Sony Finds "Anonymous" Document Uploaded to Servers

by Chris Arnone, posted on 04 May 2011 / 3,888 Views

While Sony isn't showing up for the United States Congressional Hearings regarding their recent security breach, they have decided to answer all of the questions asked of them by the hearing committee.

Kaz Hirai himself answered all of the questions posed to Sony in a letter which Sony has made available here

One very interesting piece of information revealed is the discovery of a file titled, "Anonymous" with the text "We are Legion" in it. While some might think this points the finger at the hacking group Anonymous, that isn't necessarily true and Sony doesn't point a finger, either, they simply state this file was found. Anonymous has already released a statement condemning the attacks, though they also admit it could have been perpetrated by rogue members of their group. Since hackers usually like to brag about their accomplishments, the far more likely scenario is the actual hackers inserted the document to cash in on the already prevalent attacks that WERE made by Anonymous shortly before the network outage.

I've also heard the arguement that a Sony employee may have planted this document. First off, this accusation is unfounded. Secondly, there is no benefit to Sony in doing this. We know somebody hacked the network, who did it will have no bearing on whether or not Sony will be found negligent in their ability to protect the data that was stolen, which is something they're under the magnifying glass for right now.

Some other pertinent answers, as summarized by the Sony Playstation Blog were:

 

Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack.
We discovered that the intruders had planted a file on one of our Sony Online Entertainment servers named “Anonymous” with the words “We are Legion.”
By April 25, forensic teams were able to confirm the scope of the personal data they believed had been taken, and could not rule out whether credit card information had been accessed. On April 26, we notified customers of those facts.
As of today, the major credit card companies have not reported any fraudulent transactions that they believe are the direct result of this cyber attack.
Protecting individuals’ personal data is the highestpriority and ensuring that the Internet can be made secure for commerce is also essential. Worldwide, countries and businesses will have to come together to ensure the safety of commerce over the Internet and find ways to combat cybercrime and cyber terrorism.
We are taking a number of steps to prevent future breaches, including enhanced levels of data protection and encryption; enhanced ability to detect software intrusions, unauthorized access and unusual activity patterns; additional firewalls; establishment of a new data center in an undisclosed location with increased security; and the naming of a new Chief Information Security Office
  • Sony has been the victim of a very carefully planned, very professional, highly sophisticated criminal cyber attack.
  • By April 25, forensic teams were able to confirm the scope of the personal data they believed had been taken, and could not rule out whether credit card information had been accessed. On April 26, we notified customers of those facts.
  • As of today, the major credit card companies have not reported any fraudulent transactions that they believe are the direct result of this cyber attack.
  • Protecting individuals’ personal data is the highest priority and ensuring that the Internet can be made secure for commerce is also essential. Worldwide, countries and businesses will have to come together to ensure the safety of commerce over the Internet and find ways to combat cybercrime and cyber terrorism.
  • We are taking a number of steps to prevent future breaches, including enhanced levels of data protection and encryption; enhanced ability to detect software intrusions, unauthorized access and unusual activity patterns; additional firewalls; establishment of a new data center in an undisclosed location with increased security; and the naming of a new Chief Information Security Office.

These are just Sony's answers along with my own informed analysis of the situation, but the actual culprit of this intrusion has yet to be revealed. Do you think Anonymous had anything to do with the attack or is this a feint by the actual hackers?

 


More Articles

19 Comments

mouse_clicker (on 05 May 2011)

Everyone should read hagelt18's comment again, because it's spot on. It's more of aconcept or an idea, with no official membership. How could it when the point is to remain completely anonymous? Only those who commit crimes should be punished, the rest probably had idea what was going on.


SONYisBP (on 05 May 2011)

ummm have they forgotten exactly what anonymous means? it isnt really a name. but shhhh let sony figure it out after a week or 2.


Jumpin (on 04 May 2011)

hagelt18 - simply put, those who join the group should be treated as criminals in the same way that those who join any kind of group that advocates and engages in criminal activity.


CaptainObvious (on 04 May 2011)

This is against the law! Don't worry citizens I'll catch these evildoers. But i will need some clues like name,address and DNA so hard to catch criminals who call themselves anonymous!


