After Hack, Sony Computer Systems Still Dark

Sony is no stranger to breaches. Sony's PlayStation Network was hacked in 2011 and attackers obtained 77 million user accounts. The latest attack comes against Sony Pictures Entertainment.

Sony Pictures' computer systems went down on Monday and remained down on Tuesday in the wake of reported hack attacks. Before the shut down, a message on Sony's internal computer screens read 'Hacked By #GOP,' according to the Los Angeles Times. The Times reported the acronym stands for 'Guardians of Peace.'

The message also offered a list of threats, and told Sony it had 'secrets.' The message said, 'We've already warned you, and this is just a beginning. We continue till our request be met . . . If you don't obey us, we'll release data shown below to the world.'

A Clear Warning

We reached Eric Cowperthwaite, vice president of advanced security and strategy at computer and network security company Core Security, to get his thoughts on the breach. He told us it's ugly, to say the least.

'A very public ransom attack is fairly unusual,' he said. 'Sony has had more time and incentive than your average company to improve its security.'

After past security events at Sony, Cowperthwaite assumed all Sony divisions had greatly improved security. If that is the case, then whoever is responsible for this attack is fairly capable themselves, he said.

'As always, I would view this as a warning that everyone else needs to pay attention,' Cowperthwaite said. 'If they don't have better security than Sony Pictures -- which I would wager is likely -- then they need to invest time and effort in improving their security capability and maturity.'

How Did it Happen?

Kevin O'Brien, vice president of Conjur, a DevOps security and authorization platform, told us Sony was victim to one of the most significant access and authorization breaches in recent memory with PlayStation.

While the details are still being discussed and will come to light over the coming days and weeks, currently facts suggest that a single point of failure -- a lone system that was breached -- is to blame, he said.

'Taken broadly, this replicates the same pattern of breach that we've seen across 2013 and 2014: weak access control results in systemic failure,' O'Brien said, adding that he wouldn't be surprised to learn that there was an internal threat vector in the mix. Sony could not immediately be reached for comment.

'Organizations like Sony will, hopefully, have a robust audit trail at their disposal that sits external to the systems that are compromised here. What tends to happen is that the attackers will work to erase their tracks,' O'Brien said. 'From this perspective, the other question is whether these forensic components are exposed as part of the same threat surface that led to the original breach.'