Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

12/4/2014
08:45 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Sony Hackers Knew Details Of Sony's Entire IT Infrastructure

While trying to simultaneously recover from a data breach and a wiper attack, Sony watches attackers publish maps and credentials for everything from production servers to iTunes accounts.

UPDATED Dec. 5, 4 p.m. ET: Whoever they are, the attackers who breached Sony used wiper malware to destroy Sony's systems, and are slowly disclosing stacks of stolen Sony confidential data and intellectual property. And they knew everything there was to know about Sony's IT infrastructure.

Security researchers have discovered that the wiper malware -- called Destover by some, WIPALL by others -- contained hard-coded names of servers inside Sony's network and the credentials to access them. Further, the attackers themselves released a new set of 11,000 files last night that include, as one reporter explained it, "everything needed to manage the day-to-day [IT] operations at Sony."

Sony has been trying to recover from the wiper attacks since they began Nov. 24. Employees' client machines all froze up and locked behind a wallpaper, emblazoned with a red skull, claiming that the company had been pwned by the Guardians of Peace (GOP) because it had not complied with GOP's demands, and warning that the company's secrets were about to be spilled.

The wallpaper showed on Sony machines.
The wallpaper showed on Sony machines.

True to their word, the attackers began uploading sensitive Sony data to Pastebin. The leaked files contained both corporate data and intellectual property. The files also included full copies of Sony movies that have not yet been released and a script for a new TV pilot by the creator of Breaking Bad. Employee salaries, performance reviews, and criminal background checks were exposed. Plus, according to Identity Finder, over 47,000 unique Social Security numbers were exposed, including those of current and former Sony employees and celebrities, including Sylvester Stallone, Judd Apatow, and Rebel Wilson. Many of those SSNs appeared in multiple documents -- some showed it up in more than 400 places -- so altogether, there were over 1.1 million copies of SSNs.

Meanwhile, the wiper software began destroying all Sony's internal systems. The FBI released a flash alert this week, which did not explicitly mention Sony, but warned of a wiper malware that "has the capability to overwrite a victim host’s master boot record (MBR) and all data files. The overwriting of the data files will make it extremely difficult and costly, if not impossible, to recover the data using standard forensic methods.”

Recovering from a data breach and a large-scale system destruction at the same time is exceptionally complex. Complicating matters further is that the treasure trove of data leaked yesterday includes everything attackers would need to compromise Sony all over again, in the manner of their choosing. The data includes RSA SecurID tokens, global network maps detailing databases and enterprise servers, and access credentials/files for QA servers, staging servers, production servers, routers, switches, load balancers, FTP servers, email accounts, and third-party applications -- including UPS, FedEx, McAfee, Google Analytics, iTunes, Sprint, and Verizon.

So, how does a company recover? Burn whatever's left and build something entirely new and different?

"Shut it all down," says Jody Brazil of FireMon. He says that throwing away the entire company isn't a solution. But for now, he recommends shutting down all external communications and all Web access entirely (and bringing it back slowly and carefully), resetting all passwords, instituting change control, doing a massive assessment of all systems, and aiming to get business running appropriately again in weeks, not days. "It's a very drastic approach," he says, "but the right one."

Sony's media relations department did not answer its phone or respond to emailed requests for comment today. They are working with law enforcement and Mandiant on the investigation.

"They're in a really bad situation," says Jaime Blasco of AlienVault, which has examined the wiper.

"From the samples we obtained," Blasco says, "we can say the attackers knew the internal network from Sony, since the malware samples contain hard-coded names of servers inside Sony’s network and even credentials -- usernames and passwords -- that the malware uses to connect to systems inside the network."

In other words, the wiper was customized for Sony's environment after the attackers obtained all the detailed information about the Sony IT infrastructure.

How did they obtain that information? Either they conducted a staged attack -- compromising the network, poking around, obtaining credentials, escalating privileges, etc. -- or they were given the information by an insider.

Blasco isn't willing to guess, but in a Nov. 25 interview with The Verge, someone claiming to be one of the attackers from the Guardians of Peace said "Sony doesn't lock their doors, physically, so we worked with other staff with similar interests to get in."

The source also told The Verge, "We Want equality [sic]. Sony doesn't. It's an upward battle."

So who are the we they name?

There has been a great deal of speculation that the attackers are based in North Korea -- either nation-state actors or hacktivists -- who were possibly motivated to attack Sony to protest its newly released movie The Interview -- a comedy about two American entertainers being hired by the CIA to assassinate North Korean leader Kim Jong-un. There were even reports stating that Sony was going to confirm any minute now that North Korea was behind the attack. However, Sony responded to those reports Wednesday saying that they were "not accurate." 

