Analysis of the leaked Sony Pictures data has revealed poor security practices.
The analysis by Mashable found that password files were in the same folders that they were supposed to protect. One of the folders contained payroll spreadsheets, with details such as employees’ names, job titles, home addresses and current salaries.
Some of the spreadsheet files were protected by a password but in the very same folder, there was a document called “passwords” which contained the password to unlock the files.
Following the attack last week, initial released documents included: private key files; source code files (CPP); password files (including passwords for Oracle and SQL databases); inventory lists for hardware and other assets; network maps and outlines; production schedules and outlines; financial documents and PII. Later in the week, the attackers released preview copies of Sony movies, including Annie, Fury, and Still Alice.
Also according to multiple sources, Brian Krebs reported that intruders stole more than 25 gigabytes of sensitive data on tens of thousands of Sony employees, including Social Security numbers, medical and salary information.
“Several files being traded on torrent networks include a global Sony employee list, a Microsoft Excel file that includes the name, location, employee ID, network username, base salary and date of birth for more than 6,800 individuals,” he said.
He later added that links to the torrents were posted on Pastebin on Monday morning and less than an hour after that post went live, the individual hosts that were sharing copies of the Sony data came under sustained denial-of-service attacks apparently aimed at keeping the files from being shared with other torrent users.
Michele Borovac, VP at HyTrust, said: “Organisations that are not subject to regulations like PCI and HIPAA must take a deeper look at their network security. Continuous monitoring of all traffic, as well as privileged administrator accounts, is a critical component for preventing these attacks.”
