WEB SOLUTIONS: LEAKS AND TRICKS

Computer, Phone Hacks and Tricks|| Info. Tech News, Updates and Leaks|| General Web Solutions

9:24:00 AM

Hacked documents reveal a Hollywood studio’s stunning gender and race gap



Sony Pictures Entertainment, one of the largest film studios in Hollywood, appears to have been the subject of a massive, devastating computer hack. The hack, which came to light last week, included leaked full-length versions of five upcoming Sony Pictures films, along with a trove of sensitive internal documents, and a hijacking of Sony Pictures’ corporate Twitter account.

This morning, I received a link to a public Pastebin file containing the documents from an anonymous e-mailer, and have spent hours poring through some of them. I’ll spend more time in the days ahead. But one interesting tidbit caught my eye: a spreadsheet containing the salaries of more than 6,000 Sony Pictures employees, including the company’s top executives.

Authorities still aren’t sure who is behind the hack, although a group calling itself “GOP” (Guardians of Peace) is claiming credit for the leaks, which they said totaled “tens of terabytes.” Sony Pictures, which hasn’t confirmed or denied the veracity of the leaked documents, is reportedly investigating whether North Korea could be involved. “The theft of Sony Pictures Entertainment content is a criminal matter, and we are working closely with law enforcement to address it,” a company spokesman told the Washington Post.

The salary list is contained in a spreadsheet from the leak entitled “Comp Roster by Supervisory Organization 2014-10-21.” The spreadsheet appears to contain incredibly detailed data about the compensation plans of Sony Pictures employees, including those employees’ names, job titles, home addresses, bonus plans, and current salaries.

Normally, this wouldn’t be particularly enlightening information for anyone but industry gossips and voyeurs. But when I sorted the list by “annual rate,” I noticed something notable: a stark homogeneity among the people earning the most. Based on the spreadsheet (and bear in mind that these numbers are unconfirmed – Sony Pictures didn’t respond immediately to a request for comment), the employees of Sony Pictures with the highest annual rates appear to be nearly entirely white men.

According to the leaked data, there are seventeen U.S. employees of Sony Pictures with “annual rates” of $1 million or more. Of these seventeen, only one – Amy B. Pascal, the co-chair of Sony Pictures Entertainment and chairman of SPE’s Motion Picture Group – is a woman. Pascal’s annual rate is $3 million, according to the spreadsheet, the highest on the list, and the same amount earned by Sony Entertainment CEO Michael Lynton.

The rest of the $1 million-plus club is as follows:




One other observation to make about Sony Pictures’ top-paid executives is that they’re almost entirely white. From some quick Internet searching, fifteen of the seventeen appear to be Caucasian, one (Dwight R. Caines) appears to be African-American, and one (Man Jit Singh) appears to be South Asian. (I’ll update these numbers when and if I hear back from Sony Pictures.) In other words, unless I’m missing something, the upper pay echelon of Sony Pictures is 94 percent male, and 88 percent white.

Under U.S. law, companies are required to disclose the pay packages of some high-ranking executives and board members in their proxy statements. And, of course, you could have looked at Sony Pictures’ public list of senior leaders to get a sense of who’s on top. But the Sony Pictures hack appears to have shed light on something the public rarely gets – an unfiltered look at exactly who’s making what within a large corporation.

Sony Pictures isn’t alone in having a predominantly white, predominantly male leadership, or paying its top executives multiples of what other employees make. But the numbers leaked in the recent hack – assuming they’re accurate – would mean that the top ranks of one major Hollywood studio are perhaps even less diverse than those of Silicon Valley tech companies and large Wall Street banks. After it patches up its security measures, that’s another problem Sony Pictures may have to reckon with.

 


The big news in the past week or so was the Evernote hack, being a user of Evernote I was interested by this one – it seems to be a pretty pervasive hack with user IDs and e-mail addresses being leaked.
Thankfully the passwords are salted hashes, so it’s unlikely they’ll get brute forced any time soon. As a precaution, Evernote forced a password reset on its entire userbase.
Evernote has joined the growing list of companies whose cloud-based services have suffered a serious security breach, announcing over the weekend that it had implemented a service-wide password reset after attackers accessed user information.
Happily, the company’s announcement notes, the passwords accessed were salted hashes, which should mean they last longer than the passwords lifted from the Australian Broadcasting Corporation recently.
The user information accessed by the attackers also included user Ids and e-mail addresses.
Evernote joins the ranks of numerous other large companies which have been hacked recently.

I’m wondering if there’s some serious service based 0-day exploit out there people are leveraging (Apache? nginx? MySQL?) or something else perhaps.
All Evernote users were required to reset their passwords in case the attackers are able to recover passwords from the salted hashed list. The password reset will apply not only to Evernote logins, but to all apps that users have given access to their Evernote accounts.
Other major names to be hit in recent attacks include Apple, Facebook, Twitter and Microsoft, with a Java zero-day behind most of the vulnerabilities.
The company says the attack “appears to have been a coordinated attempt to access secure areas of the Evernote Service”.
The usual suggestion, that users choose strong passwords that they don’t re-use, will no doubt be ignored by a small-but-significant number of Evernote’s customers.
Evernote suggests that no user data was leaked, which is good as people tend to store pretty important information in the app (Bank account details, passport scans etc). There is a chance that they got caught out by the Java bug too – but that seems unlikely.
I wonder which is the next big powerhouse that’s going to go down to a hack attack, I’m hoping by now everyone in the cloud has sane architecture and strong password storage implementations.
Source: The Register

XMPPloit is a command-line tool to attack XMPP connections, allowing the attacker to place a gateway between the client and the server and perform different attacks on the client stream.
The tool exploit implements vulnerabilities at the client & server side utilizing the XMPP protocol.
The main goal is that all the process is transparently for the user and never replace any certificate (like HTTPS attacks).
Features
  • Downgrade the authentication mechanism (can obtain the user credentials)
  • Force the client not to use an encrypted communication
  • Set filters for traffic manipulation
Filters that have been implemented in this version for Google Talk are:
  • Read all the the user’s account mails
  • Read and modify all the user’s account contacts (being or not in the roster).
You can download XMPPloit here:
XMPPloit