May 14, 2020

Sony hack shows that the company kept passwords stored in a folder called “Password”

SONY PICTURES LOGO(LiveHacking.Com) – Sony Pictures Entertainment has been hacked and it has been hacked hard. Over 40GB of data has been released on the Internet. The trove of data includes scripts and documents about salaries and film budgets. It is being described as “probably the worst corporate hack in history.” A group called Guardians of Peace, which may be affiliated with North Korea, has claimed responsibility for the cyber attack. It is thought that North Korea is upset at Sony Pictures’ new movie The Interview, which satirizes the country’s dictator Kim Jong Un.

As experts and journalists are continuing to pour over the data, one bizarre item has been found. According to Buzzfeed, the latest data dump included a folder called “Password.” In it there were 139 Word documents, Excel spreadsheets, zip files, and PDFs containing thousands of login credentials for Sony Pictures’ internal computers, social media accounts, and web services accounts. The files used very convenient naming conventions like “password list.xls” or “YouTube login passwords.xlsx.”

Among the passwords were details of SPE’s social media accounts including Facebook, YouTube, and Twitter. One thing is for sure, SPE is going to need to change a lot of passwords, and it needs to do it fast! There are also documents which contain passwords for a variety of other services including Amazon, FedEx, Lexis/Nexis, and Bloomberg.

The situation could get worse for Sony over the next few days. The hackers have indicated that this latest dump is only the start of a series of planned data dumps to the Internet. The hackers claim to have taken over 100TB of data from SPE, of which we have only seen a fraction so far.

The seriously troubling thing about this latest hack is that it isn’t the first time that Sony has been targeted. Sony Pictures Entertainment websites were breached in 2011 by a group known as LulzSec. As a result of the breach LulzSec published the names, birth dates, addresses, emails, phone numbers and passwords of thousands of people who had entered contests promoted by Sony. That breach occurred only a few weeks after Sony confirmed a breach to its PlayStation Network that exposed millions of personal user records. Then last, but not least, in 2012 hackers claimed to have accessed Sony’s servers and downloaded Michael Jackson’s entire back catalog, worth some $253 million.

Email addresses stolen from CurrentC

currentc-logo(LiveHacking.Com) – CurrentC has notified its users about a security breach which enabled hackers to steal the email addresses of some of its pilot program participants. According to a statement released by the company, “many of these email addresses are dummy accounts used for testing purposes only.” It went on to say that, “the CurrentC app itself was not affected.”

CurrentC is a mobile wallet rival to Apple’s new mobile payment system. It is a free downloadable app that lets customers securely save, earn participating merchant loyalty rewards and pay across a growing network of merchants which includes Target, Walmart, Old Navy, Shell, and Best Buy.

The Merchant Customer Exchange (MCX), the alliance of retailers behind CurrentC, said it had notified its merchant partners about the incident and directly communicated with each of the individuals whose email addresses were involved. It then went on to offer the normal platitudes, “we take the security of our users’ information extremely seriously. MCX is continuing to investigate this situation and will provide updates as necessary.”

The problem is that such a incident can severely damage the reputation of a company which is supposed to be offering a secure payment system. The thinking of many consumers will be, “if CurrentC can’t look after my email address, how can I trust it with my bank details!”

According to iTnews, some experts are trying to play down the incident. “The service was hacked and emails were lost. That distinction is important as a breach contains access to financial data and this hack contains mostly just personal information,” Chris Morales, practice manager of architecture and infrastructure at NSS Labs, said in a statement.

Time will tell if consumers agree with Morales or not.

Researchers reckon that there could be as many as three major security breaches per month

Processed by: Helicon Filter;As part of the B-Sides San Francisco security conference, Verizon Risk researchers Kevin Thompson and Suzanne Widup have presented findings about the number of major data breaches that could be occurring each month. By “major” the two researchers mean any security breach where more than 1,000,000 records are stolen. If their findings are accurate that means that up to 3 million records are stolen each and every month!

The findings were presented as part of the pair’s “Ripped from the headlines, what the news tells us about information security incidents” talk.  As part of their research Thompson and Widup have been investigating the data breach numbers since May of last year. Using a combination of  Verizon’s Data Breach Investigations Report and the open-source Veris Community Database the pair compiled over 3,000 data sets from sources including news articles, the Attorney General’s website, government breach tools and Freedom of Information Act requests.

Although the data set isn’t perfect and the research is continuing, one thing is clear, the number of major data breaches is much higher than previously thought. The number of three major data breaches per month was reached using data from 2011 to 2013 coupled with Poisson Distribution theory – a mathematical tool which expresses the probability of a given number of events occurring in a fixed interval of time.

At the end of last year Trend Micro predicted that “we will see one major data breach incident each month in 2014.” However the new number is triple that amount. “When I saw Trend Micro’s prediction I thought it was pretty high,” said Thompson. “But the estimate is actually pretty low right now.”

Thompson told that the actual figure was 3.07 and that 2010 was not included as data breaches were not as widely reported at the time. Verizon’s data is available on Github and the researchers are actively seeking for data to help with the research.

Philips Electronics Website Hacked, 200,000 Records Stolen

(LiveHacking.Com) – One of the largest electronics companies in the world, Philips Electronics, has been hacked. According to The Hacker News, the hackers defaced a Philips subdomain and left their names “bch195” and “HaxOr” claiming to be members of Team INTRA.

The hackers posted information on the security breach on pastebin which itself contained links to the site These links are samples of the personal information the hackers have stolen including names, email addresses, occupation, date of birth, phone number and postal address.

Also the hackers commented that “This is first 100 emails from 200k list.I don’t want to share more because i will sell it.”

According to V3 , Philips is aware of the incident and has taken action to minimise its impact. Philips is following its standard security incident response procedure and is collaborating with law enforcement.

“Within an hour Philips became aware of the event, the compromised server was shut down. We are assessing the nature and extent of information that may have been accessed and a full investigation is in place,” they said.

This attack is another in a long list of very public security breaches and if the hackers have been able to steal over 200,000 records with personal details including postal addresses and phone numbers it potentially means the hackers could have gained further access to other Philips servers.

It is interesting to note that the hackers defaced a subdomain and not the main site. Hackers like to target smaller websites (even within a larger corporation) as these are often less well protected. This is what happened to Sony Pictures in 2011 when hackers breached an old competition website.