Sony Kept Thousands of Passwords in a Folder Named "Password"

[steve2470]

http://gizmodo.com/sony-kept-thousands-of-passwords-in-a-document-marked-1666772286



It's been a rough week for Sony execs (million-dollar salaries notwithstanding). And things are only going to get worse. Which would almost be enough to make you feel bad for the poor schmucks in IT—that is, until you realize that they hid their most sensitive password data under the label "Passwords." Go ahead and slam your head against something hard. We'll wait.

The second trove of data snuck out sometime yesterday, and it didn't take long for Buzzfeed to stumble upon the Facebook, MySpace (an ancient form of Facebook), YouTube, and Twitter "usernames and passwords for major motion picture social accounts." Likely due to the fact that they were saved in a huge file called "Password." Which contained even more passwords called things like "Facebook login password." So they would know that that was the password. Because who needs encryption or security or common sense or even the vaguest attempt at grade-school level online safety.

Yep, "Password" should do just fine. Maybe stick a "1" on the end. That'll throw 'em off.

[IDemo]

1. Not to mention storing them all in MS Excel

And shouldn't it be "Passw0rd" with a zero?

[bemildred]

2. Sounds handy. nt

[MineralMan]

3. But, you know, how would anyone get access to that folder, see?

I mean, there's a firewall and stuff. People do stupid things, even corporate IT managers, it seems. Sony was dancing with the prettiest girls at the dance, and wasn't paying attention to the details, it seems.

[steve2470]

6. yep, they got a tad bit arrogant

Given time and adequate resources, ANYTHING can be hacked. AFAIK, the only 100% failsafe solution is to take a server offline. If I'm wrong, someone please correct me.

[MineralMan]

7. Unencrypted password information should never be on a computer

that is connected to any network, and access to that computer should be extremely tightly controlled and limited only to those who have the need to know such information.

That someone could hack into a networked computer with a Password folder should be a terminal embarrassment for their CIO. A firing should be done immediately.

[steve2470]

8. you nailed it nt

[FLPanhandle]

4. Probably thinking "Name it Password folder, it's so obvious that no one will think to look here"

LOL

[Rex]

5. But they used a capital P! That should throw off hackers!

password. password. Why isn't it working!!!

[stevenleser]

9. The stuff you see as an IT Consultant when you go out and look at other companies is mind blowing

No backups, incredibly inadequate backups, zero security, minimal security, no firewalls, firewall device purchased but not configured in any meaningful way, and yes various kinds of inadequate password security.

And all of that is just the beginning.

[ProdigalJunkMail]

10. right there is probably access to loads of others

Database Passwords.xls

Hell, probably some good customer info accessible now!

sP

[Initech]

11. They might as well have the password be 12345.

[Dreamer Tatum]

12. Then clearly they deserved to be hacked and their documents rifled and shared. nt

[Nye Bevan]

13. The trick is to name the folder "grocery list".

Oops, probably shouldn't have posted that publicly.....

[steve2470]

14. It Gets Worse: The Newest Sony Data Breach Exposes Thousands Of Passwords

http://www.buzzfeed.com/charliewarzel/it-gets-worse-the-newest-sony-data-breach-exposes-thousands

original article, kinda must read if you are into this sort of thing.

[Jesus Malverde]

15. Nice..nt