• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

SONY gets hacked....again!!

Page 2 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.
nkgreen said:
So, imagine Sony's servers are an AIDS-free asshole. And a hacker is diseased infected penis. The penis ejaculates ("injects") diseased infested semen ("SQL, or structured query language") into the asshole ("server"), rendering it diseased and vulnerable.
Click to expand...

looool
 
In all fairness to Sony, it's a different division than the gaming one. With large companies, one hand has no idea what the other is doing.

I also think attacking a company like this is childish. If you don't like a company, vote with your wallet and don't buy their products.
 
Zeze said:
Can someone paint a picture how they actually hack? Their techniques vs protection in layman's terms?
Click to expand...

Well, Mr. Green had a very colorful analogy, but I'll try to explain it a little less... umm... explicitly 😛.

Based on sources, it looks like the hacker group used what's called a SQL Injection attack. First, SQL is a query language used for databases (subsequently called SQL databases). You may have heard of MySQL before, which is an example of a SQL database.

A SQL Injection attack is performed by finding a point in which a website accesses the SQL database but does not perform adequate checks on the user-provided data. For example, let's look at my current Anandtech Forums URL:

http://forums.anandtech.com/newreply.php?do=newreply&p=31798817

Everything after the question mark '?' is a variable (or multiple variables... separated by the ampersand '&') that is provided to the subsequent PHP (this is a web programming language) page. If I remember correctly, these are called ENV (environment) variables in PHP. That's getting a little too detailed, but let's say VBulletin did not perform proper data checking on the 'p' variable.

Chances are the 'p' variable is going to be used to access the database and retrieve the post that I am replying to (in this case, your post). What you usually do is prematurely end the command. This probably involves the SQL SELECT statement, which may look sort of like this:

SELECT post_text FROM forum_posts WHERE id=$p

If I remember correctly, in PHP, I would end a SQL command with a semi-colon ';' So, literally what you do is replace the variable 'p' with a valid value, an end of command character and other commands. With this, you end up executing the original command (probably with a fake value) and then whatever commands the hacker wants.

The hardest part is usually finding the hole, and then you need to figure out what commands you need to use to get the data you want. This isn't terribly hard since you can get SQL databases to list their tables and their information.
 
zinfamous said:
yeah, besides staying off the internet, I do think that in theory, if quantum processing ever comes into the working stage, it is supposed to be hack proof, no?
Click to expand...

Thats quantum cryptography... quantum mechanics guarantees that measuring quantum data disturbs that data; this can be used to detect an adversary's interference with a message.
 
They fell for a SQL injection? That's pretty lame. It means they didn't even do the basics for security. It's their programming that's at fault. But hey, it's free! Get what you pay for.

The ps3 being cracked could have something to do with it if they had access to the source code.
 
Saying that Sony is a pretty fucked up company is a lot like saying that Pakistan is a pretty fucked up country.
 
nkgreen said:
So, imagine Sony's servers are an AIDS-free asshole. And a hacker is diseased infected penis. The penis ejaculates ("injects") diseased infested semen ("SQL, or structured query language") into the asshole ("server"), rendering it diseased and vulnerable.
Click to expand...

Vomit
 
If hackers really stole those info via SQL Injection, and this is after the lesson from the first hack, I can only say Sony should not be in the business at all.

I mean I am no security specialist, but as an app manager, even I know I need to secure my web apps from SQL Injection, and it's not rocket science.
 
I think I saw somewhere that they said the injection was on a gallery page or something, so their website has an address something like this:
http://whatever.com/view_photo.php?id=25
Which is meant to show you whichever photo in the database has an ID of 25. To do that, they pull some information out of the database, and the query kind of looks like this:
SELECT * FROM photos WHERE id = 25;
So if they've done a poor job of coding their site, they just trust whatever the person put in the address, and shove it directly into the database query without checking that it's actually a number first. So someone loads up the address but with a "photo id" something like this:
http://whatever.com/view_photo.php?id=25 UNION ALL SELECT username, password FROM users
Which gets put into the query unchecked like this:
SELECT * FROM photos WHERE id = 25 UNION ALL SELECT username, password FROM users;
Which also pulls out some username/password information from the database along with the photo info.
It's somewhat more complex than that, but that's the basic gist of how an injection attack works.
Click to expand...

For anyone else who wants to know
 
Earlier this afternoon, a slickdeal member posted a file of 20,000 Sony Music Pass 16-digit codes in their hotdeal section, each code representing 3 free song downloads from their site. (I guess you receive codes when you buy sony products?) The thread was deleted within a few moments, but not before it was downloaded atleast few times.

They all seem to work as well, atleast after a small sample of random ones were tested.

Sony is fvcked, lol.


/edit: story
“Among other things, we also compromised all admin details of Sony Pictures (including passwords) along with 75,000 ‘music codes’ and 3.5 million ‘music coupons,’” it added.
Click to expand...

Didn't take too long for atleast some, if not all of them to get into the wild.
 
Last edited:
nkgreen said:
So, imagine Sony's servers are an AIDS-free asshole. And a hacker is diseased infected penis. The penis ejaculates ("injects") diseased infested semen ("SQL, or structured query language") into the asshole ("server"), rendering it diseased and vulnerable.
Click to expand...

:awe:
 
Kev said:
I actually feel bad for sony now. They are really taking it up the ass
Click to expand...

Heh, I don't. I mean, I do feel bad for the poor schmucks who had their info compromised. But Sony themselves are getting exactly what they deserve for not taking fairly basic measures to secure the data.
 
Gooberlx2 said:
Heh, I don't. I mean, I do feel bad for the poor schmucks who had their info compromised. But Sony themselves are getting exactly what they deserve for not taking fairly basic measures to secure the data.
Click to expand...

So you deserve to have people come in and loot your house and go on shopping spree because you don't have a house alarm? Your reasoning is stupid.
 
Malak said:
So you deserve to have people come in and loot your house and go on shopping spree because you don't have a house alarm? Your reasoning is stupid.
Click to expand...

Sure, if you're a known criminal (hi2u free rootkits in all of our music CDs) you deserve to get what's coming.
 
Malak said:
So you deserve to have people come in and loot your house and go on shopping spree because you don't have a house alarm? Your reasoning is stupid.
Click to expand...

If I leave the doors to my house open while I'm away, I don't expect good things to have happened when I get back.
 
Its sad that people find the need to get pissy with Sony over Geohot.
These people need to get out of their basements and become constructive members of society.
 
Zeze said:
Educate me, I'm a total tech noob.

I've read bunch of things about 256-bit encryption on my upcoming phone HTC Evo3D (well HTC unlocked it now due to demand). Such encryption would make any brute force attack impossible to crack and would take millions of years.

Why can't Sony do a similar protection? Is it different because it's web?
Click to expand...

This response makes me sad...

I expected AToT to at least know the difference between man in the middle attack and sql injections.
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top