Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

12/4/2014
08:45 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Sony Hackers Knew Details Of Sony's Entire IT Infrastructure

While trying to simultaneously recover from a data breach and a wiper attack, Sony watches attackers publish maps and credentials for everything from production servers to iTunes accounts.

UPDATED Dec. 5, 4 p.m. ET: Whoever they are, the attackers who breached Sony used wiper malware to destroy Sony's systems, and are slowly disclosing stacks of stolen Sony confidential data and intellectual property. And they knew everything there was to know about Sony's IT infrastructure.

Security researchers have discovered that the wiper malware -- called Destover by some, WIPALL by others -- contained hard-coded names of servers inside Sony's network and the credentials to access them. Further, the attackers themselves released a new set of 11,000 files last night that include, as one reporter explained it, "everything needed to manage the day-to-day [IT] operations at Sony."

Sony has been trying to recover from the wiper attacks since they began Nov. 24. Employees' client machines all froze up and locked behind a wallpaper, emblazoned with a red skull, claiming that the company had been pwned by the Guardians of Peace (GOP) because it had not complied with GOP's demands, and warning that the company's secrets were about to be spilled.

True to their word, the attackers began uploading sensitive Sony data to Pastebin. The leaked files contained both corporate data and intellectual property. The files also included full copies of Sony movies that have not yet been released and a script for a new TV pilot by the creator of Breaking Bad. Employee salaries, performance reviews, and criminal background checks were exposed. Plus, according to Identity Finder, over 47,000 unique Social Security numbers were exposed, including those of current and former Sony employees and celebrities, including Sylvester Stallone, Judd Apatow, and Rebel Wilson. Many of those SSNs appeared in multiple documents -- some showed it up in more than 400 places -- so altogether, there were over 1.1 million copies of SSNs.

Meanwhile, the wiper software began destroying all Sony's internal systems. The FBI released a flash alert this week, which did not explicitly mention Sony, but warned of a wiper malware that "has the capability to overwrite a victim host’s master boot record (MBR) and all data files. The overwriting of the data files will make it extremely difficult and costly, if not impossible, to recover the data using standard forensic methods.”

Recovering from a data breach and a large-scale system destruction at the same time is exceptionally complex. Complicating matters further is that the treasure trove of data leaked yesterday includes everything attackers would need to compromise Sony all over again, in the manner of their choosing. The data includes RSA SecurID tokens, global network maps detailing databases and enterprise servers, and access credentials/files for QA servers, staging servers, production servers, routers, switches, load balancers, FTP servers, email accounts, and third-party applications -- including UPS, FedEx, McAfee, Google Analytics, iTunes, Sprint, and Verizon.

So, how does a company recover? Burn whatever's left and build something entirely new and different?

"Shut it all down," says Jody Brazil of FireMon. He says that throwing away the entire company isn't a solution. But for now, he recommends shutting down all external communications and all Web access entirely (and bringing it back slowly and carefully), resetting all passwords, instituting change control, doing a massive assessment of all systems, and aiming to get business running appropriately again in weeks, not days. "It's a very drastic approach," he says, "but the right one."

Sony's media relations department did not answer its phone or respond to emailed requests for comment today. They are working with law enforcement and Mandiant on the investigation.

"They're in a really bad situation," says Jaime Blasco of AlienVault, which has examined the wiper.

"From the samples we obtained," Blasco says, "we can say the attackers knew the internal network from Sony, since the malware samples contain hard-coded names of servers inside Sony’s network and even credentials -- usernames and passwords -- that the malware uses to connect to systems inside the network."

In other words, the wiper was customized for Sony's environment after the attackers obtained all the detailed information about the Sony IT infrastructure.

How did they obtain that information? Either they conducted a staged attack -- compromising the network, poking around, obtaining credentials, escalating privileges, etc. -- or they were given the information by an insider.

Blasco isn't willing to guess, but in a Nov. 25 interview with The Verge, someone claiming to be one of the attackers from the Guardians of Peace said "Sony doesn't lock their doors, physically, so we worked with other staff with similar interests to get in."

The source also told The Verge, "We Want equality [sic]. Sony doesn't. It's an upward battle."

So who are the we they name?

There has been a great deal of speculation that the attackers are based in North Korea -- either nation-state actors or hacktivists -- who were possibly motivated to attack Sony to protest its newly released movie The Interview -- a comedy about two American entertainers being hired by the CIA to assassinate North Korean leader Kim Jong-un. There were even reports stating that Sony was going to confirm any minute now that North Korea was behind the attack. However, Sony responded to those reports Wednesday saying that they were "not accurate." 

According to Blasco, "The malware samples we have found talk to IP addresses in Italy, Singapore, Poland, the US, Thailand, Bolivia, and Cyprus -- probably hacked systems or VPN/proxies that the attackers use to hide the origin. We also found the attackers were using the Korean language in the systems they used to compile some of the pieces of malware we have found.”

