like in the Target breach. A little misdirection might keep the holes open.
TerryB
50%
50%
TerryB,
User Rank: Ninja
12/5/2014 | 1:58:30 PM
Backups?
I know I'm pretty much a dinosaur as far as tech today but can't they just wipe the hardware and restore from latest backups to get rid of the malware?  What am I missing on this?
stevechalmers
50%
50%
stevechalmers,
User Rank: Apprentice
12/5/2014 | 2:28:04 PM
Re: Backups?
Hmmm...it looks like the attackers had a lot of time inside the Sony network, to find their way around, before the "attack".  The backups from a week ago probably represent systems that were already compromised.  So how far back do you go to be sure the backups themselves don't include the "infection", and do logs exist which allow all transactions since that point in time to be replayed (re done)?

Seems like this is beyond the scope of what a normal disaster recovery plan would cover...

 
Page 1 / 4   >   >>


News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3493
PUBLISHED: 2021-04-17
The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities on files in an underlying file system. Due to the combination of unprivileged user namespaces along with a patch carried in the Ubuntu kernel to allow unprivile...
CVE-2021-3492
PUBLISHED: 2021-04-17
Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring during copy_from_user() correctly. These could lead to either a double-free situation or memory not being freed at all. An attacker could use this to cause a denial of service (ker...
CVE-2020-2509
PUBLISHED: 2021-04-17
A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. We have already fixed this vulnerability in the following versions: QTS 4.5.2.1566 Build 20210202 and later Q...
CVE-2020-36195
PUBLISHED: 2021-04-17
An SQL injection vulnerability has been reported to affect QNAP NAS running Multimedia Console or the Media Streaming add-on. If exploited, the vulnerability allows remote attackers to obtain application information. QNAP has already fixed this vulnerability in the following versions of Multimedia C...
CVE-2021-29445
PUBLISHED: 2021-04-16
jose-node-esm-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AES_CBC_HMAC_SHA2 Algorithm (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDe...