Sony saved thousands of passwords in a folder named 'Password' | Hacker News Reader

Sony saved thousands of passwords in a folder named 'Password'

telegraph.co.uk

67 pointsdnetesn39 comments

I normally don't have much sympathy for companies which get egg-on-face because of their own incompetence, but I am very sympathetic to the employees and past employees who just had their SSN and other vitals leaked onto the internet.

As an aside SSNs really need a massive overhaul. In theory they're meant to only be used for government stuff, but their use is now so broad (finance, insurance, medical, et al) that their leakage is all too common and the potential cost of a leak too damaging.

With a little bit of investment the SSA could continue to generate SSNs (for historical reasons and government department usage) and generate a new SSID which is just a longer unique number which companies are legally prohibited from storing, however when they receive it they forward it to the SSA via an API and it returns a static unique customer number (UCN) which they can then in fact store.

This has the following advantages:

- The SSA can update your SSID a lot. Every few years, every new card, or when requested. Unlike SSNs which cannot be changed.

- Updating your SSID won't break existing accounts or similar, as companies won't store the old one anyway (only the resulting UCN). Unlike SSNs which break stuff if changed.

- Leaked UCNs are not as useful because you cannot enter them into a web-site or put them on a financial form directly (it would be a different length/format to SSIDs or SSNs on purpose). Unlike SSNs which can be directly reused.

- The system doesn't depend on complex cryptography. It is just a simple perhaps JSON request over HTTPS.

You could deploy this system over ten years at minimal cost. The system is relatively simply, and behind the scenes it can tie UCNs to SSNs in the SSA's database system. A single customer would have three things (in this system): Current SSID, static SSN, static UCN.

If SSN was no longer the primary key for financial and marketing data, and UCNs were only locally significant, this would make data sharing rather difficult between companies. Think of banks and service providers talking with credit bureaus. Or they'd just use an even more inferior technique for UUIDs like "name-address". Or even more invasive (biometrics, or something)

You mean a system similar to what almost every non-USA country currently uses?

Here in sunny Australia we don't have anything like an SSN, at least not in terms of secrecy and potential personal disruption were it revealed. We have a TFN (Tax File Number) but lots of non-owners of that number need to, and do, have access to it.

Our bank accounts contain two parts - the branch (BSB) and account numbers. Anyone can get access to those, and in fact we frequently share them in order to receive payments.

The way the US, and I think the UK also, revere such evidently hard-to-protect information means the social designs around them are hugely fragile.

Really, it's not a hypothetical 'there has to be a better way', but simply 'there is a better way'.

Not aware of a UK equivalent of SSN.

Justin - you're quite right. NI number isn't anywhere near so powerful.

However I was thinking more of the assumption that your Sort code[1] + account number can be kept secret, and more importantly the profound risks to your finances if it is not.

[1] http://en.wikipedia.org/wiki/Sort_code

Sort code and account number is no risk at all. You can (and many do) quite happily give this information out.

Indeed, it allows you to pay me money, you can easily obtain them from invoices... they do not provide any authentication.

There is some risk in revealing these, for example: http://news.bbc.co.uk/1/hi/7174760.stm

They could just share UCNs instead.

SSIDs cannot be stored (or shared). But UCNs would function exactly like SSNs in the current system.

SSIDs just exist to "wrap" UCNs, they prove that you have the current SSID for whatever person you're claiming to be (kind of like a poor man's password) and make it more difficult for thieves to re-use the UCN number trivially (you'd have to be an insider to enter a UCN, outsiders need the SSID).

The reason to stop people storing or sharing the SSID is primarily so SSIDs themselves don't become the SSN replacement. Companies might get lazy and instead of converting the SSID at the SSA, they instead "cache" the SSID->UCN conversion in-house or worse just use the SSID directly.

You have to make SSIDs ephemeral. UCNs and SSNs are static. UCNs can be stored/shared, SSNs get outmoded eventually, and SSIDs are short-lived no storage-sharing numbers that provide the UCN.

great idea... which consultant gets to build it for 800 billion dollars?

>I am very sympathetic to the employees and past employees who just had their SSN and other vitals leaked onto the internet.

What makes it even worse is that the SSA makes it virtually impossible obtain a new SSN. Even showing them that you were a victim in a high profile leak like this, for example, isn't enough. You have to prove actual misuse, such as someone taking a credit card out or being arrested in your name, before they will issue a new one. In almost all cases, police reports are required.

Given that a new SSN is essentially impossible, if I were a victim in this, I would immediately freeze my credit file at all 3 major credit bureaus. In most states this can be done for $0-$10 per bureau. This can cause hassles for instant credit approvals etc, but they provide mechanisms to unfreeze the file temporarily when necessary.