According to Blasco, "The malware samples we have found talk to IP addresses in Italy, Singapore, Poland, the US, Thailand, Bolivia, and Cyprus -- probably hacked systems or VPN/proxies that the attackers use to hide the origin. We also found the attackers were using the Korean language in the systems they used to compile some of the pieces of malware we have found.”

The use of Korean in the compiler, says Blasco, is "the only technical indicator" of a North Korean-based attack, "and that info can be faked."

Kaspersky and Symantec, however, say that there are other reasons to make the connection to North Korea. Symantec reports that the Destover wiper uses a command-and-control server that was also used by the Volgmer Trojan, and shares techniques and components with Jokra. Both Jokra and Volgmer were used in attacks against South Korea. 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 4   >   >>
johnwinning12
50%
50%
johnwinning12,
User Rank: Apprentice
12/4/2014 | 9:56:45 PM
Also mentioned on Unfilter
They talked about the Sony hacks I see on this weeks episode of Unfilter by Jupiter Broadcasting titled Putin's Pipe Dream"
BillB031
50%
50%
BillB031,
User Rank: Strategist
12/4/2014 | 11:24:34 PM
insider?
Could it have been a disgruntled insider doing this or assisting?  Almost sounds to extensive for it not to be
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/5/2014 | 9:44:13 AM
Re: insider?
The Verge interview certainly implies that access was gained with the help of an insider..Hard to be sure, not knowing whether the anonynmous source is credible or not. More to come, I hope.

 
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
12/5/2014 | 10:19:43 AM
Attribution
Unlike government organizations, which are unencumbered by shareholder wealth, commercial organizations have an incentive to dilute the reputational impact associated with a breach of this magnitude. An easy way to do this is to attribute the breach to a sophisticated adversary, which clevely offsets a certain amount of responsibility. This would have worked in Sony's favor had the attack more closely resembled nation-state activity. But the post mortem analysis that shows disclosure of social security numbers, contracts, passport photographs, etc. is not a national interest. Nor is an entertainment company, regardless of the underlying "they made a bad move about us" tall tale that has been floated.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
12/5/2014 | 10:28:25 AM
Re: insider?
@Marilyn What struck me about the Verge interview was that the source said "Sony doesn't lock their doors, physically," which makes me think that the attackers got physical access to Sony's systems -- which, they couldn't do from North Korea. It also would have made it much easier for them to walk out with data on portable storage media and install malware without having the usual monitoring software pick up on it.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/5/2014 | 10:54:31 AM
Re: insider?
Excellent points, Sara! You are good detective! If that 's the case  I would hope that at the very minimum, Sony's physical plant security team are locking the doors now.
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
12/5/2014 | 11:01:08 AM
Re: insider?
Yeah, I can't really agree with this. Risk vs. return on a black bag job is far worse than phishing an unsuspecting techniican.
Adam Boone
50%
50%
Adam Boone,
User Rank: Apprentice
12/5/2014 | 1:14:12 PM
Re: insider?
Great article, Sara. Your take on the anonymous source's comments to The Verge seems very logical to me. But I also wonder if maybe it is not some misdirection. By making it seem like they had the help of an insider and physical access, are the attackers hiding some other vector? So it might be compromised remote access to some internal system and then hopping through Sony's infrastructure like in the Target breach. A little misdirection might keep the holes open.
TerryB
50%
50%
TerryB,
User Rank: Ninja
12/5/2014 | 1:58:30 PM
Backups?
I know I'm pretty much a dinosaur as far as tech today but can't they just wipe the hardware and restore from latest backups to get rid of the malware?  What am I missing on this?
stevechalmers
50%
50%
stevechalmers,
User Rank: Apprentice
12/5/2014 | 2:28:04 PM
Re: Backups?
Hmmm...it looks like the attackers had a lot of time inside the Sony network, to find their way around, before the "attack".  The backups from a week ago probably represent systems that were already compromised.  So how far back do you go to be sure the backups themselves don't include the "infection", and do logs exist which allow all transactions since that point in time to be replayed (re done)?

Seems like this is beyond the scope of what a normal disaster recovery plan would cover...

 
Page 1 / 4   >   >>
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2009-20001
PUBLISHED: 2021-03-07
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.
CVE-2020-28466
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
CVE-2021-27364
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2021-27365
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...
CVE-2021-27363
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system...