Sony hackers call for ban on controversial comedy film

[Aerosol]

A NOTE, REPORTEDLY FROM THE GROUP of hackers currently assaulting Sony Pictures, has denied reports of employee blackmailing, and has challenged the authorities and told the firm to not release controversial comedy The Interview.

The note has been published to Github and we cannot confirm that it is from the Guardians of Peace group. But that is who it claims to be from.

"We are the GOP working all over the world. We know nothing about the threatening email received by Sony staffers, but you should wisely judge by yourself why such things are happening and who is responsible for it," it said.

"We have already given our clear demand to the management team of Sony, however, they have refused to accept."

The message accuses Sony of concentrating on tracing the hacker group when it should be complying to its demands.

It suggested that Sony and the FBI are wasting their time, and advised against the release of The Interview, which is described as an act of "terrorism".

"It seems that you think everything will be well if you find out the attacker, while not reacting to our demand. We are sending you our warning again. Do carry out our demand if you want to escape us," it added.

"And stop immediately showing the movie of terrorism which can break the regional peace and cause the War! You, Sony & FBI cannot find us. We are perfect as much. The destiny of Sony is totally up to the wise reaction & measure of Sony."

North Korea has officially dismissed suggestions that it is directly behind the attack on Sony Pictures, but did concede that it could be the work of one of its glorious supporters.

In case you missed it, Sony Pictures is currently being gutted by a person or persons unknown. The hackers have threatened the firm, leaked its remake of Annie, and posted Sylvester Stallone's social security number online.

Sony is looking into the situation and everyone else is staring at it agog.

The official North Korean News Agency - sorry, the glorious official North Korean News Agency - has posted its official response to what the government has called "rumours".

"We do not know where in America Sony Pictures is situated and for what wrongdoings it became the target of the attack, nor do we feel the need to know about it," said the agency.

"What we clearly know is that Sony Pictures is the very one which was going to produce a film abetting a terrorist act while hurting the dignity of the supreme leadership of the Democratic People's Republic of Korea [DPRK] by taking advantage of the hostile policy of the US administration towards the DPRK."

This, it added, could have inspired a glorious citizen to react, because, as it has already said, Sony is producing a film that makes a monkey out of its supreme leader.

"The hacking into Sony Pictures might be a righteous deed of the supporters and sympathisers with the DPRK in response to its appeal," it added, while suggesting that its closest neighbour may be fanning the rumour fires.

"What matters here is that the US set the DPRK as the target of the investigation, far from reflecting on its wrongdoings and being shameful of being taken unawares.

"And the South Korean group, keen on serving its master, groundlessly linked the hacking attack with the DPRK and floated the 'story about the north's involvement', an indication of its inveterate bitterness towards its country fellowmen."

The so-called GOP hacker group broke into Sony's computer system in November and leaked movies and employee information, making it one of the biggest ever cyber security breaches. Now it has begun threatening staff.

"We understand that some of our employees have received an email claiming to be from GOP," a Sony Pictures spokesperson told CNN. "We are aware of the situation and are working with law enforcement."

The FBI has been informed of the emails and is investigating the "person or group responsible for the recent attack on the Sony Pictures network".

Earlier this week it was revealed that Sony didn't make it too difficult for the hackers to breach its systems, and held passwords in a file named 'passwords'.

The hack is playing out badly for Sony and not a day goes by when we are not treated to another revelation from leaked documents or hushed insiders.

The password file included log-ins for services like Facebook and something called MySpace - no, us neither - and suggests that someone at Sony needs a lesson in security, or at the very least, a lesson in file-naming.

This is not the end of revelations that elicit a 'facepalm' response, as we have also learned that Sony has shed a load of social security numbers, including those belonging to Sylvester 'Rocky/Rambo' Stallone and some 47,000 others.

Data management software firm - natch - Identity Finder, trawled through the documents and found details from as far back as 1995. Around a third of social security numbers belonged to current or former Sony employees.

"As we have seen from the myriad data breaches this year, every organisation is vulnerable to an attack," said the firm in a statement.

"Security technologies are an important shield, but minimising the target and reducing the footprint of sensitive data is more critical than ever."

Yesterday security researchers from Trend Micro picked apart malware described in a recent FBI malware warning, and traced it back to the attacks on Sony.

