Shocking: Sony Learned No Password Lessons After The 2011 PSN Hack

from the sony-is-as-sony-does dept

The great Sony hack of 2014: what’s it all about? Is it a subversive plot by North Koreans operating out of China in revenge for a film starring two guys from Freaks and Geeks? Or maybe it’s simply fodder for stupid politicians to remind us that all the world’s ills could be cured if only internet service providers took on the challenge of fixing all the things in all the places? No, my dear friends, no. The Sony hack of 2014 is a beautiful Christmas gift (your religious holiday may vary) of a wake-up call to anyone silly enough to think that Sony would bother to learn the lessons very recent history has tried to teach it.

To prove this, one need only review the latest file dump in the leak, which features the wonderful naivete of whatever bright minds are in charge of Sony’s internal password conventions and storage policies.

In a small file titled “Bonus.rar,” hackers included a folder named “Password.” It’s exactly what it sounds like: 140 files containing thousands upon thousands of private passwords, virtually all of them stored in plaintext documents without protection of any kind. Some seem personal in nature (“karrie’s Passwords.xls”) while others are wider in scope (“YouTube login passwords.xls”). Many are tied to financial accounts like American Express, while others provide access to corporate voicemail accounts or internal servers, and come conveniently paired with full names, addresses, phone numbers, and emails.

In case you’re unfamiliar with the hack against Sony’s Playstation Network a mere three years ago, the problem was — you guessed it — the exact same thing. In that case, the hack produced customer names, addresses, emails and login/password information because that information was stored in plain text, contrary to the advice of every competent network security person on the planet. Take, for instance, one security researcher quoted in the link above:

Passwords in plaintext? These guys are pretty bad – I don’t think I’ve ever encountered this before. What’s the point of using common password storage/hashing techniques if your staff is keeping all your passwords in plain text on open fileshares? Shit, why bother having locks on the doors at all?

The worst of all the problem’s this hack revealed is that this question should have been answered in the wake of the events of three years ago. It’s one thing to screw up. It’s quite another to screw up in a manner that went public in a spectacular way and simply refuse to take measures to ensure it doesn’t happen again. But that’s Sony for you: long live plain text.

Filed Under: , ,
Companies: sony, sony pictures

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Shocking: Sony Learned No Password Lessons After The 2011 PSN Hack”

Subscribe: RSS Leave a comment
Anonymous Coward says:

Normally I’d recommend using an encrypted password manager, such as Bruce Schneier’s Password Safe or KeePass. But since all the computers on Sony’s networks were already compromised by backdoors, keyloggers and disk wipers. It probably would have made little difference. At least it would have made stealing passwords a little harder for the hackers. Maybe.

That Anonymous Coward (profile) says:

Until the cost of being stupid reaches X, they will keep being stupid.

X is an amount where shareholders might lose value, or actually take the board to task if they figure out they did nothing after the last time.

So first it was random hackers, then North Korea, then a variant of some other malware… anyone notice a theme?
Facing harsh well financed hackers their systems fell after the security was breached.
They spent more on PR after Sownage than on fixing the issues. They will never have to pay themselves for the failures, the costs will be passed down to those people they managed to screw while keeping the bosses country club memberships up to date. Politicians are blaming anything remotely related to the internet as being at fault, it lets them push other pet projects they have going.

This company failed to learn from over 20 lessons, and once again wants to play the we are the poor victims card. If you forget to lock your door and get robbed, you are a victim. If you fail to lock your door 23 times, you are an idiot… especially in a world where you can buy a lock off the shelf that self locks… but that was to expensive to bother with, and now you want people to feel sorry for you.

Perhaps one should question any pay raises or bonuses that were given, and ask could they have paid for actual security with it. But multimillion dollar liability and lawsuits from not only the little people but other millionaires perhaps maybe the message will make it across exactly how badly they screwed this up and THIS time they might tie a string on their finger to remind them to lock the door.

Anonymous Coward says:

Re: Re:

Does this open up Sony to the same things that the 2013 Target hacking has had?

This is different.

Target had their customer’s credit card information exposed. The news of this directly impacted their revenues and profits. Subsequently this led to their executive overseeing IT leaving the company. The liability of this is over customer protection laws.

Now Sony had their HR and payroll data exposed. That won’t impact their customers directly. But it will affect their workforce morale. Can’t say how much this will indirectly impact their revenues or costs. Any liability here will be over worker protection laws…

The effect of having their internal people up in arms over IT will be interesting to observe.

coward (anon) says:

Re: If one division in a large corporation sneezes, it does not mean the rest gets shots

Well said. As someone who worked for Sony Network Entertainment during the 2011 hack I can tell you that while SNEI made a lot of long overdue changes following that hack, other Sony properties, like Sony Pictures (SPE), probably weren’t even aware that we had been hacked. Other than licensing issues related to selling/renting SPE movies there is no communication or commonality between the 2 divisions.

I also believe that this hack and the sorts of data that were stolen is far less due to it being Sony and more a common problem with movie studios. The people who work at studios are extremely both non-technical and not interested in becoming technical. Passwords only exist because the IT nerds like making everyone else’s life miserable. So the simplest way to keep track of multiple passwords is to put them in a text file and share them. What I find far more unfathomable is why were there DVD quality digital copies of upcoming movies accessible on a network connected to the internet? Normally one would expect those sorts of assets to be kept isolated via an air gap.

