Hackers Lulzsec Say Sony Pictures Attacked, 1 Million Users Compromised (UPDATE)

*Scroll down for update*

Sony reportedly suffered yet another hack attack on Thursday.

This time, a group of hackers claims to have accessed the SonyPictures.com servers and compromised personal data belonging to one million customers, which the group said it then posted in a file on its website.

Hacker group LulzSecurity, fresh off its retaliatory attack on a PBS website over a Wikileaks documentary, claimed responsibility for the Sony hack.

In a release posted on the group's website, the hackers claimed they obtained "personal information, including passwords, email addresses, home addresses, dates of birth, and all Sony opt-in data associated with their accounts." The group also claimed that the hack "compromised all admin details of Sony Pictures (including passwords) along with 75,000 'music codes' and 3.5 million 'music coupons.'"

"The hackers published a massive amount of email addresses, user names and passwords, as well as coupon codes. Anyone that's registered on the site should be concerned their data was exposed," Jeremiah Grossman, CTO of WhiteHat Security, told The Huffington Post in an email. "This type of attacks exposes [one] of the fundamental flaws that most companies take to risk management. Focusing on securing your primary site (such as a purchasing site) leaves secondary sites exposed, and they often contain valuable customer data."

Shockingly, Lulzsec alleged that Sony left this information unencrypted and exposed to relatively elementary attacks:

Our goal here is not to come across as master hackers, hence what we're about to reveal: SonyPictures.com was owned by a very simple SQL injection, one of the most primitive and common vulnerabilities, as we should all know by now. From a single injection, we accessed EVERYTHING. Why do you put such faith in a company that allows itself to become open to these simple attacks?

What's worse is that every bit of data we took wasn't encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it's just a matter of taking it. This is disgraceful and insecure: they were asking for it.

While working to recover from the massive PlayStation Network hack that affected millions of customers around the world in April, Sony faced harsh criticism for the network's vulnerabilities and eventually promised that PSN security had been dramatically increased. If Lulzsec's accusations about Sony Pictures are true, Sony may have to rethink security measures for all its online properties.

Sony reportedly spent over $170 million after the PSN hack to cover the cost of identity theft insurance for customers, hacking investigators, tighter site security and more. The company even hired a Chief Information Security Officer. Even still, Sony has asserted that "no system is 100 percent safe."

"Unfortunately we should probably expect more of these types of hacks," Grossman warned.

UPDATE: According to the AP, Sony is "aware of LulzSec's claim and looking into it."

The AP also described accessing the user data posted by the hacker group online:

The data, carried in a plain text file posted to the hacking group's site, appeared to be at least partially genuine. The Associated Press called a number listed by LulzSec as belonging to 84-year-old Mary Tanning, a resident of Minnesota. Tanning picked up the phone, and confirmed the rest of the details listed by LulzSec – including her password, which she said she was changing.

"I don't panic," she told the AP, explaining that she was very seldom online and wasn't wealthy. "There's nothing that they can pick out of me," she joked.

If confirmed, the breach would deal yet another blow to Sony, which suffered a massive cyber-attack in April that targeted credit card information through its PlayStation Network and Sony Online Entertainment networks. Company executives on Thursday faced questions from U.S. lawmakers over why consumers weren't informed more quickly about the breach. Over 100 million user accounts were affected and the company only recently was able to restore service.

Comments

[king totoro]

05:54 PM on 06/05/2011

i dunno. ok sure there vulnerable. but isnt anyone whos ever been outside? thats like someone walking down the street and stabbing someone and stealing there wallet, and then saying " i was testing his defense abilities, he wasnt good"
i understand what there proving, at the same time, i think it is not the right thing to do.
anyway im just a dude in colorado what do i know right?

[Thanks4Watching]

02:28 AM on 06/05/2011

If their security really was that pathetic, they should be happy it was LulzSec who exposed it and not someone looking to steal someone's identity and go on a spending spree. Anonymous and all of it's spin-off groups (including LulzSec) aren't for-profit hackers; pretty much everything and anything they do is to make a point, not to be malicious or for monetary gain.

Like they said; Sony was asking for this to happen. Just be thankful LulzSec was nice enough to say how they did it, instead of making off with the data and selling it to fraudsters.

[masterdaddy0]

11:22 PM on 06/04/2011

"There's an old saying in Tennessee — I know it's in Texas, probably in Tennessee — that says, fool me once, shame on — shame on you. Fool me — you can't get fooled again."

[masterdaddy0]

11:20 PM on 06/04/2011

Yay, now Sony can give away more stuff because of their stupidity.

[Help USA Taxpayer]

08:10 PM on 06/04/2011

Not to worry -- The CEO of Sony will still be receiving his Bonus --- he is too valuable and might leave LOL

[Howard53545]

06:48 AM on 06/04/2011

They have declared war and we are sending out the hackers version of the Navy Seals to Bin Laden them

[nerdkill]

04:52 AM on 06/04/2011

it's sad that people of the internet community don't see what's actually happening. i see these "hackers" as hero's that are progressing the future of the internet. go ahead and keep on defending sony as they leave your data unprotected. blame "hackers" as they show their security problems, and then instead of hiring those individuals... prosecute them. remember, it's not sony's fault. you're the one that assumed they were on the forefront of technology so it must be someone else's fault. it's those dirty hackers that are the problem.

