IT Security: Analysis of Equifax and PlayStation Network Cyber Attacks

Desklib provides past papers and solved assignments for students. This report analyzes the Equifax and PlayStation Network cyberattacks.

MITS 5004
IT SECURITY

Contents
Introduction................................................................................................................................3
Part A.........................................................................................................................................4
1..............................................................................................................................................4
2..............................................................................................................................................6
Part B..........................................................................................................................................8
1..............................................................................................................................................8
Conclusion................................................................................................................................11
Resources.................................................................................................................................12

Introduction
The following assignment is the solution to the Assessment 2. It has two sections Part A and
Part B, with Part A having two questions. The first question in Part A contains the report of
the famous Equifax cyber attack incident, having all the minor and major details about the
breach. The second question contains the justification of considering the asynchronous input/
output activity as a problem in memory protection. The one and only section in Part B
contains another report about another cyber attack happened in 2011 inside the Sony
PlayStation Network along with the ways this breach in could have been avoided.

Part A
1
The Equifax Data Breach Incident
The Equifax data breach is one of the most famous and largest security breach, this century
has seen. This breach was reported in September, 2017. Equifax is defined as one of the
client’s largest credit reporting organisations in the USA. It was reported that their security
has been breached and an estimate of 148 million people’s sensitive information was
compromised. This breach involved the loss of names, phone numbers, home addresses,
security numbers, birth dates, and driving licence registration numbers. And also credit card
details of approx 209000 clients were also compromised. This breach covered such a large
amount of data and considering the sensitivity of that data the Equifax breach is
unprecedented (Warren, 2018).
On 7th September, 2017, Equifax claimed that the breach was not from their core databases
for client credit reporting, but it was from the organisation’s U.S.A. online conflict portal
application. The entire vulnerability which led to the security breach was Apache Struts CVE
– 2017 – 5638. It is a famous framework to create web applications on Java which was
controlled by Apache Software. On 7th March, 2017, the Apache Software issued a patch
being cautious about the vulnerability. On 9th March mail was delivered to the Equifax
administrators in order to apply required patch. The Equifax security systems were scanned
by the authority and there was not a single vulnerability found and so they left the
vulnerability as un-patched. On 29th July, 2017 the vulnerabilities were patched, as the
security team found some abnormal network traffic. The next day there was some further
suspicious activity detected and the Equifax took down their online services. Three days later
they hired Mandiant, a cyber-security company, to investigate resulting in the announcement
of further 2.5 million consumers’ data being breached, making the overall number to rise to
145.5 million. Later the Equifax announced that not just the USA consumers but the
consumers from Canada and UK also faced the same, the number was about 700000 citizens
here (“Identity Theft | USAGov,” 2019).
There were a lot of actions happened after that, whether it was investigation by federal
government, or foreign governments. The complete timeline of the events that followed along
with the inception of the threat is as follows:

 7th March 2017 – Apache Software announced the vulnerability and created a patch.
 8th March 2017 – The department of Security contacted Equifax, notifying them about
the vulnerability.
 9th March 2017 – The Equifax administrators received a mail to patch that Apache
vulnerability.
 15th March 2017 – The Equifax security team ran scans and did not find any
vulnerability in their online services.
 13th May 2017 – The hackers started to access sensitive identity information.
 29th June 2017 – The Equifax found unusual traffic in their dispute website. And then
they applied the vulnerability patch.
 30th June 2017 – The company experienced some more unusual activities and took
down their web application.
 31st June 2017 – The CEO was informed about the suspicious activities happening.
 1st August 2017 – Stocks of about 1.8 million dollars were sold by senior Equifax
staff.
 2nd August 2017 – The Equifax hired Mandiant to investigate their security conditions.
 7th September 2017 – The Equifax reported the public about the security break in on
Twitter.
 11th September 2017 – USA senators sent a letter to Equifax asking them to clear their
position about the Consumer Finance Protection Bureau codes for limiting the use of
pressed arbitration clauses (Kristin, 2017).
 13th September 2017 – The Senator, Mark Warner sent a letter in the name of FTC
Chairwoman to open some investigation about the breach.
 15th September 2017 – Two Executives form Equifax resigned.
 15th September 2017 – Equifax released press information that it was Apache Struts
CVE – 2017 – 5638 vulnerability.
 27th September 2017 – The interim CEO of Equifax issued a free service for people to
moderate their credit locks.
 12th October 2017 – It was found out by various security based researchers that the
Equifax’s website contained some false or dishonest download links to trick the users
to download malware which displays some unwanted advertisements online.
 31st January 2017 – the Equifax issued another free service for people to get their
credit reports in a better way.