Gimgak (on 04 May 2011)

@hagelt18 these are stupid fucking kids that can't beat the simple fact into their deadbeat brains. Annoying as hell how uninformed some people are.


Kamiyama (on 04 May 2011)

Well who ever doing this will get caught and spend a couple of decades in prison for a few felonies.


hagelt18 (on 04 May 2011)

I love how people think Anonymous is some kind of organized group. Sure people communicate and release random statements. But the very concept of anonymous is that anyone, anywhere can be a part of it so long as they remain anonymous users on the internet. Yeah, it has evolved a lot...but that core principle has not changed. Now the problem is that people (including anon ops) think that there is some governing power over this totally anarchic community. Honestly, it is more like a subculture than anything else. Trends occur...some follow and others deviate...inevitably the subculture divides further.


Dr.Grass (on 04 May 2011)

''Anyone interested in planning an attack on SCE servers with the intent to steal data for commercial profit would have done so during Anonymous' DDOS attacks (which were being carried at the time of the intrusion), as there would be a higher probability for success during that time of artificially increased traffic.'' Oh really Oo


DonFerrari (on 04 May 2011)

And the best part is Congress asking for a hearing about all this mess when the FBI is already involved and probably have all the info they are asking about... probably FBI forbade Sony of comming to public and alert everybody before they had enough info.


Jumpin (on 04 May 2011)

I think the whole "hackers like to brag" bit is a very weak argument. There is a lot of evidence that points to the group's responsibility. We will see what the FBI investigation brings up. There is also the fact that Anonymous has attacked Sony before, and other organizations. If you ask me, this investigation is long overdue.


greenmedic88 (on 04 May 2011)

"i suppose the fact that anonymous stated that their biggest attack was coming up soon before this all happened is completely irrelevant right?" It is the equivalent of threatening the "worst possible violence ever" against someone only to have the police find that person dead and dismembered the following week and then simultaneously claim innocence even though you were actively in the process of carrying out your plan of attack and then laughing about what happened to the victim after the body was discovered.


Hephaestos (on 04 May 2011)

I'm sure there are many firms with credit card records that had lower secutity levels than Sony. It is evident that the Hacker event made them a prioritized target, whether it be by solidarity or because of opportunity. In any case, Had sony not stired the hornet's nest, they wouldn't have been stung. I'm not saying they shouldn't combat piracy, i'm saying they had the wrong approach.


o_O.Q (on 04 May 2011)

i suppose the fact that anonymous stated that their biggest attack was coming up soon before this all happened is completely irrelevant right?


Ultr (on 04 May 2011)

this is going to be pretty


greenmedic88 (on 04 May 2011)

Anyone interested in planning an attack on SCE servers with the intent to steal data for commercial profit would have done so during Anonymous' DDOS attacks (which were being carried at the time of the intrusion), as there would be a higher probability for success during that time of artificially increased traffic. Additionally, said party would want to imply Anonymous was responsible for the network intrusion in an attempt to mislead the investigation. So, while it's entirely possible said party was somehow related to Anonymous ("rogue member") and that they were acting completely independently, it's also entirely possible that a completely unrelated criminal party took advantage of Anonymous' well-promoted, highly visible attacks on SCE networks to gain illegal access, making it look as though Anonymous was responsible. Either way, Anonymous was an accomplice in the intrusion, whether it was unwittingly or not. Their bungling only helped whoever was responsible.


bannedagain (on 04 May 2011)

No I think this was put there to push the investigation off in a new direction.


Teo (on 04 May 2011)

I think it was someone in Anon. Who else has been breaching security in the internet at this scale? No one, I don't care what these nerdy anon say their goal is, its obvious someone in there has used the tools that these group of hackers have at their disposal.


A203D (on 04 May 2011)

I doubt Annon had anything to do with this. this simply isnt what their organisation about. i dont think Sony has planted that there either. since it wouldnt help them or the FBI, imo the real hackers put that there to get Sony to focus on Annon. but i doubt they counted on the FBI or Homeland security getting involved - which leads to the question have the FBI, etc, figured out who the perpertratiors are yet?? you'd think they'd of got em by now!


Dr.Grass (on 04 May 2011)

Well written, to the point argument. Wish there were more in this style on VG tbh.