The use of Korean in the compiler, says Blasco, is "the only technical indicator" of a North Korean-based attack, "and that info can be faked."

Kaspersky and Symantec, however, say that there are other reasons to make the connection to North Korea. Symantec reports that the Destover wiper uses a command-and-control server that was also used by the Volgmer Trojan, and shares techniques and components with Jokra. Both Jokra and Volgmer were used in attacks against South Korea. 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Page 1 / 4   >   >>
johnwinning12
50%
50%
johnwinning12,
User Rank: Apprentice
12/4/2014 | 9:56:45 PM
Also mentioned on Unfilter
They talked about the Sony hacks I see on this weeks episode of Unfilter by Jupiter Broadcasting titled Putin's Pipe Dream"
BillB031
50%
50%
BillB031,
User Rank: Strategist
12/4/2014 | 11:24:34 PM
insider?
Could it have been a disgruntled insider doing this or assisting?  Almost sounds to extensive for it not to be
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/5/2014 | 9:44:13 AM
Re: insider?
The Verge interview certainly implies that access was gained with the help of an insider..Hard to be sure, not knowing whether the anonynmous source is credible or not. More to come, I hope.

 
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
12/5/2014 | 10:19:43 AM
Attribution
Unlike government organizations, which are unencumbered by shareholder wealth, commercial organizations have an incentive to dilute the reputational impact associated with a breach of this magnitude. An easy way to do this is to attribute the breach to a sophisticated adversary, which clevely offsets a certain amount of responsibility. This would have worked in Sony's favor had the attack more closely resembled nation-state activity. But the post mortem analysis that shows disclosure of social security numbers, contracts, passport photographs, etc. is not a national interest. Nor is an entertainment company, regardless of the underlying "they made a bad move about us" tall tale that has been floated.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
12/5/2014 | 10:28:25 AM
Re: insider?
@Marilyn What struck me about the Verge interview was that the source said "Sony doesn't lock their doors, physically," which makes me think that the attackers got physical access to Sony's systems -- which, they couldn't do from North Korea. It also would have made it much easier for them to walk out with data on portable storage media and install malware without having the usual monitoring software pick up on it.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/5/2014 | 10:54:31 AM
Re: insider?
Excellent points, Sara! You are good detective! If that 's the case  I would hope that at the very minimum, Sony's physical plant security team are locking the doors now.
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
12/5/2014 | 11:01:08 AM
Re: insider?
Yeah, I can't really agree with this. Risk vs. return on a black bag job is far worse than phishing an unsuspecting techniican.
Adam Boone
50%
50%
Adam Boone,
User Rank: Apprentice
12/5/2014 | 1:14:12 PM
Re: insider?
Great article, Sara. Your take on the anonymous source's comments to The Verge seems very logical to me. But I also wonder if maybe it is not some misdirection. By making it seem like they had the help of an insider and physical access, are the attackers hiding some other vector? So it might be compromised remote access to some internal system and then hopping through Sony's infrastructure like in the Target breach. A little misdirection might keep the holes open.
TerryB
50%
50%
TerryB,
User Rank: Ninja
12/5/2014 | 1:58:30 PM
Backups?
I know I'm pretty much a dinosaur as far as tech today but can't they just wipe the hardware and restore from latest backups to get rid of the malware?  What am I missing on this?
stevechalmers
50%
50%
stevechalmers,
User Rank: Apprentice
12/5/2014 | 2:28:04 PM
Re: Backups?
Hmmm...it looks like the attackers had a lot of time inside the Sony network, to find their way around, before the "attack".  The backups from a week ago probably represent systems that were already compromised.  So how far back do you go to be sure the backups themselves don't include the "infection", and do logs exist which allow all transactions since that point in time to be replayed (re done)?

Seems like this is beyond the scope of what a normal disaster recovery plan would cover...

 
Page 1 / 4   >   >>
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25595
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be ...
CVE-2020-5783
PUBLISHED: 2020-09-23
In IgniteNet HeliOS GLinq v2.2.1 r2961, the login functionality does not contain any CSRF protection mechanisms.
CVE-2020-11031
PUBLISHED: 2020-09-23
In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The library c...
CVE-2020-5781
PUBLISHED: 2020-09-23
In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file (/etc/config/luci) by the authenticator.htmlauth function. When modified with arbitrary javascript, this causes a denial-of-service condition for all other users.
CVE-2020-5782
PUBLISHED: 2020-09-23
In IgniteNet HeliOS GLinq v2.2.1 r2961, if a user logs in and sets the ‘wan_type’ parameter, the wan interface for the device will become unreachable, which results in a denial of service condition for devices dependent on this connection.