Sony Got Hacked Hard: What We Know and Don't Know So Far

http://www.wired.com/2014/12/sony-hack-what-we-know/

by SoftwareMaven • 12 years ago

237 171 12 years ago

Danieru• 12 years ago

"Or that the company spent half a million this year in severance costs to terminate employees?"

That's not much. Is Wired trying to make me think that is a lot? Or are they trying to play it against the salary figures? Considering they spent valuable words in the first sentence to make it clear that the top brass is "mostly" white males I get the impression the comparison was supposed to mean something.

legohead• 12 years ago

From another article I saw [1] it appeared that there was half a million spent in severance for a single employee. Others were listed as well, in 100k range, and the article author left out the names of the employees.

[1] http://fusion.net/story/30850/

foldor• 12 years ago

Actually the "mostly white males" comment struck me as an interesting side note. Sony is a Japanese company, so for it to be run by "mostly white males" is something that seems noteworthy in itself. Though I doubt that's what they were going for when they wrote that.

RaptorJ• 12 years ago

Not Sony but Sony Pictures Entertainment which is an american subsidiary.

cheeze• 12 years ago

http://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootki...

dagw4• 12 years ago

Different Sony.

CamperBob22• 12 years ago

Same name, same (lack of) good will.

nostromo2• 12 years ago

The North Korean theory seems silly. In fact, it's exactly what I might say publicly if I were Sony and I wanted to try and turn lemons (being hacked) into lemonade (free buzz about an upcoming movie). The movie Kim Jong-un doesn't want you to see!

In the end, I doubt there was any hacking involved at all: a disgruntled employee leaked documents. Perhaps Sony forgot to disable someone's password after giving them the axe.

001sky• 12 years ago

The "state sponsored" line was about a form a data recovery sabotage used. Seems an insider would have a similar desire to hide tracks. Blame the "mysterious outside forces" is always the kneejerk tho.

higherpurpose3• 12 years ago

If they did it on purpose it's even sillier. They may think that it would be cool to say they "got hacked by a state" especially if it's related to an upcoming movie about it, but to me it seems like amateur hour at Sony if they got hacked by North Korea, a country not exactly known for its advanced technology and high computer usage.

dagw4• 12 years ago

North Korea as a country might be behind the technological curve, but several reports indicate the the North Korean Army cyber warfare division is pretty well funded and advanced. There is a huge divide between the day to day realities of the average NK citizen and the realities of the upper echelons.

pyre• 12 years ago

If they did it on purpose it's even sillier.

Doubtful. Several still-in-theater or unreleased movies are apparently up on torrent sites from this hack. I don't think that they would do this just to promote another film...

tallanvor• 12 years ago

I doubt that Sony has ruled out the possibility of it being an inside job, or done with the help of someone who has knowledge of their network and systems, but it's still very possible this was the work of outsiders.

Unfortunately we'll probably be left guessing as to how this hack happened and how long it went on, since Sony is not likely to ever release that information even if they figure out the cause.

Tossrock• 12 years ago

Except for the part where a flaming skull abruptly appeared on the screens of all the employees, forcing everyone to go home? How much more "hack" can you get?

Illniyar2• 12 years ago

"Pastebin—the unofficial cloud repository of hackers everywhere"

Are they referring to "http://pastebin.com/" ? if so is it really "the unoffical cloud repository of hackers everywhere" ? Is it really used often by hackers?

I thought reddit and 4chan are the more popular places to dump illegally gained information.

nostromo2• 12 years ago

Very common.

https://www.google.com/search?q=pastebin.com%20email%20and%2...

Illniyar2• 12 years ago

Don't they have some kind of policy to get rid of these things?

superuser2• 12 years ago

Every password dump, claim of responsibility for a hack, etc. I have ever seen has been on pastebin.

I suspect this is just because it'a a highly-visible, non-sketchy domain name that provides free, scalable hosting of text that can be used anonymously without much effort.

hiou• 12 years ago

Here's an interview with Jeroen Vader. I assume he still owns pastebin and may provide some insight into why it works well for that purpose.

http://www.bbc.com/news/technology-17524822

higherpurpose3• 12 years ago

Hacker Pastebin strikes again, trying to outdo hacker 4chan.

martin1975• 12 years ago

Smells like an inside job.

mintplant• 12 years ago

An article on The Hollywood Reporter has some more information on this, including perspectives from sources elsewhere within the industry: http://www.hollywoodreporter.com/news/sony-hack-studio-secur...

"It's changing our business," says one producer of its impact on Hollywood. "From now on, money and time will be allocated by studios to deal with this full-time."

...as it should have been already, given how big and how valuable a target these companies are.

msantos• 12 years ago

"It's changing our business," says one producer of its impact on Hollywood. "From now on, money and time will be allocated by studios to deal with this full-time."

Shame that most of Sony's Finance and HR are blaming the IT department - so bloody typical!

"Everyone’s looking to the IT department to say, ‘How did you let this happen?'" said one employee in Sony Pictures’ finance department." http://fusion.net/story/31116/inside-sony-pictures-employees...

gadders• 12 years ago

I work in an IT department. Pretty sure IT Security would be the responsibility of somebody here.

ck2• 12 years ago

Not knowing anything about it did not stop every damn "news" channel from saying "oh North Korea did it" then added at the end "but there is no proof".

How can "news" call themselves news if all they do is speculate. Granted it wouldn't be entertaining if all they said was "Sony got hacked and we don't have any details" but that is why news is called news.

cellis• 12 years ago

Nope! News is simply "here's some words you might be interested in reading, and hopefully believing: ...words here...". Journalism is a dying art.

logn• 12 years ago

WSJ has some reasons to suspect North Korea:

http://online.wsj.com/articles/more-signs-north-korea-may-be...

But I think most of the media pretty much just reads the news, press releases, and their social media feeds to write their articles.

higherpurpose3• 12 years ago

You'd think they would've learned a thing or two after they were made the hackers' pinata the last time around. Sony continues to come up as the poster-boy company for weak security.

Narishma• 12 years ago

That was a different Sony company that was hacked. I don't think they share much in common except the Sony name.

LLWM2• 12 years ago

It was twelve different Sony companies. It was clear that no part of Sony had any interest in information security.

chx2• 12 years ago

So. Sony America suffered an outage on the Playstation Network due to a hack in 2011 causing 171 million in damages (that's the official figure, who knows how much the lost goodwill cost them ongoing). After that if they did not make cybersecurity priority number 1 then they deserve what they've gotten. Fool me once, shame on you; fool me twice, shame on me.

derefr2• 12 years ago

Effectively, Sony Computer Entertainment and Sony Pictures Entertainment are about as related as Virgin Airlines and Virgin Mobile. Think of Sony (and any conglomerate in general) not as a parent company per se, but more like a VC firm or a majority-shareholder mutual fund; the executives of the Sony conglomerate don't really have any more insight into the component companies than those companies' other shareholders do. The only way business-process insight is going to be spread between the component companies is if the executives of one happen to read the trade press of the other.

chx2• 12 years ago

Eh, if I am a majority shareholder then I will read the riot act to the company I hold a majority in after they lose $171M on shitty security. Also, http://www.sony.com/SCA/who-we-are/our-businesses.shtml lists all these so there is some cohesion. AFAIK there's no such Virgin supercompany.

rasz_pl• 12 years ago

and yet this happened http://www.theregister.co.uk/2014/12/03/strange_things_afoot...

PSN computers hosted leak torrent, so PSN was also hacked

elnate• 12 years ago

Is this a hack of a division of Sony? Because the executive names I found don't sound white. http://www.sony.net/SonyInfo/CorporateInfo/executive/

davidw• 12 years ago

Now we all do, since about 40 gigabytes of sensitive company data from computers belonging to Sony Pictures Entertainment were stolen and posted online.

