Sony hit again with two hacks

Japanese ISP subsidiary is broken into, while phishers use Sony server in Thailand

An intruder has apparently broken into So-net, an internet service provider subsidiary of Sony, and stolen about $1,200 worth of virtual tokens.

So-net disclosed the compromise in an alert (written in Japanese) on its homepage on Thursday.

Meanwhile, security firm F-Secure today disclosed that it has also discovered a phishing site that's hosted on a Sony server in Thailand.

"Basically this means that Sony has been hacked, again," Mikko Hypponen, F-Secure's chief research officer, noted in the blog post. "Although in this case the server is probably not very important," he added.

News of the latest breaches come barely a month after Sony disclosed intrusions at its PlayStation Network and Sony Entertainment Online sites that compromised data on close to 100 million account holders.

A So-net spokesman told the Wall Street Journal, which broke the story, that the breach of the ISP is unlikely connected to the previous compromises.

The Sony-owned So-net ISP lets consumers accumulate reward points that can be redeemed for Sony merchandize and services. The intruders illegally redeemed points belonging to about 130 consumers. Another 73 accounts were compromised, but their points were not redeemed, the Journal noted.

In addition, about 90 email accounts are also believed to have been compromised in the breach

According to the Journal, an intruder using one IP address, tried to access So-net's point service close to 10,000 times before finally gaining access. So-net itself appears to believe that the intruder had usernames of account holders and used an automated program to generate possible passwords, the Journal said.

It's not immediately clear why the company apparently doesn't have a mechanism for flagging multiple failed attempts to access its systems.

The intrusions are believed to have taken place on May 16 and May 17. So-net discovered the breach on May 18, after receiving consumer complaints. So-net stopped the point redemption service following the discovery of the breach.

he latest breaches are relatively minor in scale compared to the massive breach at PSN and Sony Entertainment Online. Even so, it only adds to the company's embarrassment.

The earlier intrusions forced Sony to take its PSN service offline for several weeks while it struggled to identify the scope of the problems and how to fix them.

The company started re-launching the service this week but isn struggling to keep it running smoothly.

For instance, earlier this week Sony was forced to once again take a portion of its PlayStation network offline because of a programming error that could provide hackers a way to break into its networks.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His e-mail address is jvijayan@computerworld.com.

       

Bin Laden Virus To Wreak Havoc, Warns FBI

Osama is dead but is still wreaking havoc. If you get an e-mail containing bin Laden links, then it's a fake, says the FBI.

Click to enlarge

The FBI has issued a warning to computer users "to exercise caution when they receive e-mails that purport to show photos or videos of Osama bin Laden's recent death."

It warns users not to open unsolicited e-mails or click links contained within such messages, as it could be from an unknown sender.

There are several email and Facebook scams doing the rounds, one shows a Facebook page, claiming to be a video of "Osama bin Laden killed live on video."

Other emails have links saying: "See video in which Osama bin Laden is shown holding a newspaper with today's date and disprove his possible death reported by OBAMA" and another says "pictures-of-osama-dead.exe."

The news of the demise of bin Laden, the godfather of terrorism and leader of al-Qa'eda, and on the FBI's 10 Most Wanted List for more than a decade was met with jubilation across the world.

The emails, if opened, could contain a virus that could damage computers and the "malware" can embed itself in computers and spread to users' contact lists, thereby infecting their systems and could also capture personal information.

Users should also ensure they have up-to-date firewall and anti-virus software running on their machines to detect and deflect malicious software, the US's Internet Crime Complaint Center recommends.

IT security experts McAfee agrees, branding the mails "expected lures" in a blog.

"Beware of any verbiage, subject lines in emails, or links via Facebook or Twitter that contain words like these–as they will almost certainly get you into trouble," it warned. 

 

News of the death of bin Laden, confirmed by a simple tweet by a former White House staffer from his BlackBerry at 10.25 EST on May 02 sent news outlets around the world into a frenzy of activity and online searches in the US surpassed the recent interest in the British Royal Wedding.

The attack on the al-Qa'eda leader by US forces was first reported on Twittter by an IT consultant based in Abbottabad, Pakistan, who said "Helicopter hovering above Abbottabad at 1AM (is a rare event)."

He was finally caught in a hideout suburb near the town of city of Abbottabad, Pakistan.

"So I'm told by a reputable person they have killed Osama Bin Laden. Hot damn," Keith Urbahn, the former Chief of Staff of Defence Secretary Donald Rumsfeld wrote on Twitter.

However, Urbahn who also describes himself as a  Navy Reserve intel officer came in from criticism from one follower, who criticised the casual nature of the post without getting confirmation first, retweeting "I gotta say...you broke this first. Everyone was crediting you before it was confirmed. Nice work."

However, it did turn out to in fact be true, although Urbahn downplayed the significance of the event, later tweeting "Stories about the 'death of MSM [mainstream media]' because of my 'first' tweet are greatly exaggerated."

He also cited his source his source as being from the media from "a connected network TV news producer."

 

Following the tweet, The White House confirmed the death soon after, which was followed by an official address by President Obama at 11.00 EST.