Sony Reels from Massive, Mysterious Cyber Breach


4 December 2014

Sony Reeling from massive mysterious hack

More than a week after it was hit in a major cyber-attack, Sony Pictures Entertainment was still working to restore its systems and complete its damage control, notes a Reuters article. While details are still unclear, it appears hackers managed to infiltrate Sony’s internal systems with malware. The hacking ring responsible, apparently called #GOP (Guardians of Peace) launched its assault on Nov. 24.

One unnamed source told Reuters that a rare virus wiped some Windows-based computers of their data — rendering the machines unusable. (This is allegedly the first time a wiping attack of this major scope has occurred against a U.S. corporation, states Reuters, citing security experts.) In response, Sony had to shut its own internal network down last week.

On Monday, the hackers released “tens of terabytes” of internal Sony data. These included links to archives purportedly containing Sony employees’ salaries, as well as passwords, and Social Security numbers, says The New York Times. The hackers also took over some Sony Twitter feeds, and published marketing plans.

In what appears to have been a related move, the hackers managed to release five Sony films on to the Internet. (The titles included the upcoming “Annie.”)

A New Cyber-threat Aimed at Information?

While Sony has been restarting its computer systems, it remained unclear just how widespread the penetration was. Also unknown are the identities and long term goals of the hackers. There have been many recent and successful cyber-attacks on large retailers — such as Target and Home Depot, to name just a couple of examples.

But those hacks were more understandable — they were generally targeted at payment card systems in the hopes of quickly reaping cash through fraud. But the Sony attack appears to be a part of a different type of breach — the perpetrators weren’t after easy money, but data. In this, it resembles the recent hacking of 100 dealmaking companies, in an apparent attempt to gain private M&A information.

And the attempt to publicly humiliate Sony adds another dimension to the penetration, says the Times. The hackers wanted to send a message to the public, for some reason. “This was like a home invasion where after taking the family jewels the hackers set the house ablaze,” said Tom Kellermann, head cybersecurity officer at Trend Micro.

Data and Files Vulnerable in Email

Perhaps for now, the best companies can do is to secure their systems, notes Mushegh Hakhinian, chief security architect at Intralinks. And of course, chief information officers and chief information security officers should, as always, apply best practices and monitor their networks.

It’s also a great time for a renewed attention overall to data protection policies and procedures. For instance, companies need to demonstrate strict control over all unencrypted copies of files containing sensitive data. Another too-often-overlooked best practice is to avoid using email attachments to send or store confidential information and content.

This applies even within the organization — as, typically, email seems to be the first place that thieves look for company information and assets. That’s because employees use email systems as an easy way to collaborate or store data.

“Putting files into email systems is the digital equivalent of stashing the cash under the mattress,” says Mushegh. “Email attachments apparently are now the new preferred attack vector. If files and data were all in highly secure repositories, and not exposed in email, it would make the cyber thief’s job that much harder.”

 



Marc Songini

Marc Songini

Marc Songini has worked in the information technology field for more than 16 years. His roles have included those of journalist, analyst, and marketing communications specialist. He admits that when he started out as a cub high tech reporter, Netscape was still rocking the industry with a wondrous new user interface called a “browser.” During his 10 years with International Data Group (IDG), Marc wrote for NetworkWorld and Computerworld, both award-winning magazines. Marc specializes in cloud, enterprise apps, and figuring out the meaning of being human in an automated world.