From the article, a few sentences in.

lkbm2• 12 years ago

It's Sony Pictures Entertainment, am American subsidiary: http://www.sonypictures.com/corp/management.html

yabatopia• 12 years ago

It's Sony Pictures Entertainment that got hacked, not Sony. They're completely separate companies, yet the media fails to recognize that. Very annoying and confusing, it's almost deliberately.

chinpokomon• 12 years ago

Gosh, someone should tell someone at Sony. They themselves draw no distinction.

Sony -- Script to Screen: http://youtu.be/4P4Wl1Ogg_g

itafroma• 12 years ago

It's Sony Pictures Entertainment that got hacked, not Sony. They're completely separate companies, yet the media fails to recognize that.

Sony is a very large conglomerate: while it would be incorrect to say that, say, Sony Computer Entertainment (the subsidiary that runs Sony's video games operations) got hacked, Sony Pictures Entertainment is a wholly-owned subsidiary of Sony Entertainment, Inc., which is itself a wholly-owned subsidiary of Sony Corporation.[1] It's as much "Sony" as any of its other subsidiaries.

[1] http://www.sonypictures.com/corp/aboutsonypictures.html

CamperBob22• 12 years ago

BS. We heard the same lame excuse when the Sony-BMG rootkit debacle took place. You want to use the name "Sony" for positive publicity and goodwill? Then you take the negative publicity along with it.

_delirium• 12 years ago

"Completely separate companies" is overstating it a bit. Operationally separate business units of the same company might be closer to the mark. Their "About" page doesn't even try to describe them independently, saying only that "Sony Pictures Entertainment (SPE) is a subsidiary of Sony Entertainment Inc., a subsidiary of Tokyo-based Sony Corporation." And the footer links directly to sony.com.

johansch2• 12 years ago

A bunch of Amazon EC2 machines that were also running web sites seemingly part of the Sony Playstation network were seeding the torrent for a day or so after the leak:

http://www.theregister.co.uk/2014/12/03/strange_things_afoot...

GFK_of_xmaspast2• 12 years ago

That's just corporate sophistry.

simi_• 12 years ago

The compensation levels should't be confidential in the first place. This policy is only useful to the wrong people.

This is how we get artificially low market rates for developers and ridiculous amounts of money paid to incompetent execs.

edit: the downvotes are an indication that you deserve your bullshit laws/status quo

maaaats• 12 years ago

The down votes may not be because people disagree with open salaries, but because this has no value in the discussion.

doctorpangloss• 12 years ago

Many people suggest that startups not over-optimize on issues like security and performance when it's not their core business.

The same could be said of Sony: empathize a little with them. Sony Pictures pays a lot of creative people. Maybe they should have seen the hack coming, but like the PSN outage this story will be maybe a paragraph in a Wikipedia article years from now. Even one great film could be watched by people a century from now, and I respect that their priorities are around figuring out economically viable filmmaking, not I.T.

The film industry regards Sony Pictures as the major studio that still takes risks on edgy comedies and dramas. They are known to respect directors more than the other majors.

Gawker will surface their ridiculous PowerPoints which truthfully exist everywhere. Or journalists will scandalize the executive pay and severances, nevermind that Nick Denton's and Anna Wintour's paychecks and perks are probably far more offensive.

But I don't mean to engage in whataboutism. In fact I mean the opposite: Just because some tech companies care a lot about security doesn't mean everyone should.

InclinedPlane• 12 years ago

I empathize with them not at all. I know how much Sony pays their high level security folks, it's a laughable amount and there is no possible way they could retain anyone even remotely qualified for those roles. If you do your best and get hacked, I'll empathize. If you deprioritize security to an extreme degree and get hacked I won't feel sorry for you.

akshatpradhan5• 12 years ago

Sony Pictures has an operating income (revenue minus expenses) of $501 million per year. They can afford to pay creatives, but they can't afford to pay for a few more security engineers?

Look, I get the creative field costs a lot of money. But Sony Pictures was paying $454,224,070 http://fusion.net/story/30850/ in total salaries as of May.

