Hacker News Reader

Comment by KaiserPro | Hacker News Reader

I work in VFX, and its a little bitter sweet to see Sony entertainment on its knees.

First, various people like sony have been forcing VFX houses to go through draconian security changes to stop this kind of threat. (supposedly because one of us leaked expendables 3, despite none of us having the complete movie or sound)

These rules include three separate zones, of which only one has access to the internet. All USB storage is disabled. All internet access must go through a terminal server. (all our phonehome services for disks now don't work)

All data must go through a purgatory like intermediate stage, for the data ops guys to move out to the "outside" zone, for upload to studios.

We then have monitors to look at the data flow, to see if wierd stuff is happening.

So if they'd followed the MPAA's own advice none of this would have happened, unless of course it was an inside job. Which in my mind there is little doubt.

View on HN

I thought you were going to say "Supposedly because one of us leaked expendables 3, despite none of us having any desire see it"

I can confirm this is industry wide when dealing with the big movie companies. I work in the big data industry and we have several of those clients under the MPAA and have had to go through multiple security audits just for their business.

What kind of security things do they require? Stuff like using two factor authentication? (Not storing passwords in a spreadsheet would also be good, but they clearly don't require that ;)

Oh no, they require that. but thats difficult to enforce.

Strick AD password, account lockouts after n attempts, password rotations every 90 days.

The internet must have an air gap between it and the "production" network. So that means internet in terminal server clients. (we used to be able to get away with VLANs, and just have a clientside VM on a different VLAN)

No automated mechanism to move data between the "production" network and the outside world. Any data that needs transporting must be accounted for (and that's literally terabytes a day.)

You are assuming Sony really cared about MPAA's advise.

My bet is that while Sony was forcing other vendors to follow draconian security measure, they themselves had very lax security. Keeping SSN of 3000+ employees in a non-encrypted excel file?

That alone tells me Sony didn't have tight enough security, hence hack by outside (teenagers or N Korea) is more likely.

Things like this happen all the time, where a big company/org tells vendors to follow some rules while they themselves ignore them. All the time.

Naa, Sony couldn't give a shit about security, it was a cost that they thought wasn't worth bearing. Its the same as any other company.

The problem is that a lot of the first release stuff came from HR. As we all know HR types rarely understand computers, let alone security. Even if they had a password repo that was super secure, it would be easier for them to share a spreadsheet, so they'll do that instead.

For all we know, Sony could have had fairly tight security. From my understanding there were hefty ACLs to stop various sides of the business talking to each other. Yet these were still breached, for a long time and lots of data seeped across.

The way the malware was written, and the actions of the hacker(s) leads me to suggest that this was an inside job. It is very had to sneak out large amounts of data, and fiddling with change control whilst not being detected is very difficult. Unless you know how to imitate the normal ebb and flow of work life.

The problem SPE have now is that they'll have to throw away everything and start from scratch. All previous data will have to be quarantined, all infrastructure from the server, switches, printers to the workstations will have to be disposed of. Why? because there is no way of proving that there isn't any malware still embedded.

This has happened at plenty of places! Ever worked on a Marvel film? They're insane about security - only certain parts of the studio are actually allowed access to that show's dailies, assets, etc.

Yup. Turning off the internet made me very sad.

That's only the case for lighting and comp for us.

The earlier stages (Assets, texturing) need internet for reference :)

We did image processing for movie applications many years ago. The studios sent armed guards with the data tapes. They had instructions to remain with the tapes until the job was done. That often meant 16 hour days. Intimidating but a rather false sense of security. I am sure they are far more sophisticated today.

If anything you should thank them for forcing on you the very measures that might have saved your business.

But of course, conspiracy theories and big companies being unfair against the nineteny-nine-percent, are all much more newsworthy than reality.

Hence goes my last post on HN. I'll come back when - if - reason someday prevails over sensationalism.

Well, bye then. Pfft.

Completely agree.

Whilst I agree that following security best practices is important, I think you miss the point of my post. WE are implementing the rules they drew up. From what I can see they did not.

Your melodramatic announcement of no longer participating in HN discussions directly contradicts your desire for reason to prevail over sensationalism.

Reply on news.ycombinator.com