Matthew A. Sawtell (profile) says:

Re: Re: If one division in a large corporation sneezes, it does not mean the rest gets shots

It would be nice to think that ‘non-technical people’ would not do silly things like storing entire movies in odd places, yet that was the one thing that saved Pixar’s collective behinds with Toy Story 2 when they lost a server farm, and realized their backups were nothing. Again, have a large enough organization – you will have instances of ‘shadow IT’ and ‘rogue data operations’ with divisions and smaller organizations, good or bad. Throw into this mix an IT staff that is mostly outsourced contractors, and we get to see more issues arise.

Anonymous Coward says:

Disagree with the anonymous security researcher

Passwords in plaintext? These guys are pretty bad – I don’t think I’ve ever encountered this before. What’s the point of using common password storage/hashing techniques if your staff is keeping all your passwords in plain text on open fileshares? Shit, why bother having locks on the doors at all?

Anonymous security researcher misses a critical point here. Yes, passwords should be stored hashed when you are the password authority, since you only need to verify the other party knows it. However, all of the passwords referenced in this article are used to authenticate to services that Sony cannot readily configure to use hashing: other corporations, which despite years of advice to the contrary, continue to use plaintext-password-in-the-form authentication (usually, but not always, delivered over https to prevent passive snooping); closed systems (e.g. Windows shares) which take directory credentials; etc. If the referenced web services authenticated via client certificates or encouraged delegation methods to readily support the idea that each Sony employee would have unique credentials for authenticating to a single external account, I would be less sympathetic to Sony. Sony showed poor discipline by getting breached and by storing the data in a form which requires minimal effort to abuse, but I don’t see that they could have kept the passwords private once the attackers breached the Sony network.

Anonymous Coward says:

Re: Disagree with the anonymous security researcher

There are ways to securely share a common password to a group of people. and have a way to do this.

There is no valid excuse/reason to store passwords in plain text.

Why is a company like Sony, with lots of money, not implementing Two-Factor authentication? Passwords will get compromised, if you do not have protections against that you will get P0wned.

Reading some RSA token device and typing the code IS too hard for some drones. There are other two factor devices such as Yubikeys that even a monkey could be taught to do, plug into USB port, press button.

There is no excuse to NOT have two-factor auth. Technology is readily available and cheap.

Anonymous Coward says:

Put the Company on the line

I think it’s time to start putting companies on the line. If they can’t keep data secure, replace the C-board, or force Chapter 7. That’ll get their attention.

Bottom line: Everyone is going to get hacked sometime. The real issue is how quickly do you discover it, and how do you handle it once you find out?

If your company sucks at security, so should your business prospects.

Mason Wheeler (profile) says:

Re: Put the Company on the line

Agreed. Having it happen the first time was bad enough, but when it happens again, that goes beyond simple stupidity; it’s hard to regard this level of incompetence as anything other than an act of malicious, willful negligence.

With this, Sony has proven themselves to be a menace to the community. If I were a regulator, I’d be looking real hard right about now at the possibility of revoking their corporate charter.

Anonymous Coward says:

but it will allow Sony to come back with some other hair-brained scheme that will fuck the customers up more! something like forcing changes to the O/S or making it compulsory to install new firmware that does absolutely nothing except allow Sony to go after people using big sticks against them in case one of each million are using a cloned handset or something! like other areas of the entertainment industries, nothing that should be done is ever done! and when something is done, it’s always to screw over the people that are relied on to keep the business going!!

Anonymous Coward says:

This article has shown me that using encrypted password managers on computers with any kind of online capabilities is a very bad idea. Once the hackers breach your system, all they need to do is install a keylogger to get your master password. At which point they’ll have unfettered access to the rest of the password stored in the password manager.

I really need to upgrade to a computer with hardware visualization support. Then I can run my password manager in a virtual machine that has no network access. Then just copy/paste username/passwords between VMs using the clipboard. Hackers might intercept a few of my passwords through the clipboard, but at least they won’t get my master password.

A more secure alternative is buying a dedicated offline computer for password management. This approach is rather inconvenient though. I’d have to manually type each username/password in by hand, in order to transfer the passwords between the offline machine and the online machine.

Perhaps I can refactor a smartphone into an offline computer for dedicated password management. I’d have to disable the the cellular baseband modem, wifi, and bluetooth on the phone. But at least it’s small enough for me to carry around so I have my passwords everywhere I go.

I think I’ll go with the dedicated computer method. That way I always have my passwords on me in the form of a pocket sized offline computer. Now I just need to find a reliable password manager compiled for Arm processors.

The only thing to watch out for is losing your pocket sized computer which holds all your passwords on it. I’ll have to make regular backups of the password manager’s encrypted database, stored on the phone’s SD card, and store it in the cloud or a some other location in case my house burns down.

I’m learning a lot for the Sony breach. I wonder if Sony is too.

Eldakka (profile) says:

Re: Re:

Time to dig out my old palmpilot that doesn’t have any wireless connectivity (except an infra-red port, but at least that’s line of site and I can cover it), and install a password manager on there and use it only for retrieving my passwords, no wireless connections, never plug it in to another device, just use the monochrome LED screen for input/output.

Or maybe get out an old smartphone and physically disconnect the antennas.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...