Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Advanced Threats

12/4/2014
08:45 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Sony Hackers Knew Details Of Sony's Entire IT Infrastructure

While trying to simultaneously recover from a data breach and a wiper attack, Sony watches attackers publish maps and credentials for everything from production servers to iTunes accounts.

UPDATED Dec. 5, 4 p.m. ET: Whoever they are, the attackers who breached Sony used wiper malware to destroy Sony's systems, and are slowly disclosing stacks of stolen Sony confidential data and intellectual property. And they knew everything there was to know about Sony's IT infrastructure.

Security researchers have discovered that the wiper malware -- called Destover by some, WIPALL by others -- contained hard-coded names of servers inside Sony's network and the credentials to access them. Further, the attackers themselves released a new set of 11,000 files last night that include, as one reporter explained it, "everything needed to manage the day-to-day [IT] operations at Sony."

Sony has been trying to recover from the wiper attacks since they began Nov. 24. Employees' client machines all froze up and locked behind a wallpaper, emblazoned with a red skull, claiming that the company had been pwned by the Guardians of Peace (GOP) because it had not complied with GOP's demands, and warning that the company's secrets were about to be spilled.

The wallpaper showed on Sony machines.
The wallpaper showed on Sony machines.

True to their word, the attackers began uploading sensitive Sony data to Pastebin. The leaked files contained both corporate data and intellectual property. The files also included full copies of Sony movies that have not yet been released and a script for a new TV pilot by the creator of Breaking Bad. Employee salaries, performance reviews, and criminal background checks were exposed. Plus, according to Identity Finder, over 47,000 unique Social Security numbers were exposed, including those of current and former Sony employees and celebrities, including Sylvester Stallone, Judd Apatow, and Rebel Wilson. Many of those SSNs appeared in multiple documents -- some showed it up in more than 400 places -- so altogether, there were over 1.1 million copies of SSNs.

Meanwhile, the wiper software began destroying all Sony's internal systems. The FBI released a flash alert this week, which did not explicitly mention Sony, but warned of a wiper malware that "has the capability to overwrite a victim host’s master boot record (MBR) and all data files. The overwriting of the data files will make it extremely difficult and costly, if not impossible, to recover the data using standard forensic methods.”

Recovering from a data breach and a large-scale system destruction at the same time is exceptionally complex. Complicating matters further is that the treasure trove of data leaked yesterday includes everything attackers would need to compromise Sony all over again, in the manner of their choosing. The data includes RSA SecurID tokens, global network maps detailing databases and enterprise servers, and access credentials/files for QA servers, staging servers, production servers, routers, switches, load balancers, FTP servers, email accounts, and third-party applications -- including UPS, FedEx, McAfee, Google Analytics, iTunes, Sprint, and Verizon.

So, how does a company recover? Burn whatever's left and build something entirely new and different?

"Shut it all down," says Jody Brazil of FireMon. He says that throwing away the entire company isn't a solution. But for now, he recommends shutting down all external communications and all Web access entirely (and bringing it back slowly and carefully), resetting all passwords, instituting change control, doing a massive assessment of all systems, and aiming to get business running appropriately again in weeks, not days. "It's a very drastic approach," he says, "but the right one."

Sony's media relations department did not answer its phone or respond to emailed requests for comment today. They are working with law enforcement and Mandiant on the investigation.

"They're in a really bad situation," says Jaime Blasco of AlienVault, which has examined the wiper.

"From the samples we obtained," Blasco says, "we can say the attackers knew the internal network from Sony, since the malware samples contain hard-coded names of servers inside Sony’s network and even credentials -- usernames and passwords -- that the malware uses to connect to systems inside the network."

In other words, the wiper was customized for Sony's environment after the attackers obtained all the detailed information about the Sony IT infrastructure.

How did they obtain that information? Either they conducted a staged attack -- compromising the network, poking around, obtaining credentials, escalating privileges, etc. -- or they were given the information by an insider.

