Over 200 user accounts compromised in the hack

Japanese mobile Internet service provider subsidiary of Sony, So-net Entertainment, has reported incidents of security breaches in its systems.

So-net, which is about 58% owned by Sony and a Sony financial unit, said that hackers had accessed user accounts and used "So-net points" from 128 accounts, with which they obtained goods worth about $1,225. Another 73 accounts were also compromised, but the points were not redeemed. The hacker also accessed the e-mail accounts of 90 users.

The company said that it discovered the breach on Wednesday after customer complaints. It immediately blocked the Internet Protocol address behind the 10,000 attempts to break into the system.

The company has said that it is unlikely that the same hackers behind the Sony PSN attack were responsible for this one because the method of intrusion used was different.

So-net Entertainment spokesman Keisuke Watabe said, "Although we can't completely rule out the possibility that there is a connection with the PSN issue, the likelihood is low."

It was in last week that Sony restored its PSN network for users after shutting it down for over a month. Sony's PSN and some other networks were subject to a massive hack in April, which is believed to have compromised around 100 million users worldwide.

Bad times for Sony. .Bad times indeed!

“As long as it is popular within the hacker community to expose Sony’s flaws, we are likely to continue seeing successful attacks against them,” Wisneiwski says, though he adds, that while it’s cruel to kick someone down while they’re down, when this is all over “Sony may end up being one of the most secure web assets on the net.”

The TechHerald points out that Sony has suffered seven security incidents in two months, including an original mass DDoS (distributed denial of service) by Anonymous last month and the devastating breach that compromised the data of more than 100 million account holders of the PlayStation Network and Sony Online Entertainment.

Sony is also due to reveal its annual profits on Thursday and it could prove disappointing for investors. At the time of writing, the company was preparing to give a press conference in which it would announce a revision to its annual profits forecast, and according to the Financial Times, companies listed on the Tokyo Stock Exchange are required to inform investors if they believe they will miss earnings targets by 30% or more.

To think the passwords were saved in plain-texts. .SMH

http://pastebin.com/WqLysjiN


SCOREBOARD

Sony: 0 || Hackers: 7

Slyr0x:

The company said that it discovered the breach on Wednesday after customer complaints. It immediately blocked the Internet Protocol address behind the 10,000 attempts to break into the system.

10,000 attempts by a single IP on a server and the server's firewall was still in good terms with the IP

Abi make dem come buy Alpha plan for TruDigits? Cuz you sef slyr0x you know this ish can't happen there.

^^^hahaha bruv. .Na so. .But i doubt if there was a firewall in place. U seen 'em plain-text passwords too?

^^^ ya some may be actual passwords to their mailboxes.

Dual Core:

^^^ ya some may be actual passwords to their mailboxes.

the password of http://cp.nairaland.com/ is there.

Dual Core:

^^^ ya some may be actual passwords to their mailboxes.

Exactly. .From most of 'em dumps have seen, the success rate is like 4/5.

*dhtml:

the password of http://cp.nairaland.com/ is there.

Yeah am going through the cpanel atm.

Slyrox, you missed it, the nairaland atm is https://www.nairaland.com/robots.txt - muhahahaha

I still aint gettin yhu bro. .

BTW Is dis the old NL https://www.nairaland.com/img/ ??

Sly, analyze this:  http://loadimpact.com/page_analysis/nairaland.com-33133976db9d5d1d640be8fc28d1632d
and compare with facebook. Enter facebook into the searchbox and see the results.
Either the robots.txt is not properly configured or those engines are doing overtime. . .

Slyr0x:

I still aint gettin yhu bro. .

BTW Is dis the old NL https://www.nairaland.com/img/ ??

i was able to sheck my inbox, ope o!

It was badly configured bro

User-Agent:Googlebot-Image
Disallow: /img/Mendie

Look at what iQuoted above. .It actually says User-agent:Googlebot-Image DO NOT crawl/spider this directory. .BUT other user agents can.

Best config woulda been

User-agent: *

As can be seen from www.google.com/robots.txt

So i believe "http://loadimpact.com" aint using the user agent googlebot to crawl the site

Of course i know it was badly configured - that was why i used other agents to search out the folders and files, i just did not want it to be said that i hacked NL - i fink i have been accused of that before - when i . . . . . .

but this is a national security issue, e don pass my level.

The themes folder are visible, all them javascript, css and all sorts are visible. . . . .

Erm, maybe you should tell mr seun how to properly configure it, so that he will not leave his a** uncovered to h*ckers. . .

*dhtml:


The themes folder are visible, all them javascript, css and all sorts are visible. . . . .

Rily? Link?

Not the themes folder per say, i meant - the files and structures,
see http://loadimpact.com/page_analysis/nairaland.com-33133976db9d5d1d640be8fc28d1632d

you can see stuffs like https://www.nairaland.com/Themes/default/images/english/who.gif

Oh. .*laffs*

Its not a vuln bro. .Normally when ure fetching pages from the net, all the components of that webpage needs to be fetched from their various directories.

Look at one of d css fbk uses http://static.ak.fbcdn.net/rsrc.php/v1/yi/r/yhDVD47DP1O.css

Can you see the structure is actually showing?

Its like yo background image, its been called from

http://.net/templates/dhtmlex/images/background.jpg .This in itself aint a vuln buh the vuln would've been if iHad

http://.net/templates/dhtmlex/images/ and it actually lists yo whole folder. .

Nope, on the contrary slyr0x, it is a form of vulnerability - but sorry, once again, i cannot discuss this on a public board.
If you can hook up to chat with me some other time, i can explain it better to you.

I am not a hacker - not even an amateur one for that matter - but from my vast programming experience, i have learnt
a thing or two - that are not common public knowledge.

My site and nairaland are two different worlds entirely, on a high-traffick site, some things are not to be taken lightly.

Bad image for Sony. They need to overhaul their security systems.

denzel2009:

Bad image for Sony. They need to overhaul their security systems.

Them should flog then sack all them programmers

*dhtml:

Them should flog then sack all them programmers

Do you think heads wouldn't have rolled?

denzel2009:

Do you think heads wouldn't have rolled?

of course that is inevitable. . .

Most recent News: PlayStation Network Hack Will Cost Sony $170M .

Sony expects the hack of the PlayStation Network and will cost it ¥14 billion (US$170 million) this financial year, it said Monday.

Unknown hackers hit the network gaming service for PlayStation 3 consoles in April, penetrating the system and stealing personal information from the roughly 77 million accounts on the PlayStation Network and sister Qriocity service. A second attack was directed at the Sony Online Entertainment network used for PC gaming.

Sony responded to the attacks by taking the systems offline. It called in several computer security companies to conduct forensic audits and rebuilt its security system.