Sony hack exposes poor security practices

Malware overwrites hard drives

According to the FBI, the malware overwrites all data on the hard drives of computers, including the master boot record, preventing them from booting up.

"The overwriting of the data files will make it extremely difficult and costly – if not impossible – to recover the data using standard forensic methods," the report said.

That FBI revealed the malware uses Microsoft Windows components to propagate, shut down network services and get instructions from its controllers.

This means that enterprises that use Windows and Microsoft server software are vulnerable to attack, especially those not using the latest versions of the software.

Companies that rely on Windows and Microsoft server products – especially older versions of Windows – are particularly vulnerable to attack.

The FBI memo provides a way to detect the “beacon” message used by the malware to communicate with its controllers, but that is of limited use to victims according to Ars Technica.

By the time the malware begins communicating with its controllers, it has already been launched on the target network and begun overwriting data.

Enterprise information security professionals will have to wait until researchers have analysed the malware for details to learn how to find it before it is executed.

Windows vulnerability

According to the FBI, the malware comes wrapped in an executable “dropper” that installs itself as a Windows service.

This new Windows service then creates a network file share using the “%SystemRoot%” Windows environmental variable which points to the location of Windows system files in the PC’s file directory structure.

The malware then gives unrestricted access to that share, allowing any computer on the local network to access it. It also uses the command line of the Windows Management Interface (WMI) to spread to other computers on the network.

According to community security analysis site Malwr, the dropper communicates with a set of IP addresses at a university in Japan. Then it shuts itself down.

The dropper also installs a file with the same name as Microsoft’s Internet Information Server (IIS), iissrv.exe to monitor port 80, which is used by most web traffic.

When the main executable called “igfxtrayex.exe” is launched, it makes four copies of itself and launches each of with different command-line arguments to trigger different parts of the code.

It then shuts down the Microsoft Exchange Information Store service, dismounting Exchange’s databases and making email inaccessible.

Next, the malware attempts to connect to its command and control network. At the same time it starts deleting data from the hard drive until it is completely wiped.

Doubt over North Korea theory

Despite reports linking the attack to North Korea, there seems little evidence to back this up. Sony has dismissed as “inaccurate” reports saying the company was set to blame North Korea for the attack.

While North Korea has not issued any statement on the attack, a group calling itself #GOP or "Guardians of Peace" claimed responsibility.

Security industry commentators say the attack does not bear the hallmarks of cyber attacks backed by a nation state, but is more likely the work of hacktivists or disgruntled company insiders.

This is consistent with the fact that the attackers posted notices on Sony computers, saying the company had failed to meet their demands, which were not specified.

Sony has not indicated if it has received any demands from #GOP, but someone claiming to be a member of the group hinted in a media interview that sympathetic insiders helped them in their operation, and that they sought “equality,” according to Wired.

Nation state attackers generally do not criticise their victims for having poor security or post stolen data to Pastebin, said Wired.

Lessons from the Sony hack

While many questions remain unanswered, several security lessons can be drawn from the attack:

1. Encrypt all sensitive data. Many of the documents containing personal and corporate information were not encrypted in any way;
2. Do not store passwords in the same place as password-protected documents. Although some files were password-protected, most were accompanied by a folder containing the passwords, reports Mashable;
3. Use two-factor authentication. Although it is not known how the attackers accessed the Sony data, it is likely they used stolen or credentials provided by insiders, which would have been useless, had the company used two-factor authentication;
4. Keep sensitive personal data separate from other data. According to leaked data, folders for salary, heath and other personal data were stored in the same directories as other data;
5. Carry out regular external security checks, to ensure obvious security risks are eliminated; and to check that, if attackers are able to get into the network, it is difficult for them to move around without restriction.