Even hiring 5 more security engineers would have gone a long way. That's $1 million if we assume a $200k salary for good security engineers. A drop in the bucket for Sony Pictures.

I personally could do a lot with 5 security engineers.

l33tbro• 12 years ago

Exactly. Let's not engage in this faux polemic about art-v-practicality. Sony are not mumblecore aesthetes from Bushwick. They are a megalith that should have their security locked down hard. Sorry you got owned, but seriously get with consensual reality: hackerfolk tend to hate owners of Big Content like you. Should have seen this coming ...

johansch2• 12 years ago

Security is also incredibly, incredibly hard. Google were hacked quite hard as well, remember?

basch2• 12 years ago

you are talking about human problems. people clicking links. people typing their passwords into foreign web forms.

software engineers wont magically fix executives handing over credentials to hackers.

if you were designing a network and interface to access your files, maybe you could design it without resorting to passwords, but that wasn't practical in sonys case.

maybe they could have designed their network to notice the data leaving, but again, the hackers could always find a way to win. (physical infiltration of the company and a verizon hotspot?)

darkarmani• 12 years ago

They can afford to pay creatives, but they can't afford to pay for a few more security engineers?

So how do you measure their risk and the probability of being damaged? Serious security experts are STILL trying to figure out how to calculate these things. Insurance companies still have trouble "properly" pricing cyber insurance. The insurance companies are doing it, but they are way behind their ability to price for other forms of disasters.

So how much should they spend towards cyber security? How far off are they from that amount? We don't know. (well maybe we'll know from the leaked documents).

GFK_of_xmaspast2• 12 years ago

Why can't they be like Sony Music, and not pay creatives at all.

billions• 12 years ago

Sony has a culture problem: if it is not a Japanese initiative, it doesn't happen. Unfortunately, the Japanese web executives are at least 10 years behind on Silicon Valley, on knowledge and vision. For as long as there isn't a Japanese security expert, born in Japan and groomed at Sony, Sony will continue taking these types of blows.

TrainedMonkey2• 12 years ago

Let me rephrase the question here, we could either spend $1m on some gobbledegook that those fast talking nerds saying we need, or we could get bigger bonuses. We worked hard and bonuses would be tangible, when asked about how we will know if $1m expenditure a year is working fast talking nerds talk even more quicker about something that amounts to 'nothing bad will happen'.

We are arguing here from position of knowledge that guys who make these decisions likely do not have. Should they have it? Probably not, but they definitely should listen to someone who knows and who can present solid risk/cost/benefit analysis that they can understand.

matthewmacleod3• 12 years ago

Many people suggest that startups not over-optimize on issues like security and performance when it's not their core business.

And that's a fucking stupid thing to say in those cases, so it's a fucking stupid thing to say here.

Things like security and performance should be given. This is akin to arguing that small restaurants shouldn't care about food safety, or that small construction firms shouldn't worry about building codes. If you ignore these things, you'll fuck it up and people will get hurt.

jdimov• 12 years ago

When it comes to start-ups it's not stupid - it's wise. The food safety analogy is inappropriate. Security is about risk management. Low risks do not justify high expenses.

When it comes to a company with hundreds of millions in revenues, however, they have clearly underestimated the risks and have been irresponsible.

dasil0033• 12 years ago

You're acting like there are no tradeoffs for these things. There are always tradeoffs.

tomp• 12 years ago

Things like security and performance should be given. This is akin to arguing that small restaurants shouldn't care about food safety, or that small construction firms shouldn't worry about building codes.

No, it's completely different. Food safety and building codes is akin to good software engineering; on the other hand, security against hacks is more like a restaurant protecting you from a third party poisoning your food, or a building withstanding planes crashing into it. Most building and most restaurants don't offer such protection.

WorldWideWayne• 12 years ago

Firstly - What's with the fucking attitude?