Why wait until you're a victim? It's much easier to prevent significant damage to your credit history than it is to repair it. The hassle with credit approvals is pretty minimal; people generally know ahead of time when they'll need a credit check, and it only takes ~15 minutes to put a temporary lift in place. Identity theft is often an expensive, massive headache that can take years to fully recover from.

Actual misuse isn't enough. There was the case of a woman whose ssn was used by hundreds of people. I think she eventually was able to get a new number but it took years and it's impossible for anyone else.

I recently saw a demo of the "Aadhaar" project by Indian government in Nasscom Product Conclave event (in Bangalore). I was a skeptic & still am wary about security aspects of something at this scale by government.

But I was quite impressed by the progress & the use cases [1] themselves. They showed in real time, how a bank account authentication can be completed without bringing any other document.

Just IRIS scanner on a phone / tablet, that confirmed the identify of user by returning a photograph & other details. It was done in seconds with a 3G network. There were a few other use cases demonstrated and was pleasantly surprised to learn there are companies in valley that are building services on top of the API. [2]

[1] Overview of Aadhaar service: https://resident.uidai.net.in/aadhaar-services;jsessionid=B1...

[2] API: https://developer.uidai.gov.in/site/book/export/html/18

Companies just shouldn't use a government id number for any sort of authentication.

They might need such a number to carry out some level of authentication, but they shouldn't treat knowledge of the number as significant.

Perhaps you're right. But then they still need a way of uniquely identifying a specific individual across many products and services. If for combating fraud if nothing else.

There could always be an independant organisation who generates GUIDs for everyone, but you'd still want to improve on SSNs due to the limitations outlined above.

The unique id is fine. It's pretending that it can be a secret that causes all the problems. It should be treated as personally identifiable information and not distributed carelessly, but that shouldn't be mixed up with treating it as secret (which it needs to be to provide useful verification of identity).

SSNs should be made public.

Then we could all stop pretending that knowing an SSN provides any sort of security. The pernicious idea that asking someone their SSN is like asking for a password needs to be killed, completely. To make organizations change their processes requires more than mere federal law forbidding the use of SSNs, and making SSNs public would make it obvious to _everyone_ that knowing an SSN doesn't mean anything. Make them public, and take away their power.

Interesting, but I think it has bad side-effects for privacy. I'm guessing this would mean a public mapping of at least full-name => SSN being published. AFAIK there's no such list of names currently -- is there a good reason for that? Would/should this list include more data like date of birth? My understanding is that SSN's from certain eras encode information on the place of birth. Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily?

A Name<=>SSN mapping would be enough to force change. It wouldn't even have to be accurate or complete, just well known. If the government announced that it will release a list of SSNs and names, everyone would realize they can't ask for a SSN for "verification".

> My understanding is that SSN's from certain eras encode information on the place of birth.

It goes the other way too, from public info to SSN: http://arstechnica.com/science/2009/07/social-insecurity-num...

> Might having a public, nearly unique number of any person allow buying/selling additional data from third parties more easily?

The government has been trying to restrict the use of SSNs since their beginning, including commercial restrictions.

https://en.wikipedia.org/wiki/Social_Security_number#Identit...

Good points, thanks. I think you missed my point about commercial use, though. Allowing a public, universal, nearly unique identifier (apparently SSN's aren't always unique) for every resident of the US might make it easier to compile, buy, and sell information about people. I guess these companies already use {name, date of birth} as an ID to attach addresses etc., but having a more robust UID would allow more accuracy when considering name changes or variants. Also, publicizing SSN's risks retroactively publicizing everything that was ever privately collected under them. I can't quite put my thumb on this, so maybe it's a bit irrational, but I would want somebody to thoroughly disprove things like this before I could support the idea.

If, e.g., Facebook is completely allowed to know my SSN, they can more easily make deals with anyone else to share information about my finances, medicine, voting, etc., which are already tied to my SSN. Considering the "shadow profiles" some social companies reportedly compile, they might even be able to do this without my ever creating an account. The current situation in this area would still probably make me uncomfortable if I knew it all (as your links suggest, Facebook might already be able to guess a lot of SSN's), but I at least hope that having one "secret" and legally "regulated" element slows down some data mining and exchanging.

If you have confidence that business interests or laws will prevent my worst fears from being realized, consider we're talking about this in a thread about supposedly private information being publicly released when a company got hacked. Then there's the trading and compiling these hackers could be doing outside of the public view.

I agree that a government issued identifier is a bad idea, but that debate is long over and SSNs won.

The government can still stop corporations from using it by passing a law and enforcing it (and they have for some things), but that doesn't seem likely given the history and evolution of SSNs. It seems more likely that the government continues to require SSNs on more and more reporting, and continues to not punish other uses by corporations.

