Sony is taking hit after hit. They have been hacked by still unknown individuals, their SSL Certificates have been used by the Destover malware and personal information from thousands of Sony users have been leaked and are being viewed by thousands of internet users each day.
In 2011, Sony was attacked by various actors. The Anonymous collective had initiated an DDoS attack and there were claims that an still unidentified user had logged into the Sony Playstation network. The unidentified user gained access to names, birthdays, email addresses, passwords, security questions and maybe credit card details of all Playstation Network users.
There are claims which state that the hacker in 2011 gained access via the Rebug framework in the Playstation 3 console. The Rebug framework allows developers to gain access to the internal trusted network of the Sony Playstation environment.
Kaspersky Lab released a report on the Destover malware sample which used Sony certificates. Kaspersky Lab claims that it holds two samples of stolen Sony SSL certificates.
The first sample has been compiled in July 2014 and it holds the following MD5 value:
- 6467c6df4ba4526c7f7a7bc950bd47eb
The second sample has been signed on the 5th of December in 2014 and it holds the following MD5 value:
- e904bf93403c0fb08b9683a9e858c73e
The stolen certificate serial number:
- 01 e2 b4 f7 59 81 1c 64 37 9f ca 0b e7 6d 2d ce
The thumbprint:
- 8d f4 6b 5f da c2 eb 3b 47 57 f9 98 66 c1 99 ff 2b 13 42 7a
Resources at the csoonline.com website state the following about the response which Sony has taken:
It’s been more than two weeks now since Sony’s security nightmare was made public knowledge. Certificate revocation should have been one of the first things to happen, especially on certificates related to projects and business critical applications.
Yet, the certificate used to sign the variant of Destover was part of an employee’s project requirements. If that certificate was valid a week after the breach became known, it’s a safe bet the others were too.
Source
But let’s not forget about the claims which stated that North Korea might be behind the hack on Sony. The claims stated that the North Korean government had been motivated to hack the Sony company in retaliation for the comedy film “The Interview”.
The Interview movie is a comedy film about a plot to assassinate the leader Kim Jong-Un. The N-Korean government declined any responsibility for the hack on Sony.