Blasco isn't willing to guess, but in a Nov. 25 interview with The Verge, someone claiming to be one of the attackers from the Guardians of Peace said "Sony doesn't lock their doors, physically, so we worked with other staff with similar interests to get in."

The source also told The Verge, "We Want equality [sic]. Sony doesn't. It's an upward battle."

So who are the we they name?

There has been a great deal of speculation that the attackers are based in North Korea -- either nation-state actors or hacktivists -- who were possibly motivated to attack Sony to protest its newly released movie The Interview -- a comedy about two American entertainers being hired by the CIA to assassinate North Korean leader Kim Jong-un. There were even reports stating that Sony was going to confirm any minute now that North Korea was behind the attack. However, Sony responded to those reports Wednesday saying that they were "not accurate." 

According to Blasco, "The malware samples we have found talk to IP addresses in Italy, Singapore, Poland, the US, Thailand, Bolivia, and Cyprus -- probably hacked systems or VPN/proxies that the attackers use to hide the origin. We also found the attackers were using the Korean language in the systems they used to compile some of the pieces of malware we have found.”

The use of Korean in the compiler, says Blasco, is "the only technical indicator" of a North Korean-based attack, "and that info can be faked."

Kaspersky and Symantec, however, say that there are other reasons to make the connection to North Korea. Symantec reports that the Destover wiper uses a command-and-control server that was also used by the Volgmer Trojan, and shares techniques and components with Jokra. Both Jokra and Volgmer were used in attacks against South Korea. 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 3 / 4   >   >>
Technocrati
0%
100%
Technocrati,
User Rank: Ninja
12/6/2014 | 10:49:21 PM
Sony Learning the Hard Way: Technology and Arrogance Do Not Mix

I knew you would be all over this story Sara ! : )     This one really tops the cake.  I have not stopped laughing since I heard the news !  Matter of fact I am laugh now.

Easily one of the most arrogant companies around -  Sony  thought they could take a light hearted ( an oxymoron for sure in the case of Sony ) poke at a leader of a country known to harbor hackers or at least have an connection to the network of hackers that routinely breeches U.S. systems from banking to retail ?

Knowing that their systems have already been compromised.  Can you say "arrogance" ?  And once the arrogant bully was hit in the eye - he ran to the FBI and cried foul.  ( I can barely finished this post - as the chuckle rises from my belly.)

So initially it was a handful of yet to be released ( block busters ) , and now we learn the damage includes salaries and social security numbers !  

I am not laughing anymore.  And neither are the people who have been compromised by Sony's habitual incompetence and arrogance.

 

Sony a technology company ?   I think that is a reach to be honest.

ODA155
50%
50%
ODA155,
User Rank: Ninja
12/5/2014 | 3:02:07 PM
Re: Backups?
@stevechalmers, I'm posting to your comment because I can't add a new comment... hhmmm.

Anyway, take the number 3. What's that you ask, that's how many times Sony networks in one form or another have been hacked since 2010. Now, with that in mind how much confidence do you or should you have that Sony has spent the resources (time, manpower, money... whatever) to investigate, determine how those hacks occurred and properly address them? I don't, why... because it's happened again. Something to remember, any good hacker as does any good PenTester will do their homework, it's called reconnaissance, regardless how long it takes. And for all we know someone doing reconnaissance could have been mapping Sony's network for years, why, because it's an easy mark... low hanging fruit, I don't know.

When you talk about inside information, how many people do you think would actually know this much detailed information about ANY network unless you built it or are responsible for it's security? Does Sony have a SIEM, I'd start there... email is always a great place to start because other than a computer it's most likely the only thing common to all of your users.

"Recovering from a data breach and a large-scale system destruction at the same time is exceptionally complex. Complicating matters further is that the treasure trove of data leaked yesterday includes everything attackers would need to compromise Sony all over again, in the manner of their choosing. " This is exactly my point, who's to say this current network exposure isn't a direct result of the breaches? You ask "So, how does a company recover? Burn whatever's left and build something entirely new and different?"... in this case yes, I think that would be prudent, and I would also add to that statement... build it with new people.

