Lulzsec Member Raynaldo Rivera Pleads Guilty To Sony Pictures Breach 81
hypnosec writes "Raynaldo Rivera has pleaded guilty at the US District Court for the Central District of California to hacking the Sony Pictures Entertainment website in May 2011. The 20-year-old in his plea agreement revealed that he joined Lulzsec in May of last year in a bid to help the hacking collective carry out cyberattacks on governments and businesses. Rivera, who surrendered to the FBI on August 28 this year, admitted that he was the one who launched an SQL injection attack against sonypictures.com that enabled him to extract confidential information from the website's database."
Re:SONY was breached a bunch of times (Score:5, Interesting)
Actually this problem is typically caused by MBA "beancounters" that do not have any skills or object knowledge with regard to the things they decide. They are also characterized by a hugely inflated ego and self-assessment. What then happens is best described as "save a penny, lose a million". Add to hat that external and independent security reviews are not done or only companies with no ethics are selected ("the customer is always right" is the road to hell in security evaluations) or reports are blatantly ignored. That is how Fuckupshima happened, that is how RSA was compromised (and why are they still in business????), that is why Sony was conceptually unable to even understand what happened to it.
Only solution: Massive corporate liability (They got your account hacked and cannot prove IT Sec due diligence? $1000 per count to the affected customer, unless the customer can prove even higher damage.) coupled with personal liability on the highest level (No external reviews? Glaring security holes not even looked for or ignored? CTO, CIO and CSO go to jail for a few years. If they can prove being blocked by the CEO and cooperate fully in the investigation, 30% sentence reduction, still at the very least 2 years they have to serve, and CEO goes to jail for a long time. All also have their salary and bonuses impounded for the time they did not perform.) Add to that surprise audits from time to time that have much the same impact if glaring security problems are found.
Of course, this will not happen. It would require a honest and competent government to put something like that in place. They do not exist, except occasionally in small countries.
Re:Rookie mistake (Score:0, Interesting)
By not hiring PHP Kiddies out of college, that is how.
PHP deliberately by design makes you write awful SQL-injection vulnerable code. It should be banned.
And don't dare tell me that a good developer knows how to use a language right, having to memorize a trillion exceptions is NOT PROGRAMMING.
PHP is hammering a nail with a sandwich.
Every other language I can think of, EVEN LOLCODE, has a purpose, PHP has none, every other language it tried to copy is already better at the job.
OH BUT ITS OPEN, to hell with open. I'd rather have a competent language than stupid developers who can't even understand what the === operator was supposed to do. That entire thing was embarrassing.
PHP is beyond repair, too many idiots contribute to it now. That is why everyone who helped create it pretty much abandoned all hope.