Secondly - Did you see the words over optimize? There is certainly such a thing as too much optimization in terms of security. Would you hire police men to patrol your kid's lemonade stand startup? No.

dcole2929• 12 years ago

this entire thread of conversations is a joke. Do you know more about this breach than what was written in the article because they clearly state they don't know exactly what happened. Which isn't to say that Sony doesn't know more but from details released how can you know anything about what Sony does or doesn't do security wise that they should have been?

Like literally the first rule of Security is that as the person trying to defend, protect, secure something you are always at a disadvantage. Of course Sony has money to hire top notch Security Engineers to protect their interests and I'm sure they do but like anyone else they can be beat.

This is all not even accounting for the security black hole that is user idiocy, or the fact that the article makes several references to potential inside help.

In short Sony's past exploits don't give them a ton of credit but it's also a bit ridiculous to go from they could have done better to where this whole thread went.

probably_wrong• 12 years ago

The film industry regards Sony Pictures as the major studio that still takes risks on edgy comedies and dramas. They are known to respect directors more than the other majors.

I'm not in touch with the film industry, so could you link me to a discussion about this somewhere? I find the idea of Sony taking risks hard to reconcile with the mess that was "The Amazing Spider-Man 2", but as I only know the comic book fan side of things I could use some extra background.

jarcane• 12 years ago

Thing about that is, the movie business is all about risk deference sometimes: making a dumb obvious move now, so you can afford to take the bigger risk later.

And remember too that while the sequels of both SM film series have been largely crap, the originals were big risks in some respect. The first Spider-Man gave a massive budget to a director largely known only for low-budget shlock, and the ASM reboot meant deciding only a few scant years after the last one to completely dump and start over a franchise that was circling the drain.

rbanffy3• 12 years ago

I think fraction of their executive bonuses would be quite enough to fully fund a fairly decent security effort. If security were designed into their processes, it would probably cost much less.

If the 100 TB figure is correct, this has been going on for some time - it takes time to steal that much data in a way that does not raise a bunch of red flags. If the red flags weren't there to be raised or they were and were ignored, well... at least their executives got their bonuses.

Also, in the interest of fairness, while this malware attack seemed to be directed to Windows machines, a dedicated enough intruder would have developed attack strategies for any platform.

droopybuns• 12 years ago

Let's talk numbers.

A "fraction" of a bonus. Let's assume their bonus is a paltry 100k. A good infosec pro expects on average to be making at least 200k, so you have already blown out your budget. You can take a swing at hiring a consultant, but that gets you 5 weeks at around 70k, so you are eating a huge chunk of your fractional bonus budget.

Consultants don't really work for systemic problems like this though. Sony has cancer. They need empowered specialists to come in and tear out and then replace. These are both technical and managerial problems that exceed the capabilities of your average defcon attendee.

I disagree with both the approach you have taken here in envoking executive pay envy, as well as the substance. Security is hard. Practicing good security is expensive. You don't get to throw a couple of hundred grand around once and call it good. It is an ongoing and expensive investment.

jason46• 12 years ago

100TB? Seems more likely nobody noticed a team carrying out some thirty-five 3TB external drives. If their network was able to maintain operations while somebody sucked out 100TB of data through their gateway, I'm impressed.

eof• 12 years ago

Many people suggest that startups not over-optimize on issues like security and performance when it's not their core business. The same could be said of Sony:

How so? The whole point of saying it about startups is that they are startups.. they have severely limited capital and resources and need to optimize for growth/revenue/continuing to exist.

This does not apply to Sony. If you are storing medical records and SSNs and you are multi-billion dollar company; there is no viable excuse that looks anything like, "uhh.. yeah well we are really just an entertainment company."

eyeareque3• 12 years ago

I once asked a lock pick artist what lock I should get for my house. They pointed out that if you have something valuable in your house, do you want to protect it with a 50 dollar lock or a 250 dollar lock. Basically they should have had better security; and I can bet they will spend the money for proper security now that they got owned so well.

