Attacks mount as hacker group says it looks to embarrass Sony Sony Ericsson Canada today confirmed that it was hit by a security breach that allowed about 2,000 customer records, including first name, last name, email addresses and the hash of encrypted passwords to be illegally accessed.No additional personal or credit card information was compromised, the company said in a statement to the IDG News Service this afternoon.Earlier today, The Hacker News (THN) had reported that it received a tip from a Lebanese hacker who had breached the site and accessed email addresses, passwords and names of thousands of users of Ericsson’s Eshop online store in Canada. The information was then posted on Pastebin.com. The Ericsson breach is one of two reported today. According to THN, another group called LulzSec accessed a database used by Sony BMG Japan and posted its contents — minus usernames and other personal information — on Pastebin.com Lulz Sec also claimed to the Hacker News site that it has discovered more vulnerable Sony BMG databases. The news site posted links to two pages on Sony Music’s Japanese Web site that it said contain the SQL injection vulnerabilities used to break into the Sony database.Sony did not respond to requests for comment on the reported hacks. Chester Wisniewski, senior advisor at security firm Sophos, said it isn’t clear whether the hackers could inject data into the vulnerable Sony BMG Japan database or simply access its contents. “If they are able to alter the records, this could be used to insert malicious code that could be used to compromise people browsing the [Sony BMG Japan] site,” Wisniewski wrote in a blog post today.The latest attacks were said by the Hacker News to be enabled by SQL injection flaws on Sony websites. THN editor Mohit Kumar told Computerworld in an email that the Sony Pictures’ site in Japan may have also fallen victim to a hacker attack, while another of the company’s sites in Europe contains the same flaw that allowed hackers to break into the other Sony sites. That site has not been reported as being hacked, but hacker groups are actively discussing breaking into it, he claimed. The recent breaches appear to be attempts to humiliate Sony.“This isn’t a 1337 h4x0r (elite hacker in Leetspeak),” Lulz Sec noted in a message posted on Hacker News. “We just want to embarrass Sony some more. Can this be hack number 8? 7 and a half,” the message noted in apparent reference to the series of recent intrusions at Sony.Sony sites have been hacked several times in several weeks, which analysts say shows that the company’s online networks are very porous. The biggest of these attacks by far happened in mid-April, when attackers broke into Sony’s PlayStation Network and Sony Online Entertainment and compromised personal data of some 70 million account holders and another 12 million or so credit and debit card holders.Those attacks caused Sony to take down PSN and SOE for several days while it worked with three external security firms to find and fix the security holes. About 10 days ago, Sony announced that it had fixed all problems with its PSN and SOE networks and partially restored those services.Since then, there have been at least five publicly known hacks of Sony web sites around the world, including the two reported today. Two of the attacks were reported last week, while another one against Sony BMG Greece was reported yesterday. According to Kumar, extracting Sony BMG Japan’s database would have been “just a kid(s) game” for anyone using an automated SQL injection tool such as those used by penetration testers.All that a would-be hacker would need to do is put one of the URL’s into the SQL tool and have it analyzed, Kumar claimed. “The tool will extract whole database (sic) with one click,” he said.The important thing for Sony is to find and fix such vulnerable links quickly, Kumar said. “Hacker News motive is to alert Sony this time,” because several hacker groups are actively looking for ways to break into other Sony sites as well, he said. “We can’t stop hackers, but can alert Sony about holes in the rest of their sites,” he said. “All these hackers (are) doing free of cost auditing for Sony. So Sony should take benefit from this” and secure its systems, Kumar said.Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar’s RSS feed . His e-mail address is jvijayan@computerworld.com. Related content news analysis Apple earnings: About that iPhone 'slump' in China Based on information from Thursday's earnings report, it seems that data pointing to an iPhone slump in China were over-baked. By Jonny Evans May 03, 2024 9 mins iMac iPhone Apple news Microsoft begins to phase out ‘classic’ Teams Microsoft is encouraging Teams customers to move to the new, faster version of the collaboration app; the older version will be switched off next year. By Matthew Finnegan May 03, 2024 3 mins Microsoft Teams Collaboration Software Productivity Software news analysis Apple confirms it will open up the iPad in Europe this fall The latest efforts to comply with Europe’s Digital Markets Act mean developers can offer to side load apps to both iPhones and iPads in the EU. Apple has also taken steps to improve what it offers to smaller and non-commercial developers in the By Jonny Evans May 02, 2024 6 mins iPad Apple Mobile Apps news Udacity offers laid-off US workers free access to its courses for 30 days Sign-ups will be available over the next 30 days By Lucas Mearian May 02, 2024 4 mins Technology Industry IT Jobs IT Skills Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe