Darknet - The Darkside

Don`t Learn to HACK - Hack to LEARN. That`s our motto and we stick to it, we are all about Ethical Hacking, Penetration Testing & Computer Security. We share and comment on interesting infosec related news, tools and more. Follow us on Twitter, Facebook or RSS for the latest updates.

30 December 2014 | 4,964 views

SniffPass – Simple Password Sniffer

Check For Vulnerabilities with Acunetix

SniffPass is small password monitoring software (basically a password sniffer) that listens to your network, capture the passwords that pass through your network adapter, and display them on the screen instantly. SniffPass can capture the passwords of the following Protocols: POP3, IMAP4, SMTP, FTP, and HTTP (basic authentication passwords).

You can use this utility to recover lost Web/FTP/Email passwords via your own network adapter.

SniffPass - Simple Password Sniffer

Requirements

SniffPass can capture passwords on any 32-bit Windows operating system (Windows 98/ME/NT/2000/XP/2003/Vista) as long as WinPcap capture driver is installed and works properly with your network adapter. You can also use SniffPass with the capture driver of Microsoft Network Monitor, if it’s installed on your system.

Under Windows 2000/XP (or greater), SniffPass also allows you to capture TCP/IP packets without installing any capture driver, by using ‘Raw Sockets’ method. However, this capture method has the following limitation:

  • On Windows XP/SP1 passwords cannot be captured at all – Thanks to Microsoft’s bug that appeared in SP1 update…
  • On Windows Vista with SP1, only UDP packets are captured. TCP packets are not captured at all.
  • On Windows 7, it seems that ‘Raw Sockets’ method works properly again, at least for now…

Do note, this software is NOT designed to grab passwords from other machines on the network, and could do so but only if the computers were connected via a simple hub or unecrypted Wireless networks.

You can download SniffPass v1.13 here:

sniffpass.zip

Or read more here.



25 December 2014 | 1,163 views

Rackspace Recovers From Major DNS DDoS

So Rackspace has just recovered from a major DNS DDoS attack which rendered some domains inaccessible for over 11 hours. It seems to have been a fairly frequent occurrence lately with Namecheap also undergoing several attacks against its DNS infrastructure.

I got affected again recently on December 18th when they were hit with a massive attack: DDoS Attack against Default DNS System V2

Rackspace DNS DDoS

This wasn’t the only attack with a large portion of the Internt being effected back in February when Namecheap DNS system underwent a heavy and sustained DDoS attack: Namecheap Is In The Middle Of A DDoS Attack.

Rackspace says it has recovered from a nasty distributed denial of service attack that it says may have seen “a portion of legitimate traffic to our DNS infrastructure … inadvertently blocked.”

The trouble started just before lunchtime on Monday, US central time, and persisted until 11 hours later.

Over on the company’s Google+ page Rackspace warned of “intermittent periods of latency, packet loss, or connectivity failures when attempting to reach rackspace.com or subdomains within rackspace.com.”

The company’s status report later confirmed it had “… identified a UDP DDoS attack targeting the DNS servers in our IAD, ORD, and LON data centers [North Virigina, Chicago and London]. As a result of this issue, authoritative DNS resolution for any new request to the DNS servers began to fail in the affected data centers. In order to stabilize the issue, our teams placed the impacted DNS infrastructure behind mitigation services.

Several other services have been hit with heavy, sustained DDoS attacks for no apparent reason including SaaS services like Dropbox which got taken offline.

In this instance (as usual) there doesn’t seem to be any reason so far, perhaps extortion? Gaming services are frequent targets with Steam, Xbox Live and PSN all having been taken offline previously by DDoS attacks.

This service is designed to protect our infrastructure, however, due to the nature of the event, a portion of legitimate traffic to our DNS infrastructure may be inadvertently blocked. Our teams are actively working to mitigate the attack and provide service stability.”

Rackspace is now confident things are back in order, as it has blacklisted DNS servers that were “sending both legitimate and DDoS traffic to Rackspace”. Users may not be entirely out of the woods, as its most recent update says “If you continue to experience adverse impact, please reach out to your support teams and provide trace route information for further investigations.”

A full root cause analysis of the incident is under way.

It can be really serious too, earlier this year Code Spaces was put out of business by a sustained DDoS attack which turned into an intrusion, extortion and eventual deletion of their entire business.

It’ll be interesting to see if any reason comes out for this Rackspace attack, but with the power of botnets now – it might just be for no reason at all.

A recent survey has shown that DNS attacks are putting organizations at risk – so yah, serious business.

Source: The Register


19 December 2014 | 1,090 views

Acunetix OVS Review (Online Vulnerability Scanner)

Introduction

It’s been a while since we’ve looked at any Acunetix products in depth, they’ve always had a solid Web Vulnerability Scanner as we found in our reviews of Acunetix WVS 6 and Acunetix WVS 7. Version 9.5 of the Web Vulnerability Scanner was released earlier this year and late last year Acunetix also announced their Online Vulnerability Scanner or OVS.

OVS is built leveraging the same state-of-the-art and proprietary Acunetix crawling and scanning technologies available in its on-premise solution.

Acunetix OVS Review (Online Vulnerability Scanner)

Acunetix Online Vulnerability Scanner was officially launched in March this year and is responsive, scalable and centralised with unmatched deep crawling and scanning capabilities.

If you compare it to the on-premise solution, it’s simple to use, there’s no maintenance (as it’s cloud based) and it’s very competitively priced (the on-premise offering is understandably a fairly costly enterprise solution).

I’ve spent a few days checking out OVS and it’s features/flow, including both the web scanning functionality and the network scan. So here is our Acunetix OVS review – enjoy.

Features

OVS is accessible via the web at https://ovs.acunetix.com/ – which for me is already a MAJOR benefit as I can easily log-in and check the status from anywhere. Previously with something like Acunetix WVS, you are limited to using the machine that has the software installed and the licence activated – which sometimes limits your mobility.

Feature wise it has:

  • Complete vulnerability management through one holistic dashboard
  • Perimeter server scanning
  • Recurring and scheduled scans
  • Over 35,000 network and 600 web vulnerability checks
  • Easy to interpret and prioritised vulnerability alerts with further information to make remediation easier
  • Complete set of compliance reports including OWASP Top 10, PCI DSS, ISO 27001 and HIPPAA
  • Fully supports HTML5, JavaScript, and thus the detection of DOM based XSS

Useful stuff if you are following any compliance regimes (PCI DSS is a pretty common one if you have anything to do with any kind of payment processing).

Also recently added to OVS are AcuSensor and AcuMonitor.

Acunetix AcuSensor Technology is a new security technology that allows you to identify more vulnerabilities than a traditional Web Application Scanner, whilst generating less false positives. In addition it indicates exactly where in your code the vulnerability is and reports also debug information.

There’s AcuSensor support for both .NET and PHP and you basically add it into your app to also scan from the inside and indicate exactly where in your code the vulnerabilities occur, install info can be found here.

Using OVS

Actually using OVS is pretty straight forward, after signing up you’ll have to do some basic account verification for a web scan. The domain you are scanning also has to be verified by means of a file in the web root (to prove it’s legitimately yours or at least you have access to it).

OVS Verification

You also have various options when adding a target including form based authentication details, you can add a login sequence file, download the AcuSensor file and add SSH credentials.

OVS Target Options

To do the network scan takes a little deeper verification requiring a phone call from Acunetix to confirm your contact number and some other details.

The interface isn’t the prettiest (it’s quite obviously Bootstrap), but it works just fine – starting a scan is easy as long as you’ve verified your domain. You can choose the type of Web Vulnerabilities you want to focus on and the type of Network scan (including if you want to run a safe or invasive network scan).

OVS Scan Options

It’s already really easy to set up scheduled and repeating scans, especially useful for compliance stuff like PCI DSS which requires quarterly scans.

OVS Scheduled Scans

When the scan has completed, you will get a notification via e-mail and you can check it out in the web app. The results are displayed in a fairly regular expanding tree format with the highest risk/impact vulnerabilities shown first. Each one has a title, and it expands to show what it affects, a description, attack details, impact, how to fix it and some web references if available.

OVS Scan Results

A feature I found really useful is the ability to generate reports from scan results in certain formats, the app can generate reports for you in terms of PCI 3.0 Compliance, Sarbanes-Oxley, HIPAA and so on. If that’s part of your job it’s a great value add.

Report Generation

Conclusion

Overall I think it’s a great tool and I’m glad to see a company like Acunetix, who has a great software scanner moving more into a SaaS (Software-as-a-Service) style offering. It suits the mobile pen-testing consultant a lot more, especially with agile teams working together the old methods of generating reports with software on each engineer laptop was cumbersome and hard to scale.

Hence tools were developed just to do report management like Kvasir and MagicTree. With a tool like Acunetix OVS, such issues are a thing of the past.

I do hope they keep developing and improving it, adding more features and making it a more user friendly experience.

If you want to check it out you can do so here:

http://www.acunetix.com/online-vulnerability-scanner/

Remember that there’s a 14 day free trial, which offers 2 full network scans with full results and 2 web scans with overview reports on 2 targets.


18 December 2014 | 7,529 views

ICANN Hacked Including Root DNS Systems

So another hack has been exposed, this time on ICANN – which is pretty bad. They are the database of the Internet basically, including the root zone system which is the highest authority for DNS requests.

The Internet Corporation for Assigned Names and Numbers (ICANN) is a non-profit organization that is responsible for the coordination of maintenance and methodology of several databases of unique identifiers related to the namespaces of the Internet, and ensuring the network’s stable and secure operation.

ICANN Hacked

Pretty serious business, and this time nothing high-tech went on at all – just some very targeted ‘spear-phishing‘ against employees of ICANN which did eventually yield valid credentials.

Domain-name overseer ICANN has been hacked and its root zone system compromised, the organization has announced.

Attackers sent staff spoofed emails appearing to coming from icann.org. The organization notes it was a “spear phishing” attack, suggesting employees clicked on a link in the messages, and then typed their usernames and passwords into a bogus webpage, providing hackers with the keys to their accounts.

“The attack resulted in the compromise of the email credentials of several ICANN staff members,” the announcement reads, noting that the attack happened in late November and was discovered a week later.

With those details, the hackers then managed to access a number of systems within ICANN, including the Centralized Zone Data System (CZDS), the wiki pages of the Governmental Advisory Committee (GAC), the domain registration Whois portal, and the organization’s blog.

The CZDS provides authorized parties with access to all the zone files of the world’s generic top-level domains. It is not possible to alter those zone files from within the system, but the hackers did manage to obtain all the information of those who are registered with the system, which include many of the administrators of the world’s registries and registrars.

In an email sent to every CZDS user, ICANN has warned that “the attacker obtained administrative access to all files in the CZDS including copies of the zone files in the system. The information you provided as a CZDS user might have been downloaded by the attacker. This may have included your name, postal address, email address, fax and telephone numbers, and your username and password.”

This is by no means a Sony level hack, but well honestly – nothing else is and probably will be for quite some time.

A compromise to ICANN is serious in a different way though as it’s a backbone of the Internet and thankfully the attackers couldn’t alter the root zone files or it could have been chaos. It’s mostly a case of information disclosure in terms of users of the Centralized Zone Data System.

While the hack is nowhere near the same level as the hack on, say, Sony that has seen gigabytes of information leaked onto the internet, it will prove extremely embarrassing to ICANN, which hopes to be handed control of the critical IANA contract next year.

It also comes as the US government revealed yesterday the process by which updates to the internet’s root zone files are done through ICANN. When changing the network addresses for the world’s top-level nameservers, the process relies on a secure email from ICANN, or a request sent through a secure web portal, a standard format change request and self-certification that ICANN has followed its own processes.

With the email addresses of staff with access to root zone records having been compromised and the hack only noticed a week later, there will be significant concern that had the hackers been luckier or if an IANA staffer – who also use icann.org email addresses – had logged in to the fake site the hackers may have gained access to the system used to make changes at the very top of the internet.

ICANN seeks to assure people that it is on top of the situation: “Earlier this year, ICANN began a program of security enhancements in order to strengthen information security for all ICANN systems. We believe these enhancements helped limit the unauthorized access obtained in the attack. Since discovering the attack, we have implemented additional security measures.”

That security program began when ICANN suffered a problem with CZDS system in April. In that case a number of users were wrongly given admin access to the system.

It’s good to see ICANN being a bit more grown up about this as well, disclosing that it happened, what was leaked and how they think the intruders got access to the system – a definite move in the right direction.

ICANN has also stated that disclosed passwords were stored as salted hash values, rather than in plaintext, although the algorithm used is not known. They also confirmed that this hadn’t effected any IANA-related systems and that no other systems have been impacted.

Source: The Register


16 December 2014 | 1,348 views

BlueMaho Project – Bluetooth Security Testing Suite

BlueMaho is GUI-shell (interface) for a suite of tools best used for Bluetooth security testing. It is freeware, opensource, written on python, uses wxPython. It can be used for testing BT-devices for known vulnerabilities and major thing to do – testing to find unknown vulns. Also it can form nice statistics.

I did get interested in Bluetooth for a while and the security implications of a personal area network protocol which includes discovery/broadcast etc. I ended up only posting one article at the time though which was about Haraldscan – BlueTooth Discovery Scanner.

BlueMaho Project - Bluetooth Security Testing Suite

I have a bunch more Bluetooth related resources to share though, so I’ll be putting them out from time to time. Some (like this) aren’t particularly up to date, but give you a great base to start with and play around.

Features

  • Scan for devices, show advanced info, SDP records, vendor etc
  • Track devices – show where and how much times device was seen, its name changes
  • Loop scan – it can scan all time, showing you online devices
  • Alerts with sound if new device found
  • on_new_device – you can spacify what command should it run when it founds new device
  • It can use separate dongles – one for scaning (loop scan) and one for running tools or exploits
  • Send files
  • Change name, class, mode, BD_ADDR of local HCI devices
  • Save results in database
  • Form nice statistics (uniq devices by day/hour, vendors, services etc)
  • Test remote device for known vulnerabilities (see exploits for more details)
  • Test remote device for unknown vulnerabilities (see tools for more details)
  • Themes! you can customize it

Requirements

The main requirements are:

  • OS (tested with Debian 4.0 Etch / 2.6.18)
  • Python 2.4
  • wxPython
  • BlueZ

You can download BlueMaho here:

bluemaho_v090417.tgz

Or read more here.


13 December 2014 | 2,863 views

Oryon C Portable – Open Source Intelligence (OSINT) Framework

Oryon C Portable is a web browser designed to assist researchers in conducting Open Source Intelligence investigations. Oryon comes with dozens of pre-installed tools and a select set of links catalogued by category – including those that can be found in the OI Shared Resources.

Oryon C Portable - Open Source Intelligence Framework

  • Based on SRWare Iron version 31.0.1700.0 (Chromium)
  • More than 70 pre-installed tools to support investigators in their everyday work
  • More than 600 links to specialized sources of information and online investigative tools
  • Additional privacy protection features
  • A ready to use opml file containing a sorted collection of information sources in the fields such as: OSINT, Intelligence, online research, InfoSec, defense, and more.

You can download Oryon C Portable here:

Oryon C Portable.exe

Or read more here.


11 December 2014 | 1,345 views

Sony Digital Certs Being Used To Sign Malware

So at the end of November, Sony got owned, owned REAL bad – we wrote about it here: Sony Pictures Hacked – Employee Details & Movies Leaked. It seems in as a part of the massive haul of documents, the digital certificates used to sign software were also stolen.

Which is bad, as you can imagine. Not SSL certs, but software crypto-certs that verify the executable comes from a trustworthy source (in this case Sony).

Sony Digital Certs Being Used To Sign Malware

It’s something of a malware-ception too, as the software that is thought to have been used in the Sony Pictures compromise is the very software being signed with the Sony cert to boost it’s effectiveness.

Miscreants were quick to capitalize on the theft of Sony’s cryptographic certificates – used to sign software to make it look legit.

An analysis of malware dubbed Destover was published by Kaspersky Lab on Tuesday, and shows the code was signed using a private certificate belonging to Sony to evade malware filters.

These certificate were apparently taken from Sony Pictures servers, which were comprehensively ransacked by hackers at the end of November, and leaked online.

It’s believed the infiltrators used a version of Destover to attack Sony’s network. And it appears the stolen digital certs were used to sign another build of Destover on Friday, which then ended up in the wild over the weekend.

When Windows examines an executable, it looks to see if the program has been signed by a recognized, trusted developer before running the code. As far as the operating system was concerned, the signed Destover was legit.

It’s a pretty nifty trick, but it wouldn’t work for long (the beauty of cert schemes) is that the issuer can also revoke the cert. Which apparently, in this case, happened pretty fast. So if you try and run the Sony signed malware on Windows now – it should reject it.

I’m not exactly sure the message Windows gives and if it’s any different between a revoked cert and and running something with no cert.

“The stolen Sony certificates (which were also leaked by the attackers) can be used to sign other malicious samples,” Kaspersky warned on Tuesday.

“In turn, these can be further used in other attacks. Because the Sony digital certificates are trusted by security solutions, this makes attacks more effective. We’ve seen attackers leverage trusted certificates in the past, as a means of bypassing whitelisting software and default-deny policies.”

Sounds pretty scary, right? But before anyone panics, it’s worth pointing out that malware writers can no longer use the code-signing keys.

The certificates were issued by DigiCert, a US biz that sells security certs. Kaspersky said it warned DigiCert about the issue, so El Reg checked with the crypto-company to find out what the situation was.

“This certificate is already revoked,” a spokeswoman for DigiCert told The Register on Tuesday, meaning Windows systems should reject the Destover build when its cryptographic signature is checked by the operating system.

“We received a report about the malware last week and immediately revoked the certificate,” she added.

I imagine they managed to get the malware deeper into a few places with the signed version, maybe only for a day or two – but a crack team of people with bad intentions could really capitalise on that.

There’s some good info about certs and certificate revokation here: DIGGING INTO CERTIFICATE REVOCATION LISTS

I honestly don’t think this will have caused a massive amount of damage, but it sure is interesting reading. We’ll have to see if any more news about this crops up.

Source: The Register


09 December 2014 | 1,407 views

InsomniaShell – ASP.NET Reverse Shell Or Bind Shell

InsomniaShell is a tool for use during penetration tests, when you have ability to upload or create an arbitrary .aspx page. This .aspx page is an example of using native calls through pinvoke to provide either an ASP.NET reverse shell or a bind shell.

ASP.NET is an open source server-side Web application framework designed for Web development to produce dynamic Web pages. It was developed by Microsoft to allow programmers to build dynamic web sites, web applications and web services.

It was first released in January 2002 with version 1.0 of the .NET Framework, and is the successor to Microsoft’s Active Server Pages (ASP) technology. ASP.NET is built on the Common Language Runtime (CLR), allowing programmers to write ASP.NET code using any supported .NET language.

InsomniaShell - ASP Reverse Shell Or Bind Shell

A bind shell is basically binding the command prompt to a listening port on the compromised machine, a reverse shell is sending a command prompt to a listening port on the attackers machine (used when the hacked server doesn’t have a public IP).

InsomniaShell has the added advantage of searching through all accessible processes looking for a SYSTEM or Administrator token to use for impersonation.

If the provider page is running on a server with a local SQL Server instance, the shell includes functionality for a named pipe impersonation attack. This requires knowledge of the sa password, and results in the theft of the token that the SQL server is executing under.

You can download InsomniaShell here:

InsomniaShell.zip


06 December 2014 | 1,503 views

WhatWeb – Identify CMS, Blogging Platform, Stats Packages & More

WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1500 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

WhatWeb - Identify CMS, Blogging Platform, Stats Packages & More

WhatWeb can be stealthy and fast, or thorough but slow. WhatWeb supports an aggression level to control the trade off between speed and reliability. When you visit a website in your browser, the transaction includes many hints of what web technologies are powering that website. Sometimes a single webpage visit contains enough information to identify a website but when it does not, WhatWeb can interrogate the website further. The default level of aggression, called ‘stealthy’, is the fastest and requires only one HTTP request of a website. This is suitable for scanning public websites. More aggressive modes were developed for use in penetration tests.

Most WhatWeb plugins are thorough and recognise a range of cues from subtle to obvious. For example, most WordPress websites can be identified by the meta HTML tag, e.g. meta name="generator" content="WordPress 2.6.5", but a minority of WordPress websites remove this identifying tag but this does not thwart WhatWeb. The WordPress WhatWeb plugin has over 15 tests, which include checking the favicon, default installation files, login pages, and checking for “/wp-content/” within relative links.

We wrote about WhatWeb way back in 2010, and there actually hasn’t been a release since 2011 (v0.4.7). I was glad to find however it still is under active development and there is work being done on what is going to become 0.4.8 at some point, it has many changes (as listed below) but hasn’t yet been released.

But due to the wonders of technology, you can grab the unreleased development version from Github now (link also below).

Features

  • Over 1500 plugins
  • Control the trade off between speed/stealth and reliability
  • Performance tuning. Control how many websites to scan concurrently.
  • Multiple log formats: Brief (greppable), Verbose (human readable), XML, JSON, MagicTree, RubyObject, MongoDB.
  • Proxy support including TOR
  • Custom HTTP headers
  • Basic HTTP authentication
  • Control over webpage redirection
  • Nmap-style IP ranges
  • Fuzzy matching
  • Result certainty awareness
  • Custom plugins defined on the command line

Sample Output

Changes in 0.4.8-dev

  • Added over 700 new plugins
  • Added aggressive version detection using md5 static file matches to several plugins
  • Added support for raw HTTP headers when scanning local files
  • Added –dorks to return google dorks for the selected plugin
  • Added google dorks to more than 500 plugins
  • Added ./addons/hunter
  • Added ./addons/gggooglescan
  • Added ./addons/country-scanner
  • Added SQL logging with --log-sql and --log-sql-create arguments.
  • Added raw header support by monkey patching the net/http library
  • Added context searching for plugin matches[].
  • Added the matches keyword, :search.
  • Added methods for aggressive plugins to send HEAD and POST requests
  • Added –grep, -g option to be easier than –custom-plugin.

You can download the latest ‘stable’ dev version (if such a thing exists) here:

master.zip

Or read more here.


04 December 2014 | 4,212 views

Sony Pictures Hacked – Employee Details & Movies Leaked

Sony hasn’t always had the best of times when it comes to being hacked, back in 2011 Sony basically had to rebuild the PlayStation Network (PSN) because of a hack which rendered the service off-line for almost a whole week.

Plus the fact the PSN hack could have leaked up to 10 million user accounts which included credit card details. And again in 2011 they lost 25 Million Customer Account Details Through SOE (Sony Online Entertainment).