It's a great time to be working in the security field today.

rconti2• 12 years ago

That's an amazingly narrow-minded way of looking at a problem. It's easier and quicker to break your window than to pick your lock, $50 or $250.

thesteamboat• 12 years ago

do you want to protect it with a 50 dollar lock or a 250 dollar lock

It's not obvious to me that the $250 lock actually performs better in any relevant way. You might trust the guy, but when I'm hearing an anecdote second-hand I want to hear something more convincing than "trust the price".

Which is very much the problem -- it's quite hard for security non-experts to distinguish between good security and security theatre.

lgas• 12 years ago

No one suggests that startups not over-optimize on security or performance because these are not their core business. They suggest that they don't optimize for them because they have extremely limited resources compared to big corporations like Sony.

It doesn't matter how much time a startup spends on security and performance if they never find product-market fit and get to the explosive growth phase. Once they do however, this is when they need to raise real money and start addressing these "non-core" issues as well.

Sony is not a startup, is not resource constrained, etc. There's absolutely no reason to empathize with them.

digitalzombie• 12 years ago

I mean with all their experience from CD root kit. You think they know how to prevent hackers.

venomsnake• 12 years ago

I love the fact that salaries have gone public. That should lead to some very amusing inter company drama.

secfirstmd• 12 years ago

Even though I am a massive supporter and advocate of whistle-blowing and leaking (in the public interest), the state of a lot of the journalism around this is appalling - esp the Gawker article. (Though the Wired one is pretty responsible in fairness.)

Unless Sony has shown to be doing something malicious (which I don't think it has - other than some horrific Adam Sandler movies recently), then the angle of mining the data just to create click-bait headlines is particularly infuriating.

Yes, it is right to report such a large cyber intrusion in the public interest, especially if people's data has been taken (and Sony already had this problem occur before - so it is worth pointing out that they had a chance to tighten up security) but trawling through the internal data of an innocent private company and exposing it online, just to gossip, is particularly poor journalism. Having worked with a lot of media, you can be sure they rightly wouldn't be too happy if people did that to them - just for kicks.

serve_yay• 12 years ago

During/after the recent leak of celebrities' private photos, the condemnation was swift and serious. People can see how that directly applies to their own life, they wouldn't want their photos out there like that.

But when it's a company -- it's apparently OK to just look through all their shit. It's already publicly available anyway, so what's the big deal?

jfmercer• 12 years ago

I am not a sysadmin or network security guy, so I have to ask: how could hackers siphon as much as 100 terabytes of data from Sony's network without being noticed? Shouldn't they have indictors to see their bandwidth was running dry? If so, did the GOP do it slowly to avoid drawing attention?

spacemanmatt• 12 years ago

For a network the size of Sony's, it seems like that volume should be relatively easy to smuggle out. Maybe not all at once, right?

gizzlon2• 12 years ago

If my math is right, it would take ~120 days at 10 MB / second.

gizzlon2• 12 years ago

Although it's possible to monitor bandwidth use pretty closely, none of the companies I've worked for ever did that unless we where having problems.

All the "hackers" have to do is copy the date in a matter that does not cause obvious problems. For example, as you said, do it slowly, or do it at night when "nobody's" using the network anyway.

JonnieCache• 12 years ago

As a movie studio I imagine their infrastructure is used to moving obscenely large archives around as a matter of course.

shthed• 12 years ago

Served from Sony's EC2 instances: http://www.theregister.co.uk/2014/12/03/strange_things_afoot...

dbcooper• 12 years ago

Re/code is claiming that Sony will officially name North Korea as the source of the attack:

http://recode.net/2014/12/03/sony-to-officially-name-north-k...

Sony Pictures will officially name North Korea as the source of a hacking attack that has exposed sensitive files and brought down its corporate network last week, two sources close to the investigation tell Re/code. An announcement could come as soon as today.

Details of what Sony and the security firm Mandiant will announce are still being finalized. But the sources confirm that North Korea will be named as the source of the attack.

