Support NeoGAF

[Zoe]

someone has to teach corporations how to do internet security, its for our own good

Then send the DB file to them and only them. Don't leak it out to the internet where criminals can do god knows what with innocent people's accounts.

 

[makingmusic476]

The real disappointment is the amount of failure in Sony's security to prevent something as simple as a SQL injection and storing all the passwords in plaintext. That is a damn shame.

It makes you wonder how many other companies are equally as unprotected, and we just don't know because they haven't become targets yet.

Sony was getting away with such meager protection for years and nobody had any idea.

 

[tapedeck]

....sigh.

 

[nVidiot_Whore]

I would not recommend anyone go trolling through the file trying g-mail accounts.. unless you are confident your IP can't be traced it's not really a great idea.. and it is most definitely illegal.

 

[Jack Random]

*edit* They're asking for money now lol

source?

 

[jmdajr]

It's real. I just got into 6 email addresses.

well shucks

 

[Ace 8095]

I also verify this is real.

Edit: Sent the guy an email from his own account telling him what happened and to change his password. Done my good deed for the day.

 

[darkwing]

Then send the DB file to them and only them. Don't leak it out to the internet where criminals can do god knows what with innocent people's accounts.

that isn't the lulz way

 

[iNvid02]

Then send the DB file to them and only them. Don't leak it out to the internet where criminals can do god knows what with innocent people's accounts.

doesnt have the same effect imo

 

[Zoe]

source?

In the OP:

Due to a lack of resource on our part (The Lulz Boat needs additional funding!)

 

[SRG01]

I'm surprised Sony didn't beef up security across all it's divisions. Very stupid on their part, especially considering how much PR damage the PSN hack caused. But at the same time, I wonder how many big name websites are out there that are susceptible to garden variety internet attacks.

Excluding banks and financial institutions? Probably a good half or three quarters of the internet is vulnerable. It's not security through obscurity, but rather "am I an attractive enough target to hit?"

doesnt have the same effect imo

What effect? To increase Sony's security (which according to them is their rationale) or to fulfill some sort of vendetta against them?

 

[hyp3rlink]

Then send the DB file to them and only them. Don't leak it out to the internet where criminals can do god knows what with innocent people's accounts.

There is not enough publicity in that stunt and the fact is this was only done for publicity.

 

[nVidiot_Whore]

Then send the DB file to them and only them. Don't leak it out to the internet where criminals can do god knows what with innocent people's accounts.

The public also should know who not to trust.

The proper thing to do is to let the company know the exact details, and give the public a generic warning.

The leaking of even a portion of the account data is most certainly NOT the right thing to do.

But either is hiding it from the public how bad a major companies security is.

 

[Anticitizen One]

quick someone post that Bill & Ted Sony gif

 

[Jack Random]

In the OP:

ahh, thought you meant they were demanding cash from sony or something, that's just asking for donations, no?

 

[Metalmurphy]

source?

They just posted a BitCoin address on twitter.

 

[Enco]

someone has to teach corporations how to do internet security, its for our own good

Haha.

I assume you're joking. Right?

Fuck these assholes. Fuck hackers and fuck Sony. But mainly the hackers.

 

[Einbroch]

That's a shame. Sony needs to step up their game and the hackers need to not be asses.

 

[Deku]

What accounts are related to sony pictures?

 

[lifa-cobex]

someone has to teach corporations how to do internet security, its for our own good

Wouldn't be surprised if we get charged for future psn use. That's my lesson learnt.

 

[dschalter]

lol at people defending this.

 

[Averon]

I'm surprised Sony didn't beef up security across all it's divisions. Very stupid on their part, especially considering how much PR damage the PSN hack caused. But at the same time, I wonder how many big name websites are out there that are susceptible to garden variety internet attacks.

Sony division's lack of communications with one another is infamous.

 

[eternaLightness]

smh...

 

[madara]

lol at people defending this.

Aye, mind blow if they are older then 14. Disgusting.

 

[nVidiot_Whore]

Excluding banks and financial institutions? Probably a good half or three quarters of the internet is vulnerable.

That's a vast generalization.. most of the internet uses pre-built software.. lots of pre-built software have had vulnerabilities.. but they are also fairly quickly patched.

I've spent my fair share of time tinkering on web sites.. trying to hack them.. I'm decently skilled at it.

You definitely find some here and there. I once found a VBulletin vulnerability.. but it didn't allow me access to any personal data. I could post a link on ALMOST any Vbulletin forum though and cause any user who clicked it to get an avatar of my choosing.

 

[Steve Youngblood]

doesnt have the same effect imo

Well, the truth of the matter is that doing something like this can not in any way shape or form be classified as inherently altruistic. I mean, you can claim it as such, but such a claim is disingenuous. The hackers aren't the good guys, here.

However, depending on the methodology employed to obtain the information, they may or may not inadvertently be doing some good by bringing substandard security implementations to light.

 

[SRG01]

The public also should know who not to trust.

The proper thing to do is to let the company know the exact details, and give the public a generic warning.

The leaking of even a portion of the account data is most certainly NOT the right thing to do.

But either is hiding it from the public how bad a major companies security is.

I think you underestimate how much security research goes on in the background and how many security groups are respectful of other's private data when addressing security issues.

These guys are exhibiting sociopathic behavior, plain and simple. There is no need to get collateral damage.