Sony Pictures Hacked - Employee Details Leaked

The hack was so bad, it basically shut down Sony Pictures – the above picture is a photo of a desktop in the Sony Pictures office and apparently all computers were showing this. Similar images came from various sources in different offices showing that this is indeed a seriously pervasive attack.

If you downloaded the archive from the URLs in the pictures, it contains text files which are basically HUGE lists of filenames, files that have leaked from Sony servers. And there’s some serious stuff in there including Hollywood stars passport scans, ppk files (SSH private keys), password lists and much much more.

There’s some discussion on the contents and analyse on Reddit here: I used to work for Sony Pictures.

The password lists/SSH keys also led to the compromise of many more related services and accounts (many film related Twitter accounts were hacked).

Sony Pictures is investigating a breach that has seen hackers supposedly steal reams of internal data and splash defacements across staff computers. The company is now in lock-down as it wrestles with the problem.

The beleaguered company, writes Variety, has requested staff disconnect their computers and personal devices from the Sony network and shut down virtual private networks.

Cracking group Guardians of Peace claimed responsibility for a defacement appearing on staff machines that it stole internal corporate data. The group says it will leak more details to the public web depending on what Sony ‘decided’ in what appeared to be a reference to demands quietly sent to the company earlier.

Source: The Register

Sony Pictures e-mail servers were still totally off-line the day after the attack and they made a statement saying it could take between 1-3 weeks to rectify the matter.

It seems like the attackers are really leaking the files they stole too as details of Sony employees were leaked including personal details and salaries.

It’s getting worse for Sony: the latest dump from the raid that’s brought the company to an IT standstill include the personal detas of staff.

Documents leaked through BitTorrent show the names, home addresses, salaries (and bonuses), and social security numbers of thousands of staff, including executives.

Sony Pictures Entertainment could not be reached for comment by the time of writing.

Some 17 executives, from programming to advertising, were listed as having salaries over US$1 million. Severance pays also appeared to be listed.

Source: The Register

It’s 8 days since the attack and Sony Pictures is still struggling to recover, it also seems like some unreleased movies might (including Annie) have been leaked during the compromise.

Sony, the studio behind “The Amazing Spider-Man” films and the “Breaking Bad” television series, restarted many of its computer systems on Monday after a Nov. 24 breach by a group calling itself #GOP, for Guardians of Peace. Executives at the entertainment company said they were also making progress in fighting the apparently related Internet pirating of five complete films, including the unreleased “Annie.”

Source: New York Times

The virus was pretty nasty and wiped all the machines + removed the master boot record rendering most of Sony’s Microsoft based desktops useless. There are some suspicions North Korea could be involved due to the malware used.

Back in August Sony was under attack by a massive DDoS attack aimed at PSN, and then just as they recovered – this.

The latest details to pop-up are that the leaked data dump is being seeded by a bunch of Amazon EC2 servers that host Sony PlayStation websites..which is odd, as the Sony Pictures network and the Sony PlayStation network should be totally separate.

Sony PlayStation website servers were used to distribute a 27.78GB archive potentially containing sensitive data swiped from Sony Pictures computers, it’s claimed.

Until early on Tuesday afternoon, San Francisco time, more than 60 systems seeding the archive on the BitTorrent network appeared to be virtual servers in the Amazon EC2 cloud, according to security researcher Dan Tentler.

A number of those fingered server instances – eg, 54.77.62.39 – are also serving websites for Sony Computer Entertainment. The EC2 instances serving up the data were checked by another researcher, who found some had SSL certificates signed by Sony.

Source: The Register

This is quite possibly the worst hack of a major US company ever perpetrated, especially in terms of business disruption and data loss – the financial implications of this could be HUGE. Especially for their biggest Christmas movie Annie.

I’m sure we’re going to see more data dumps dropping in the next week or so, it’s certainly an interesting case and it’s definitely not over yet.