[jabailo]

02:20 AM on 06/04/2011

I don't know which has more holes....Sony Playstation or Fukushima reactor #3.

Ba' ding!

[boomcat44]

01:58 AM on 06/04/2011

Maybe somebody can help me out here. take it slow though, and don't use any of that techno mumbo jumbo. I'm in my fifties, and most days it's all I can do just to turn my computer ON.
A lot of days, I just stare at it and curse.
Anyway, I've been reading some of the responses on this thread, and I admit to being confused.
What these hackers did, was it illegal or not?
Did it cause any trouble or inconvenience for others?
Most people are like me, I think. We're not techno geeks. We only have a very, very, VERY basic understanding of computers.
I mean, even if it's not illegal, why cause trouble for the rest of us, who have little to no clue as to what's happening, and are likely scared to death that we broke something?
I don't get it.

[Valerio della Porta]

09:55 AM on 06/04/2011

http://en.wikipedia.org/wiki/White_hat_(computer_security)

I'm not in the hacker's mind so I don't know if the above was a motivations but that's one reason why you want to probe a system.

[olafTheAwesome]

10:24 AM on 06/04/2011

First of all, hacking, as we know it in the geek world, is the art of modifying the features of a system, in order to accomplish a goal outside of the creator's original purpose.

For the non-geeky types, it simply means the art of breaking into/gaining entry into a system. Now, whether the hacking is illegal depends on whether the system you are hacking into belongs to you or not.

So, we differentiate between white hats, or ethical hackers, and black hats. The white hats are normally employed to hack into systems to test them for vulnerabilities. This is legal hacking.

Black hats hack into systems that do not belong to them, either for glory or due to criminal energy. This is very illegal.

So, as well as abstaining from wine, women and song, you will do well to make a commitment to abstain from black hat hacking ;)

[boomcat44]

12:09 PM on 06/04/2011

That was very helpful. I had never heard the terms "White Hats" and "Black Hats".
So, the hackers that got into Sony were "Black Hats", right?
Well, I wouldn't know how to hack into anything, regardless of what hat I wore.
And BTW, my micro-bio? It's more like a........suggestion.

[okila]

10:17 PM on 06/03/2011

Bill Gates really needs to stop. All this free time on his hands.

[brodieking]

09:10 PM on 06/03/2011

Wow, some people REALLY have it out for Sony. Wouldn't be surprised if they were Xbox Fanboys looking to expose them as the weaker part of the gaming trifecta.

[onlyahumanshell]

01:14 AM on 06/04/2011

xbox was here!

[nerdkill]

04:45 AM on 06/04/2011

yeah... because it couldn't be that sony asked for it... couldn't be that sony is trying to stop the future of the internet. they're so innocent... poor guys. don't let your fanboyism blind you.... so silly. see you on psn;)

[TKI]

07:50 PM on 06/03/2011

Grease to your elbows, idiots

[fgbouman]

06:08 PM on 06/03/2011

It is a shame that these sorts of juvenile criminals take no shame in their inconveniencing and possibly harming millions of people. Certainly companies need to care for their customers's data, but that is no excuse for hackers to declare war on the general public, which is exactly what they are doing.

[Eris23]

07:07 PM on 06/03/2011

Not exactly. The delivery was certainly juvenile. However, it's not an act of war on the general public. It's merely a shaming of one of the world's most powerful corporations that has both the capital and the experience to not have implemented such weak security.

[NunyaBus99]

11:57 PM on 06/03/2011

the general public is just collateral damage in their war against Sony. Sure some at the company might get shamed but the peoples information that was stolen and posted where others could use it, will cause problems for some of them.

[nerdkill]

04:48 AM on 06/04/2011

you clearly have no idea of what true hackers do for the world wide community. other than those that actually want your personal information, the majority of "hackers" are trying to prove a point. the freedom of the internet and your information is under attack... not by hackers, but by sony. try reading slightly between the lines.

[toofarleft4thisworld]

06:37 AM on 06/04/2011

we want the airwaves!

[RevSpaminator]

02:56 PM on 06/03/2011

This is about as silly as your bank placing all of it's cash and deposits in an open wooden box in their parking lot at the end of the day.

[fgbouman]

06:13 PM on 06/03/2011

Wrong. It is as your bank's securing your money in its vault without stationing a cordon of police around the bank. Sony's failue has been its failure to take extraordinary security steps when it knew that there were safecrackers in the neighborhood.

[RevSpaminator]

07:00 PM on 06/03/2011

Wrong. This was a rudimentary SQL injection. All the 'hackers' did was ask for the data and the system handed it to them. Sony didn't even bother to encrypt the passwords with a simple hash.

No one even bothered put a lid on the box.

[Eris23]

07:08 PM on 06/03/2011

Hardly. Breaking into a site and getting all the passwords and e-mails of users througha simple SQL injection via a web browser is not remotely the same as cracking a vault. It's literally equivalent to jiggling a door knob to see if the lock will pop, only to discover that it does and there was no other security in place.

[jo smith456]

02:42 PM on 06/03/2011

Just a simple SQL INJECTION? And confidential information are not encrypted?

Shocking!!!

Interestingly, it reminds me, from the past, of the "rootkit" spy-like feature that Sony put into its consumer products.

[portabello]

03:06 PM on 06/03/2011

Yeah, that was sweet of them. I don't like hackers but this could not possibly be happening to a more deserving company.