Somewhat related, I think the history of SSNs is a lesson in things like separation-of-concerns and scope creep. Social Security cards started in 1936 with the heading "Social Security Act." In 1946, "For Social Security Purposes Not For Identification." In 1961, "For Social Security and Tax Purposes -- Not For Identification." In 1972, they gave up on "not for identification." As of 2007, the card includes security features such as color-shifting ink and a latent image only viewable from certain angles. It seems the card progressed from simply a medium to convey an account number to the holder, to a high-security proof of eligibility and identity.

A system designed in the 30's, explicitly not for identification, is still in use 80 years later for everything from its original design for a single government agency, to medical care, financial credit tracking, taxation, voting, employment, etc. Might we have benefited from re-designing it at some point in the past, instead of overloading purposes beyond what it was created for?

http://www.ssa.gov/history/ssn/ssnversions.html

I know someone working at Sony Pictures. She said that Sony Pictures is literally paralyzed. They can't pay their employees and have reverted to completely manual processes. They can't accept orders from customers or pay their vendors as well. The hackers have completely destroyed their infrastructure. There is no real disaster recovery and there are backups of various systems at various levels of conoleteness but presumably those backups are infected as well.

They need to completely rebuild their ERP system from scratch and that will take months.

It's a complete nightmare and if this doesn't change the perceptions of CEOs on cybersecurity, they need to be fired because it complete puts their entire company at risk of they don't put a significant expense to ensure that their company is secure.

This isn't strictly true. The thousands stored in a folder called "Passwords" was actually a curated dump of passwords from various parts of the server that the hackers put together and into its own dump -- looking at the data, it doesn't appear the passwords were saved there originally.

That's not to let Sony off the hook, however. Plenty of passwords were stored alongside the password protected documents [1] and some of the passwords used were insanely bad (s0ny123) [2].

[1]: http://mashable.com/2014/12/03/sony-hack-4-security-lessons/ [2]: http://mashable.com/2014/12/02/sony-hack-passwords/

Its the company social media accounts. Managing those is always going to be a trick, but it's actually not that big of a deal that they're lost - a tedious job for a marketing intern to reset them all and a risk of Sony making some embarrassing tweets or fb posts. Nothing compared to losing customer data or credit card numbers or crypto keys or something.

Title is a bit sensationalized, really. I mean "leaked passwords" sounds severe, but corporate social media accounts aren't exactly what the reader expects.

Yeah, I don't really see why you wouldn't write down the passwords of social media accounts.

What's the alternative? We all know (don't we?) that security through obscurity is no security at all. Giving the folder a different name would only affect usability, not security. The problem is not the folder name but the fact that the data itself (including paths) was unencrypted, and that perimeter security was lacking. Poking fun at the folder name seems to be missing the point.

Obscurity is part of security. I have personally found that by using non-default ports for services that attempts to break in have gone down to zero. For example if you leave port 5900 open I guarantee your going to have bots trying to break in day and night. Someone would have to be specifically targeting my network to even find the ports I use(a port scan takes a good amount of time) and the services behind those ports. Of course that's not the only security in place, there are many layers but obscurity plays an important part.

Totally agree. Obscurity will not save you from a targeted attack but the main problem on the internet now is automated break-in attempts. Obscurity can be very helpful there. Of course I can't help noticing that this is the moral equivalent of having your group attacked by a bear and saving your life by out-running everybody else in the group.

But if everyone else in your group is running around naked, covered in honey, shouting "come and get me, bear!" and steadfastly refuses to listen to your pleas to stop, I don't think anyone would blame you.

A port scan of the entire internet takes around 3 minutes if you have enough bandwidth [1]

[1] http://blog.erratasec.com/2013/09/masscan-entire-internet-in...

If it doesn't DoS my firewall, a port scan like that will be easily detected and blocked. A stealthy port scan takes a good amount of time.

Not if you interleave the hosts, rather than the ports on each host, as you would.

Just because you have fewer attempted break-ins doesn't mean your system is more secure. In other words, the only relation between the number of successful break-ins and the number of attempted break-ins is "less than or equal to".

If you want to really get down to it, there is no such thing as security, only deterrents, with enough determination and skill a way will be found through all defenses. There are many more script-kiddies out there than real hackers, IMO obscurity successfully deters the script-kiddies in pretty much all cases. If a skilled hacker wants in to your network he will eventually find a way, if even just through social engineering. With a layered approach to security, obscurity, strong passwords, patched systems, log monitoring, encryption, etc... You will successful deter the "hack of opportunity" and even many targeted hacks, leaving you only truly vulnerable to the skilled hacker.

I also have a folder called "passwords" (actually "pw") with thousands of passwords.

The difference is that they are all encrypted with gpg (via my little pw utility [1]).

[1] http://svario.it/pw

Sony's IT deficit notwithstanding, somebody somewhere had to have pointed out 1Password or Lastpass.....

On another note, is anybody surprised? Take out Sony and insert Company X, I'm sure this is a common practice in many companies.

What could go wrong?

Reply on news.ycombinator.com