Things aren’t getting any better for Sony and its networks (still down): the government is looking into the huge hack of where 100 million Sony user accounts have been (potentially) compromised. According to Security Expert Dr. Gene Spafford, Sony employees have reported that there was no firewall installed on Sony’s servers, and that the version of Apache (the web server) that Sony was using was updated security-wise. That’s pretty bad, because when people use outdated software, it makes it even easier for hackers to break into their systems.
Typically, the community finds and fixes security vulnerabilities. However, those vulnerabilities are also very well documented. It means that hackers don’t even have to work very hard to find them in the first place. They can simply look at the fix, create an exploit, and search for outdated sites that have not been secured yet.
Until recently, I gave Sony the benefit of the doubt because being hacked can happen to virtually every company, and high-profile companies like Sony are high-value targets. However, if this is true, it’s hard to say that Sony didn’t screw up. Upgrading servers for security updates is pretty much mandatory, and not running a firewall… what ?!
Sony has declined to comment at the moment, and has said that it is working hard to plug the holes and monitor data security. A site of that size has to be really hard to monitor, and being “reactive” will certainly not pay as much as being “defensive”. Let’s hope that users get back online soon and that Sony has learned its lesson.
Links: The Threat of Data Theft to American Consumers (http://energycommerce.house.gov)
Filed in . Read more about Hacking, Playstation Network, Psn, Security, Sony and Sony Psn.