Technology/Entertainment: Sony Pictures Hack

Sony just can't seem to catch a break. Today marks the first time that Sony has been able to get the PlayStation Network fully up and running since the major hack in April (SOE has been back up since a few weeks ago). It also has significance for Sony in a wholly different way: the Sony Pictures site has been hacked, and the integrity of information for more than one million users has been compromised.

Hacker group LulzSec claims to have successfully hacked SonyPictures.com, managing to gain themselves access to user accounts including passwords, e-mail addresses, full home addresses, and date of birth.

On top of that, Sony Pictures accounts also have a number of opt-in features that contain further information about each user depending on what each signs up for. LulzSec state all of that detail was available to them. They also managed to get the details of all admin accounts for the website.

But unfortunately, the pain for Sony doesn’t seem to stop there, though. 75,000 music codes and 3.5 million music coupons are thought to have been taken. We believe these are codes that allow you to purchase Sony music tracks at a discounted price, or in some cases even for free.

The most shocking and possibly damning thing revealed by this hack is the fact that Sony stored all the Sony Pictures account passwords in plain text. No encryption means no work for the hackers, beyond gaining access to the server.

This is an excerpt from a post by LulsSec on Pastebin.com

Our goal here is not to come across as master hackers, hence what we're about to reveal: SonyPictures.com was owned by a very simple SQL injection, one of the most primitive and common vulnerabilities, as we should all know by now. From a single injection, we accessed EVERYTHING. Why do you put such faith in a company that allows itself to become open to these simple attacks?


What's worse is that every bit of data we took wasn't encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it's just a matter of taking it. This is disgraceful and insecure: they were asking for it.


This is an embarrassment to Sony; the SQLi link is provided in our file contents, and we invite anyone with the balls to check for themselves that what we say is true.

This is sure to cause yet more upset for Sony in the press and with users. It also means they have millions of codes to mark as unusable on their system asap.

Gaming: Sony Hacks

You may be aware of the recent Sony PlayStation Network (PSN) hacks that may well have included private and confidential information from many of it's 77 million plus subscribers a few weeks ago. You may even be affected by this. Not only has Sony been slow to bring the PSN back up, but they have also brought down the servers for their Sony Online Entertainment (SOE) branch, as a result of yet another hack. This part affects me, as I play DC Universe Online, and now not only can't I, but I may have also had my own personal information swiped. Damn skippy. 

The statement from Sony is that they decided to temporarily bring the SOE servers down as a result of their ongoing investigation of the PSN hacks. Sony has stated, however, that SOE users weren’t affected by the attack, and hasn’t changed that story at all, which is somewhat comforting. 

The statement on Sony’s site reads: “We have had to take the SOE service down temporarily. In the course of our investigation into the intrusion into our systems we have discovered an issue that warrants enough concern for us to take the service down effective immediately... We apologize for any inconvenience and greatly appreciate your patience.”

Whether or not the damage is still spreading and Sony is uncovering more issues in the wake of the original attack remains to be seen. There’s no doubt Sony would like to update its community only to say service is restored and they’ve determined no data was lost, but bringing the environment offline is a big step just to prove that. Unfortunately, it’s possible we haven’t seen the end of Sony’s security woes just yet.

There's been talk of Sony offering up it's users free games and/or free playtime in compensation of the inconvenience caused by the down time, and that seems all well and good for a company trying its hardest not to lose any more money than they have to. But that wasn't good enough for some.

Less than a week after the first PlayStation Network-related class action suit was filed against Sony, a second legal claim has been initiated. While the first didn't ask for a specific amount, the second is quite clear on how much it wants from Sony - at least 1 billion dollars in damages. But those aren't US dollars, they're Canadian one, which means Sony might have to shell out more money as a result of our strong dollar.

The second suit was announced on Monday by the Toronto law firm of McPhadden Samac Tuovi LLP, with Sony Canada, Sony USA, and "other Sony entities" being named as defendants. The firm has commenced the proposed class action on behalf of 21-year-old Mississauga, Ontario, resident Natasha Maksimovic. Described as a years-long PlayStation user, the lawsuit quotes Maksimovic as being outraged by the PSN outage and subsequent data breach. 

"If you can't trust a huge multi-national corporation like Sony to protect your private information, who can you trust?" asked Maksimovic in a statement. "It appears to me that Sony focuses more on protecting its games than its PlayStation users." 

The class action proposes that the C$1 billion ($1.04 billion) in damages be used to pay for "costs of credit monitoring services and fraud insurance coverage for two years." It was unclear if the amount would be applied only to the cost of the 1 million Canadian PSN users affected by the still-ongoing outage, or all the 77 million global PSN users whose information may have been exposed. 

It seems quite clear that Sony really, really wants its users to take its bri..er, "generous offer" which will essentially mean that any subscriber who does, will effectively no longer have any stake in the class action suits held against the entertainment giant.

For more information on the suit, and if you can participate, follow this link: http://www.mcst.ca/ClassActions/ClassActionsHome/SonyPSN/