Sony BMG Greece site hacked
Another Sony attack, this time on the company's record label web site in Greece
By Joan Goodchild, Senior Editor
May 23, 2011 — CSO —
In what is proving to be a tough run of bad news for Sony, the Greek web site for its Sony BMG record label has been hacked. An upload of sample extracts from a database of SonyMusic.gr. users' names and email addresses were posted onto pastebin.com by Hackers News Network. The information, with parts omitted in the post, was obtained in the hack, the site claims.
Sophos Senior Security Advisor Chester Wisniewski detailed the latest hack in the Sophos Naked Security blog, noting this most recent incident appears to be a case of hackers kicking someone when they are down. Sony has been plagued with bad press since it was first revealed in April that Sony's Playstation Network was breached and the personal data of millions of users was compromised.
{Also see: The lesson Sony didn't learn five years ago}
Wisniewski said it appears someone used an automated SQL injection tool to find the flaw in the Greek site attack.
"It's not something that requires a particularly skillful attacker, but simply the diligence to comb through Sony website after website until a security flaw is found," said Wisniewski. "If you are a user of SonyMusic.gr, it is highly recommended that you reset your password. Expect that any information you entered when creating your account may be in the hands of someone with malicious intent, and keep a close eye out for phishing attacks."
Read more about data protection in CSOonline's Data Protection section.
Other stories by Joan Goodchild
The challenge of true data protection spans databases, internal and external networks, physical and offsite storage, business partners and more. These resources offer expert perspective from the basics through specific key elements of data protection strategies.
Network security basics
Protection, detection, and reaction—those are the three underlying principles your security program must embody
Computer incident detection, response, forensics
Richard Bejtlich shows how to measure and improve the maturity of your incident response
A few good IT security metrics
Stop counting blocked malware attachments and measure things that can contribute to meaningful change
5 key cloud security trends
Cloud security is evolving rapidly—stay on top of it
IT risk assessment frameworks
How to do end-to-end encryption
How to compare and use enterprise antivirus
Also find sample data protection policies in CSO's tools, templates and policies library
- The CISO's Survival Guide to Securing Data
- Data Privacy and Protection in Production Environments: New Research from Ponemon Institute
- FireEye Advanced Threat Protection KnowledgeVault
- Five Tips to Consider in a Data Security Strategy for Smartphones and Tablets
- Moving Your Email to the Trusted Cloud
- New PCI Tokenization Guidelines with QSA Expert
- #FFSec: Security pros to follow on Twitter, May 25
Follow these names on Twitter. Together, they make cyberspace a more secure place. (copy and paste) - Step right up and listen to the security barker
- Is the title 'security evangelist' really that bad?
More Salted Hash with Bill Brenner