A Sony spokeswoman declined to comment on the timing or the news, but said “The investigation continues into this very sophisticated cyber attack.”

rconti2• 12 years ago

"Harming the regional peace and security and violating human rights for money". Interesting. The focus on this film and these supposed ideals make it sound very regional. I'm not saying it's North Korea, but it's someone in the region. Assuming the "purported hacker" actually had something to do with it.

johngd2• 12 years ago

Anecdotally, I knew some guys who worked at (or with?) the global security division at Sony US HQ.

The story went that each of the Sony subsidiaries[1] had their own security division that was largely autonomous for reasons of politics and budget, of course. Each part of the company had different vendors, different policies and procedures, and different philosophies on how security should be implemented.

When they would all send their representatives to have a global security pow wow, however often it happened, it ended up like an episode of game of thrones.

[1] http://en.wikipedia.org/wiki/Sony_Corporation_shareholders_a...

drivingmenuts• 12 years ago

The story went that each of the Sony subsidiaries[1] had their own security division that was largely autonomous for reasons of politics and budget, of course. Each part of the company had different vendors, different policies and procedures, and different philosophies on how security should be implemented.

And they could centralize all of that and ... it still wouldn't solve the problem. You'd have a single point of failure that might still leave them with their pants down at the end of the day.

Some days, you just can't win. You can have the smartest people (they probably didn't), the best hardware and software (ditto) and you're still gonna get punched in the junk.

johngd2• 12 years ago

Absolutely. I think it is a very difficult problem to solve as companies grow larger and larger and rise to behemoth proportions all while trying to tackle something that is relatively new (the security concerns of today, as opposed to say the 80's,90's,2000's when Sony didn't have to be as competitive in the products that they offered) and typically expensive (for a company Sony's size) where funding for these things seem to be viewed in terms of $ now, instead of potential $ later.

mlrtime• 12 years ago

There are some comments over at reddit suggesting this is a huge deal internally. There are teams that are just not showing up for work because all the systems are down.

Zigurd• 12 years ago

Security means security against the state actor threat. We got a foretaste of it because North Korea's head of state has strange priorities, but there's no reason a hack like this wouldn't be launched in a trade conflict, for example.

We created a security environment that prioritizes surveillance over security, especially in creating a market for zero-day exploits. That's a market that might exist without the US as a buyer, but the size and value of that market is dominated by US spending.

We would not tolerate the development and auctioning of weaponized disease microbes. But we funded a similar market that threatens our technology infrastructure.

lurkylurk• 12 years ago

with a hack as big as this why hasn't it affected their stock price?

post_break• 12 years ago

My friend got doxxed from this. SSN, passport, hiring agreements, everything. This hack basically dumped every single document Sony had out on the web.

talmand• 12 years ago

"a line-up of mostly white male executives"

What's the point in such a statement?

forgottenpass• 12 years ago

What's the point in such a statement?

In-group signalling.

eyeareque3• 12 years ago

With security you either pay for it now, or you pay for it later. These companies who make lots of bad mistakes seem to have opted for the latter.

dasil0033• 12 years ago

Or you never pay for it and no one ever hears about it and everyone is sleeping like babies. Or you pay for it now and later, because you know, security is hard and crackers have the upper hand. The possibilities are endless and nuanced!

Animats• 12 years ago

Are their backups OK? That's the only real issue.

None of the "leaked" data is that interesting. Some executive pay info is in SEC filings. Talent pay is usually known in Hollywood. Leaking the script of Annie? That's a remake; we know how it comes out.

The real question is, what did the attackers change? Did they add some phony businesses to accounts payable, or initiate financial transactions?

There's a lot to be said for making backups to write-once media.

debuggerpk• 12 years ago

http://www.theverge.com/2014/12/4/7333263/the-malware-that-t...

in the article it says "and the computer that did the compiling was set up to display its text in Korean characters."

i have a problem digesting this, because as per my experience, the compiler doesn't leave a trace the native host's display language or does it?

what do you people have to say about it?

kevin_thibedeau2• 12 years ago

There was a resource file included with Korean language strings. That either got there because the developers were Korean or as a false flag since malware doesn't otherwise need multilingual support.