The firm analysed the FBI document and was able to identify the code in question, which it has called BKDR_WIPALL.

Before this image was found the team was not so sure, and declined to link Sony and the attack.

"TrendLabs engineers were recently able to obtain a sample of the 'destructive malware described in reports about the FBI warning to US businesses last December 2'," said the first report from the firm.

"As of this writing, the link between the Sony breach and the malware mentioned by the FBI has yet to be verified."

That did not last long, however, and after some additional probling the researchers pulled out a plum of a piece of evidence.

"This appears to be the same wallpaper described in reports about the recent Sony hack last November 24 bearing the phrase ‘hacked by #GOP'," they wrote about the image.

"Therefore we have reason to believe that this is the same malware used in the recent attack on Sony Pictures."

Sony is still in something of a denial stage, and in a kind of Luddite paradise, and is low on comment about the situation.

The Guardian has seen an internal memo from the company that speaks of the grave situation and how it affects everybody.

"It is now apparent that a large amount of confidential Sony Pictures Entertainment data has been stolen by the cyber attackers, including personnel information and business documents," Sony said, according to the report.

"This is the result of a brazen attack on our company, our employees and our business partners. This theft of Sony materials and the release of employee and other information are malicious criminal acts."

The high-profile hack is turning into a saga, with reports now claiming that the firm's PlayStation servers are being used to distribute data pilfered during the attack.

That's according to security researcher Dan Tentler and a report at Forbes, which claims that Sony PlayStation servers are being used to distribute a 27.78GB archive potentially containing sensitive data swiped from Sony Pictures computers.

Tentler examined the data being shared, and found that some of the hosts contained SSL certificates straight from Sony.

It's unclear what exactly is going, and Sony has yet to comment. We'll update when we hear more.

This revelation comes a day after the FBI threw its hands into discussions about the hack, at the same time as it emerged that North Korea could be to blame.

The FBI sent out a 'Flash warning' to US businesses with the request that they do not share it with the papers.

Fortunately for people like us, not everyone was listening and one outfit ran to Reuters with the information.

Reuters reports that the document fingers North Korea for an assault on an unnamed outfit in the US. North Korea has since refused to deny involvement in the hack.

The country is reportedly miffed about an upcoming Sony Pictures film about leader Kim Jong-un, called The Interview, which has already caused the North Korean government to complain to the United Nations and the US.

Reports claim that, when asked whether it was involved in the attack, a spokesman for the North Korean government replied: "Wait and see."

While some are clearly not paying attention, the FBI has warned businesses to watch out for attacks that look to separate them from their hardware and communications systems.

"The overwriting of the data files will make it extremely difficult and costly, if not impossible, to recover the data using standard forensic methods," the report said.

The real nut of this would be the actual report, but the FBI has told us in the past that, while it shares such information with businesses, it does not provide the same service to journalists.

While we wait for the agency to respond on this occasion we recall a time in October when we asked for access to a similar document with a Chinese-flavoured warning.

"The FBI's recent notification to our industry partners provides recipients with information they can use to help determine whether their systems have been compromised by these actors, and provides steps they can take to mitigate any continuing threats," it said at the time.

"The FBI continues to aggressively investigate, disrupt and dismantle criminal networks that pose a threat in cyberspace."

Sony Pictures is into its second week of being held in the grasp of hackers with a motive.

The firm is being held to a kind of ransom by a hacker group called GOP and is facing down threats to release information that it would reportedly rather not release.

On top of this, Sony Pictures has lost control over some social media accounts and internal communications systems.

Now some of its movie releases, including Fury with one Brad Pitt, have been leaked in a viewable DVD screener format, suggesting that the hackers have entertainment industry crown jewels, i.e. actual movie content.

TorrentFreak, which ranks the most downloaded movies on BitTorrent on a weekly basis, finds that Fury, a new entry to the list, is the fifth most popular item already.

Around five titles from the Sony camp are in the wild, including a remake of the Annie musical. You have been warned.

According to other reports, Sony has hired the services of security firm Mandiant, which is part of FireEye, to aid in the clean up and, presumably, forensic work.

We have asked both parties to comment on this, or confirm the arrangement. Mandiant declined.

Source