Sony Hacked Again: SQL injection attack against SonyMusic.gr exposes user data

http://nakedsecurity.sophos.com/2011/05/22/sony-bmg-greece-the-latest-hacked-sony-site/

by kefs • 15 years ago

109 22 15 years ago

nakedsecurity.sophos.com

jbk• 15 years ago

> when this is over, Sony may end up being one of the most secure web assets on the net.

Sorry to be harsh, but this is a wishful thinking.

When you've been very careless about security for years (PS3 random seed not random, music rootkit that was hackable, OMA master key leaked, PSN servers not up-to-date, PSN trusting the PS3s, etc...), you don't simply turn into a "secure" company, unless you spend years of corporate policies and formation, trying to change the habits of your employees...

Changing (or creating new) employees reflexes and habitudes isn't something easy at all, especially when you are an international company, with different cultures on board. This can be a herculean task.

I wish they will succeed, though...

fleitz• 15 years ago

Yeah, it's going to take 3-5 years, look how long it took Microsoft.

guywithabike• 15 years ago

Or it may never happen. Security is a culture and a way-of-life. It's not a couple of technologies, a new CTO, and a couple policy emails and training sessions.

charlesju• 15 years ago

The problem here is that they have created a beacon for all hackers that want to create a name for themselves. Of course they are going to have security loopholes, most web assets do, but their standards now have to magnified by a magnitude to keep intruders out.

alnayyir2• 15 years ago

Sony's incoherence just as a matter of how much surface area they have exposed to the public only multiplies this problem.

robin_reala• 15 years ago

Yeah, this is it. It only takes one SQL injection for Sony to make the news these days. Just think about the number of web properties Sony has. I wouldn’t like to have to job of securing those in the first place, let alone with a bunch crackers with a reason to target you and the associated press coverage.

Not to say that this is good; it’s awful for your users data to be exposed.

kefs• 15 years ago

More details: http://www.thehackernews.com/2011/05/sony-bgm-greece-hack-co...

riobard• 15 years ago

Lesson learned: go fix your security issues _before_ pissing off tons of hackers by lawsuits.

pers3us• 15 years ago

CWuestefeld• 15 years ago

That's a direct result of the new policy to hide article scores.

Derbasti• 15 years ago

We'll see about 'lesson learned'. At the moment, Sony does not look like they learned anything. But I sure hope they will.

JoachimSchipper• 15 years ago

"It could be that the purpose of your life is only to serve as a warning to others." -- http://www.despair.com/mis24x30prin.html

arapidhs• 15 years ago

And PSN still under maintenance in greece.

tytso• 15 years ago

Not having any inside knowledge, I don't _know_ this, but it's always seemed to me that Sony has never been able to write software to save its life. Whether it's PSN, or the pathetic web store for the Sony eReader, or the equally pathetic Mac and PC software for the Sony eReader, Sony software has consistently disappointed me.

Given how brilliant Sony's hardware designers have historically been, I wonder if there is something fundamental going on. Could it be that Sony is simply not good at hiring and retaining good software engineers, perhaps because the hardware engineers get all of the kudos and awards and perks? If so, Sony wouldn't be the only company that has had that problem. Before I gave up on Nokia smartphones (my last Nokia phone was the E70) I've had similar suspicions about Nokia products. I loved their hardware design, but the software didn't seem to live up to the promise of the hardware...

mosburger• 15 years ago

I'm a consultant who is wrapping up a gig w/ a division of Sony, and I will say that Sony as a company is very very silo'ed. The various divisions of Sony almost never communicate amongst each other, and there's a shit-ton of duplicate efforts within groups. I'm very surprised they were able to develop a PSP Phone.

I guess I'm thinking that trying to diagnose the problems with their software as a corporate culture thing might be a bit misguided as Sony literally behaves like several completely separate companies running in parallel, unaware of each other. Although perhaps the quality of their software would improve if they worked together and leveraged each other's work. Seems like a stretch, though.

Splines• 15 years ago

I'm very surprised they were able to develop a PSP Phone.

I'm very surprised that they did it at all. In my opinion it creates a confusing story for PSP owners looking to upgrade. NGP or PSP Phone?

Sometimes I wonder if the two teams were even aware of each other's existence.

swaits• 15 years ago

Sony Music != Sony Pictures != Sony Computer (PlayStation) != Sony Electronics (TVs, etc.)

Sony Hacked Again: SQL injection attack against SonyMusic.gr exposes user data

Related Stories