Saving data, especially e-mail and informal chats, is a liability.
It’s also a security risk: the risk of exposure. The exposure could be accidental. It could be the result of data theft, as happened to Sony. Or it could be the result of litigation. Whatever the reason, the best security against these eventualities is not to have the data in the first place.
via The importance of deleting old stuff—another lesson from the Sony attack | Ars Technica.
Norse’s senior vice president of market development said that just the quickness of the FBI’s conclusion that North Korea was responsible was a red flag.
“When the FBI made the announcement so soon after the initial hack was unveiled, everyone in the [cyber] intelligence community kind of raised their eyebrows at it, because it’s really hard to pin this on anyone within days of the attack,” Kurt Stammberger said in an interview as his company briefed FBI investigators Monday afternoon.
via U.S.: No alternate leads in Sony hack – Tal Kopan – POLITICO.
From: The FBI’s North Korea evidence is nonsense
The reason it’s nonsense is that the hacker underground shares code. They share everything: tools, techniques, exploits, owned-systems, botnets, and infrastructure. Different groups even share members. It is implausible that North Korea would develop it’s own malware from scratch.
Above article dated 12/19/2014. It appears the FBI may be doubling down on their theories to save face. Their conclusions got POTUS to make a speech about this and if it turns out it was all nonsense that makes him look bad too.
As a fan of author Tom Clancy’s early works I found this quote funny. From: Researcher: Sony Hack Was Likely an Inside Job by a Woman Named “Lena”
This sounds much more plausible to me than a crack North Korean cyber-commando squad, or whichever Tom Clancy wet dream has been floating between the White House and the New York Times.
Researchers from the security firm Norse allege that their investigation of the hack of Sony has uncovered evidence that leads, decisively, away from North Korea as the source of the attack. Instead, the company alleges that a group of six individuals is behind the hack, at least one a former Sony Pictures Entertainment employee who worked in a technical role and had extensive knowledge of the company’s network and operations.
via A New Script: Clues In Sony Hack Point To Insiders | The Security Ledger.
Attribution Is Difficult If Not Impossible
First off, we have to say that attribution in breaches is difficult. Assertions about who is behind any attack should be treated with a hefty dose of skepticism. Skilled hackers use proxy machines and false IP addresses to cover their tracks or plant false clues inside their malware to throw investigators off their trail. When hackers are identified and apprehended, it’s generally because they’ve made mistakes or because a cohort got arrested and turned informant.
Nation-state attacks often can be distinguished by their level of sophistication and modus operandi, but attribution is no less difficult. It’s easy for attackers to plant false flags that point to North Korea or another nation as the culprit.
via The Evidence That North Korea Hacked Sony Is Flimsy | WIRED.
A list of previous Sony Hacks here.
“It’s really a phenomenally awesome hack—they completely owned this company,” Schneier, who is regularly consulted by the federal government on security issues, said. “But, I think this is just a regular hack. All the talk, it’s hyperbole and a joke. They’re [threatening violence] because it’s fun for them—why the hell not? They’re doing it because they actually hit Sony, because they’re acting like they’re 12, they’re doing it for the lulz, no one knows why.”
via Bruce Schneier: Sony Hackers ‘Completely Owned This Company’ | Motherboard.
Unless you know how infiltrators got into Sony’s system there is no way figuring out the who behind the hack. So far details of this has been lacking and as far as potential culprits targeting Sony, North Korea is probably least capable from an education standpoint and logistics. Social engineering, getting people inside Sony to cooperate is usually behind successful infiltrations. Sony’s Playstation network was taken down awhile ago. I suspect whoever did that probably is behind this despite what movie is about to be released soon.
What we see is a hardware architecture that’s both simple and powerful. With longtime game designer Mark Cerny leading the way, lending his software-minded expertise to Ootori and the rest of the hardware engineering team, Sony abandoned the overly complex Cell microprocessor that drove the PlayStation 3, building the PS4 around an “x86″ chip similar to the processors that have driven most of our personal computers for the last three decades. The idea was to make it that much easier for developers to build games for the new console, to create the things that will ultimately capture our attention.
via See What’s Inside the PlayStation 4 With These Exclusive Photos | Game|Life | Wired.com.
The operating system at the heart of Sony’s PlayStation 4 is FreeBSD 9.0.
via [Phoronix] Sony’s PlayStation 4 Is Running Modified FreeBSD 9.
This provision would effectively legalize spyware in Canada on behalf of these industry groups. The potential scope of coverage is breathtaking: a software program secretly installed by an entertainment software company designed to detect or investigate alleged copyright infringement would be covered by this exception.
Hopefully something like this never sees the light of day in the US and if it does, it helps raise awareness of copyright abuse. The Sony rootkit was a pretty nasty piece of malware that was rather difficult to remove properly. Bad things will happen to the unsuspecting and the more novice computer user should the ability of anyone to install spyware at the root level become legal. If I recall correctly, the Sony rootkit installed before the user accepted the End User License Agreement. Thus, even if you read the EULA and decided not to install or have anything to do with Sony, Sony already parked itself on your computer.
The release of the new custom firmware – and the LV0 decryption keys in particular – poses serious issues. While Sony will almost certainly change the PSN passphrase once again in the upcoming 4.30 update, the reveal of the LV0 key basically means that any system update released by Sony going forward can be decrypted with little or no effort whatsoever. Options Sony has in battling this leak are limited – every PS3 out there needs to be able to decrypt any firmware download package in order for the console to be updated (a 2006 launch PS3 can still update directly to the latest software). The release of the LV0 key allows for that to be achieved on PC, with the CoreOS and XMB files then re-encrypted using the existing 3.55 keys in order to be run on hacked consoles.
Sony Chemical & Information Device Corp. has demonstrated a thermal sheet that it claims matches thermal paste in terms of cooling ability while beating it on life span. The key to the sheet is a combination of silicon and carbon fibers, to produce a thermal conductive layer that’s between 0.3 and 2mm thick.