 

[Solaros]

Is it entirely impossible that the information came from somewhere else or as someone mentioned a honeypot?

I guess people could see if the information logs in (granted they could have also spam registered a bunch of information.

Not saying that's the case, but it's a possibility.

A company that has deplorable info sec practices has honeypots... Right...

 

[XiaNaphryz]

Fuck hackers and fuck Sony. But mainly the hackers.

Cue 20+ page debate on generalizing hackers.

 

[scar tissue]

It's real. I just got into 6 email addresses.

Well, that's it for Sony
They'll never recover from this shit if the hack train keeps going like this

 

[Fuzzery]

It makes you wonder how many other companies are equally as unprotected, and we just don't know because they haven't become targets yet.

Sony was getting away with such meager protection for years and nobody had any idea.

 

[nVidiot_Whore]

I think you underestimate how much security research goes on in the background and how many security groups are respectful of other's private data when addressing security issues.

Where did you get that impression?

I'm well aware of how many white hat groups are out there.. but they don't hide vulnerabilities from the public.

The right thing to do is to tell the company all of the details.. but also warn the public. I said specifically the wrong thing to do is actually leak the data. But a lot of white hat hackers also post public warnings depending on the type of vulnerability.

 

[Loudninja]

Well, that's it for Sony
They'll never recover from this shit if the hack train keeps going like this

Heh give me a break.

 

[TrojanBlade]

Then send the DB file to them and only them. Don't leak it out to the internet where criminals can do god knows what with innocent people's accounts.

This. If they honestly want to help the corps, they would do this and maybe even get some reward for finding the loopholes. But they blatantly diffuse the information on the internets so it could be abused and then they do lolz.

I know Sony has to be blamed here too, but they are not the disease. The fucking hackers who do this shit and then spread it for abuse are.

 

[nilbog21]

haha wow.. i wonder if sony is gona make it to ps4 at this point..

 

[SRG01]

That's a vast generalization.. most of the internet uses pre-built software.. lots of pre-built software have had vulnerabilities.. but they are also fairly quickly patched.

I've spent my fair share of time tinkering on web sites.. trying to hack them.. I'm decently skilled at it.

You definitely find some here and there. I once found a VBulletin vulnerability.. but it didn't allow me access to any personal data. I could post a link on ALMOST any Vbulletin forum though and cause any user who clicked it to get an avatar of my choosing.

Good job, you didn't quote the rest of what I wrote.

Where did you get that impression?

I'm well aware of how many white hat groups are out there.. but they don't hide vulnerabilities from the public.

Most white hat security firms will approach the company with the vulnerability first and work in conjunction with fixing that vulnerability. Only when the scale and vulnerability have been addressed do they actually go public with it.

 

[Kibbles]

what were you trying to sign up for? email updates? shouldn't have needed a password

That was probably it actually. I guess I don't have to worry.

 

[lifa-cobex]

lol at people defending this.

Thinks it's more anger against both sides

 

[whytemyke]

You know, I don't rob convenience stores to prove that they need better security.

So fuckin' true.

 

[Hela]

At least it's not SCE this time, so it won't affect just restored PSN.

 

[Guardian Bob]

Anyone trying this out is doing something seriously illegal.

 

[XiaNaphryz]

So does this mean we'll see more requests to Sony from the US government in the near future?

 

[RustyNails]

Excluding banks and financial institutions? Probably a good half or three quarters of the internet is vulnerable. It's not security through obscurity, but rather "am I an attractive enough target to hit?"

That number is troubling. Considering the fact that all medical records are gonna have to be digitized in the next couple of years, this compounds the issue even more.

 

[notworksafe]

haha wow.. i wonder if sony is gona make it to ps4 at this point..

Please don't be a serious post. Because wow...

 

[Enco]

Cue 20+ page debate on generalizing hackers.

hack·er/ˈhakər/Noun
A person who uses computers to gain unauthorized access to data.

Don't see much debate to be had. If you do it for fun using resources made for hackers then great. If however you pull stunts like this then screw you. This can in no way be defended.

 

[nVidiot_Whore]

Good job, you didn't quote the rest of what I wrote.

Great reply?

It had nothing to do with my comment. You greatly exagerate how many web sites have code vulnerabilities.

Most white hat security firms will approach the company with the vulnerability first and work in conjunction with fixing that vulnerability. Only when the scale and vulnerability have been addressed do they actually go public with it.

Well it depends on the vulnerability, as I said. It's not immediate, I'm just saying.. it's not hidden from the public.

 

[NullPointer]

SONY: It only does EVERYTHING OR 'x'='x'

 

[Scrow]

why don't they hack a company like Serco? Sony is such small fry by comparison.

 

[SRG01]

That number is troubling. Considering the fact that all medical records are gonna have to be digitized in the next couple of years, this compounds the issue even more.

All this means is that information and information security will be sourced to a few specific companies in the future. Security has become too specialized for regular companies to handle.

It's very telling if Lockheed Martin got hacked a few weeks ago.

 

[Vinci]

Well, the truth of the matter is that doing something like this can not in any way shape or form be classified as inherently altruistic. I mean, you can claim it as such, but such a claim is disingenuous. The hackers aren't the good guys, here.

However, depending on the methodology employed to obtain the information, they may or may not inadvertently be doing some good by bringing substandard security implementations to light.

So they're like Robin Hood! =)