DAddYE2• 12 years ago

Opening an article these days with:

Who knew that Sony’s top brass, a line-up of mostly white male executives, earn $1 million and more a year?

is just take advantage of a difficult moment and increase the `hate`.

I don't get why this could happen on magazine like Wired...

Reading comments on the article seems that statement is pretty unfair.

I didn't check myself because I think reading those informations is bad as the hack itself, however the author who did that can also feel free to judge others.

rsingel• 12 years ago

Oh, no! Pointing out that a corporate power structure is overwhelming white and male is so unfair to those that are white and male.

I used to be this author's editor and that lede is very Wired.

Sad to see this "tone policing" comment is the top-voted comment on this thread.

lkbm2• 12 years ago

I definitely think that it's useful to point out the over-representation of white and male voices in powerful positions (which seems particularly relevant in big media corporations, since it's such a cultural driver), but in this case it's kind of stuck in there without any follow-up or relevant thesis.

But, yeah, it's definitely silly that the top comment is just complaining about that sentence.

vacri2• 12 years ago

To be frank, it's a stupid lede anyway. It's not like people would be surprised that the CxOs for an entrenched, major company like Sony would be highly-paid and white males. It's basically the default assumption for that demographic.

DAddYE2• 12 years ago

I think for "you" is just an easy ride on the wave of the recents news.

Sad to see how easy is for "media" to jump from a trend to another even out of context.

Sad to see once again "you" pointing to "me" while "you/crew" had fun reading gender, ssn numbers, stipends and felt free to report your vision.

ManFromUranus• 12 years ago

This is the sort of trite, self congratulatory "socially conscious" type of comment that is appearing all over the place. What does it have to do with Sony getting hacked? Nothing really. It does reveal the personal sentiments of the author somewhat, and also your own. Did the comment help anybody? I doubt it. Other than stoking resentment what possible purpose could stating that the executives were "overwhelmingly white males" possibly have?

buckbova2• 12 years ago

It's the typical diatribe from this demographic that wants to add this to every conversation whether it's relevant or not.

hackuser2• 12 years ago

It's the typical diatribe from this demographic that wants to add this to every conversation whether it's relevant or not.

One difficulty is that people who are not affected by it do not notice it and they don't think it's a big deal. It doesn't register that the star of almost every movie is a white male.

It's human nature to be lost in our own perspectives; it's why it's so important to make an effort to imagine walking around in other people's shoes: If you are a minority or a woman, you are faced with this discrimination everywhere. Every time you turn on the TV, walk down the street, at work, in social situations, dating, at the restaurant; when you read a history book, in the news (e.g., recent police discrimination issues), when you look at our government, when the camera at the football game picks out the young hot white women in the crowd, etc.

If bringing it up all the time makes you uncomfortable, maybe that's a good thing. If it seems like the issue comes up a lot, maybe that speaks to the enormity of the problem.

saraid216• 12 years ago

Does anyone else miss the days when "white" wasn't a race?

dragonwriter2• 12 years ago

"White" has been used as a common term for a race longer than anyone living has been alive, so, no, I don't think anyone alive could miss the days when "white" wasn't a race.

People can, I suppose, miss the days when "white", as a term for a race, had almost exclusivey positive connotations when used by anyone with any influence in society and pine for the days when white privilege was so strong as to be virtually unquestioned, but you shouldn't mistake missing that for missing "white" not being a race.

runamok• 12 years ago

Especially since Conde Nast (Wired's parent) is owned by this family: http://en.wikipedia.org/wiki/Samuel_Irving_Newhouse,_Jr. http://en.wikipedia.org/wiki/Donald_Newhouse

bigtunacan• 12 years ago

I'm surprised that after the scandal of the 2011 Playstation Network hack that security isn't a big priority.

Sony Got Hacked Hard: What We Know and Don't Know So Far

Related Stories