My personal opinion is this, at this point it really doesn't matter who did it, Sony had\has a target on it's back for a while and they failed (really bad) to address that problem and protect it's resources, therefore Sony is to blame and to me it is that simple.
stevechalmers
50%
50%
stevechalmers,
User Rank: Apprentice
12/5/2014 | 2:28:04 PM
Re: Backups?
Hmmm...it looks like the attackers had a lot of time inside the Sony network, to find their way around, before the "attack".  The backups from a week ago probably represent systems that were already compromised.  So how far back do you go to be sure the backups themselves don't include the "infection", and do logs exist which allow all transactions since that point in time to be replayed (re done)?

Seems like this is beyond the scope of what a normal disaster recovery plan would cover...

 
TerryB
50%
50%
TerryB,
User Rank: Ninja
12/5/2014 | 1:58:30 PM
Backups?
I know I'm pretty much a dinosaur as far as tech today but can't they just wipe the hardware and restore from latest backups to get rid of the malware?  What am I missing on this?
Adam Boone
50%
50%
Adam Boone,
User Rank: Apprentice
12/5/2014 | 1:14:12 PM
Re: insider?
Great article, Sara. Your take on the anonymous source's comments to The Verge seems very logical to me. But I also wonder if maybe it is not some misdirection. By making it seem like they had the help of an insider and physical access, are the attackers hiding some other vector? So it might be compromised remote access to some internal system and then hopping through Sony's infrastructure like in the Target breach. A little misdirection might keep the holes open.
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
12/5/2014 | 11:01:08 AM
Re: insider?
Yeah, I can't really agree with this. Risk vs. return on a black bag job is far worse than phishing an unsuspecting techniican.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/5/2014 | 10:54:31 AM
Re: insider?
Excellent points, Sara! You are good detective! If that 's the case  I would hope that at the very minimum, Sony's physical plant security team are locking the doors now.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
12/5/2014 | 10:28:25 AM
Re: insider?
@Marilyn What struck me about the Verge interview was that the source said "Sony doesn't lock their doors, physically," which makes me think that the attackers got physical access to Sony's systems -- which, they couldn't do from North Korea. It also would have made it much easier for them to walk out with data on portable storage media and install malware without having the usual monitoring software pick up on it.
savoiadilucania
50%
50%
savoiadilucania,
User Rank: Moderator
12/5/2014 | 10:19:43 AM
Attribution
Unlike government organizations, which are unencumbered by shareholder wealth, commercial organizations have an incentive to dilute the reputational impact associated with a breach of this magnitude. An easy way to do this is to attribute the breach to a sophisticated adversary, which clevely offsets a certain amount of responsibility. This would have worked in Sony's favor had the attack more closely resembled nation-state activity. But the post mortem analysis that shows disclosure of social security numbers, contracts, passport photographs, etc. is not a national interest. Nor is an entertainment company, regardless of the underlying "they made a bad move about us" tall tale that has been floated.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/5/2014 | 9:44:13 AM
Re: insider?
The Verge interview certainly implies that access was gained with the help of an insider..Hard to be sure, not knowing whether the anonynmous source is credible or not. More to come, I hope.

 
<<   <   Page 3 / 4   >   >>
News
US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
News
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
News
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7856
PUBLISHED: 2021-04-20
A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient authentication validation.
CVE-2021-28793
PUBLISHED: 2021-04-20
vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration.
CVE-2021-25679
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed....
CVE-2021-25680
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** The AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. These issues impact at minimum versions 10.8.1 and below but potentially impact later versions as well since they have not previously been disclosed. Only...
CVE-2021-25681
PUBLISHED: 2021-04-20
** UNSUPPORTED WHEN ASSIGNED ** AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The aff...