By Ben Kuchera | 

A new class-action lawsuit has been filed against Sony that claims the company has been negligent with online security, leading to multiple hostile attacks and the loss of customers’ private data. The suit claims that personal information—including credit card numbers and expiration dates—were taken from Sony’s servers, and cites a number of confidential witnesses who claimed Sony’s security was inadequate. Perhaps most damning is the claim that Sony laid off employees working in security before the attacks.

“Sony was more concerned about their development server being hacked rather than some consumer’s data being stolen,” according to a confidential witness quoted in the complaint. “They want to protect themselves and not the people that use their servers.”

While Sony has always stressed that the company has no reason to believe credit information was compromised, the complaint treats the theft of credit card data as fact. The suit claims that Sony “spent lavishly to secure its proprietary development server containing its own sensitive information,” while not providing nearly the same level of security for the information of its customers.

In fact, the suit alleges that Sony was trying to cut costs in this area. The following paragraph from the complaint explains the claim:

Just two weeks before the April breach, Sony laid off a substantial percentage of its Sony Online Entertainment workforce, including a number of employees in the Network Operations Center, which, according to Confidential Witness 2, is the group that is responsible for preparing for and responding to security breaches, and who ostensibly has the skills to bring the Network’s security technology up-to-date.

Another witness stated that PS3 systems are designed to be secured by a random number generator, but in practice each console has the same access number, making each system easier to hack. If you have one code, you have them all. The suit also quotes Sony deputy president Kazuo Hirai as saying that the company will now bring security practices “at least in line with industry standards or better,” leading to the conclusion from that prior to the hack security was in fact below industry standards.

Other pieces of evidence from the suit are weaker, such as the claim that Sony’s unwillingness to disclose the methods used to encrypt credit card data is evidence that the encryption is “either weak or easily broken.”

The suit asks for “appropriate” restitution for class members, credit-monitoring services, and “exemplary damages” if its found that Sony acted in a reckless or negligent manner.

By Mike Sharkey | Jun 24, 2011

Sony has repeatedly stated there was nothing more it could have done to prevent the April PlayStation Network cyber security breach that led to one of the largest thefts of consumer data in history. But according to a new class action lawsuit, nothing could be further from the truth.

As Reuters reports, on Monday a trio of men (Felix Cortorreal, Jacques Daoud Jr., and Jimmy Cortorreal) filed a lawsuit against Sony that alleges the company fired network security employees two weeks before the attack on PlayStation Network and “spent lavishly” on cyber security to protect corporate information while choosing not to use the same level of security for customer data.

Citing a confidential source, the lawsuit states that Sony knew it was at increased risk of cyber attack in the weeks building up to the April 19 breach because it was in the process of suing famed PlayStation 3 hacker George “Geohot” Hotz (a case the company later settled) and it had experienced a number of smaller security breaches leading up to the full scale PSN attack.

Still, Sony laid off “a substantial percentage” of employees in its Network Operations Center, the lawsuit claims, and it decided not to install the same firewalls and other security measures for customer data that it used to protect corporate data.

Sony has yet to respond to requests for comment on the case.

Sharkey says: I’m guessing that confidential source is one of the pink slipped Sony Network Operations Center employees. We’ve already heard security experts outside of Sony accuse the company of not doing enough to protect customer data, but if someone on the inside is coming forward, that’s a whole other can of worms. Amid a handful of other lawsuits against Sony over the PSN breach, this one officially becomes the one to watch.

Copyright: http://www.gamespy.com/articles/117/1178927p1.html

The simplest thing for LulzSec to do may be just to quietly split up – and for its members to deny forever that they ever belonged to the group. Photograph: Alexander Fediachov/Alamy

The trouble with hacking for glory – as LulzSec, aka Lulz Security are doing – is that you want everyone to know what you’ve done, but you don’t want anyone to know who you actually are. And the combination of human nature, where people want their due respect, and the internet, where every action leaves some sort of trace, means there will always be tensions between carrying out acts and denying that you carried them out.

The logs seen by the Guardian from within the group show how that can go astray. In one episode, they become worried after someone is discovered talking in a chatroom about some bounty given to him by “Kayla”, one of the LulzSec members. “Kayla will talk to him,” says Sabu, the leader of the group, with the clear indication that shutting him up is the aim.

There’s an irresistible echo with the scene in Martin Scorsese’s mafia film Goodfellas, when after a successful heist the gangsters are told off by their bosses for flaunting their sudden wealth with fur coats and cars. The bathetic contrast – the gangsters have just stolen a hoard of gold bullion; the hackers have some Amazon voucher codes – only goes to heighten the bubble that the hackers live in.

In many ways the hackers’ attitudes mirror those of street gangs, where the talk is of respect, attacks, who can be trusted, who the enemies are (usually law enforcement and rival gangs), whose ground belongs to who, and who has accomplished what. The consolation is that these are gangs whose weapons won’t lead to blood being spilt, and who aren’t worried about walking accidentally into the wrong postcode.

But hackers have similar problems: the twin threats from rival gangs and from law enforcement. The latter move more slowly, but are more dangerous; the former are quicker and can draw in the latter. LulzSec have prompted the ire of a powerful hacker, The Jester, an American ex-military operator who works alone. The Jester is only one of a number of rival hackers threatening to blow the lid off LulzSec. Others are angry too, calling LulzSec “suicide bombers of the internet” for their lack of any clear agenda; the attack on the Arizona police (on the grounds that LulzSec dislikes its proposed immigration laws) will not assuage that anger.

Earlier this week the Jester posted so-called “dox” – documentation purporting to reveal the real-life identity of each senior hacker – relating to Sabu and Topiary. Even if the dox were wide of the mark, LulzSec may feel that the net is tightening. And once their secret identities are out in the open, it’s game over.

The logs detail a group more willing to cripple its foes’ websites (especially 2600.com, a starting place for many hackers, and still regarded affectionately by some of the older ones) with distributed denial of service (DDoS) attacks than professional hacking exploits. Since its formation in May, the group has revelled in the playground warfare of taking down websites belonging to global corporations such as Sony Pictures and Fox.

However, that does not mean that the group is incapable of more devastating attacks. Some of its members – including Sabu and Kayla – have been linked to the huge assault on US security firm HB Gary Federal in February. Even on Friday, LulzSec claimed on its Twitter account that it is preparing a “major leak”, presumably of information stolen during one of its more daring hacking exploits. Quite how many more they will be able to carry out before hubris – or their pursuers – catch up is open to question. The simplest thing for LulzSec to do may be just to quietly split up – and for its members to deny forever that they ever belonged to the group. But denial too may be the hardest step to take besides silence.

Copyright: http://www.guardian.co.uk/technology/2011/jun/24/lulzsec-leak-beginning-end-hackers

• See more like this:
• hackers