 1st March 2018 – The Equifax announced about further, 2.4 million, consumers being
affected by losing their driving licence information getting to the total of 148 million
consumers being victimised so far.
 28th March 2018 – The Equifax announced Mark Begor as their new CEO (epic.org,
2017).
This whole breach was a result of carelessness of the security team at Equifax. And later it
was all amended by the following:
 Allowing the consumers to freeze their credit cards when needed.
 Improving the breach notification act. This would involve the consumers to be
acknowledged about any breach and data loss within 72 hours of the event.
 Limiting the usage of security numbers from private companies.
 Enacting the privacy legislations and maintaining an Information protection agency
(Gressin, 2017).
2
The data protection schemes such as paging and base / bound are a way to moderate and
control the way data is accessed between programs and processes.
The base/ bounds registers protect the data stored in memory to be used only by a single
writing process and ceasing another process to read the same data meanwhile. The base
registers are loaded when the program is made to run, with the physical address of that
program or process and from where it began. And the bound registers usually do not cease
the programs when they are out of their limit but it can be checked if the program has crossed
the boundaries by using the upper bound register, which enables the system to check again if
any program has exceeded its scope. Hence the base & bound registers give an important
ability in context switching. And in this way the users programs are not intervened with other
programs used by other users and not only that the user can also relocate the code and the
data individually (Wentzlaff, 2018).
The paging process enables the operating system to get data from secondary storages in
uniform sized blocks called pages. It is one method for writing and reading the data in
secondary storage for the usage of it in primary storage or the main memory. The size of a
process is calculated in terms of pages. Paging not only reduces the external fragmentation, it
also is quite simple to be implemented. It still gets affected by internal fragmentation. And

due to the paging table it needs extra memory and hence needs high storage in Random
Access Memory (Rouse, 2018). Paging allows the physical space of address in a non -
contiguous process. The mapping that happens in this process from the virtual address to the
physical address is taken care by the MMU (Memory Management Unit). The blocks of the
memory of physical address are divided into same sized units called the Frames whereas the
same when happens to the logical address the block is called as pages (Kumar, 2018).
The asynchronous activity unlike the synchronous one continues to be executed in the
background or say backend. Such as, when a user is trying to access the database while the
asynchronous activity is going on, the process of this asynchronous input / output activity
does not stop or wait. And so in the asynchronous input / output activity if one process tries
to access some data and also modify it in the memory meanwhile another process is using it,
the system allows the program to do so. Thus it makes the program running in the
background, using that data and information may suffer a change in the data it is operating
on, this can be explained as the overwriting of data or information from the paging and base /
bound registers (Memory). This intrusion can be prevented by putting some checks on the
data access and management criteria so that the data may not suffer any sudden and
unexpected manipulation.

Part B
1
On 19th April, 2011, the world known brand Sony was encountered an infiltration in their
PlayStation network because of which they lost identifiable data from about 77 million user
accounts to hackers. This attack is counted as one of the biggest security attacks the world
has ever seen. The response taken by the Sony is still criticised by consumers, politicians and
of course security experts worldwide. Later the same month, Sony Inc. closed or shut down
the online (PSN) PlayStation Network. At that time about 77 million users were there across
the globe using the PlayStation Network. And for a week the organisation failed to instruct
the PlayStation Network users about the shutdown of the system just a message post was
there on the Sony’s website telling that the organisation has suspected some theft has been
broken in causing them to lose the PlayStation Network users’ sensitive information. The
data which was stolen included login details, client names, home addresses, birth dates, e–
mail addresses along with network passwords. And later another mail was received by the
users that their credit card information might also have been compromised. The Sony Inc.
kept the PlayStation Network shut for about a month till it was resumed on 14th May 2011
(Bonner, 2012).
The whole world was criticising the Sony Inc. for informing about the breach a week later.
And because of all the allegations and its image in front of the world being deserted the
organisation decided to cut the Chairman’s salary by a margin of 15 percent.
According to security experts it was shared that there was no need to blame to hackers when
the organisation’s internal stability is not maintained. They said that the organisational
complexity & lack of some efficient security based support in the entire board level was
probably the major mistake or blunder Sony did which led to the attacks on the PlayStation
Network. Away from all these, the Sony Inc. called it a great cyber attack in their server. The
method by which the hacker would have got into the server was never made clear but yet
there was reported to be some encryption about PlayStation 3 which got cracked. This crack
would cause more software piracy easily but it also might have been the reason to open a
wide gate for hackers to attempt to get the hack done which happened (VentureBeat, 2011).

The famous group of hackers, the anonymous took no responsibility of the hack but they
criticised the organisation over the legal threats it made to the people who used that crack.
The breach affected two components of the Sony networks – first was the (PSN) PlayStation
Network and the other was Qriocity, its paid music service. Sony Inc. dropped some hints
regarding the refund for users who lost their PlayStation Network accounts, but it wasn’t
confirmed for long. Experts of security in the market said that the information leakage was
not much big, yet including the credit card details it was proven to be one of the biggest
breach-ins any company has ever experienced. They said the information being stolen would
be worth of tens of millions in the back market (Stuart & Arthur, 2017).
Sony being caught alleged of delaying the informing did also explained the reasons in
Entertainment Europe magazine. They said that there was a difference between the timing
when they identified the intrusion and he time when they got to know that users’ data have
been compromised. They said that they learned about the intrusion on April, 19, and they shut
their services down right away. To provide more information about the breach the Sony Inc.
put a FAQ for users to ask and enquire whatever they wanted about the breach.
The reason behind the shut down and the hack is not clear till today, as the Sony Inc. is one
world leading organisation in digital industry and they tended to keep their lip tight in the
matter. There were only assumptions, well calculated and evaluated assumptions made by the
great minds. One possible reason was that the Anonymous must have learnt about some
weakness occurred in the PlayStation Network’s security and later they must have passed that
information to some other hackers, and then those hackers might have attempted an attack by
SQL Injection. Another possible reason could be the release of the Rebug, one custom
PlayStation 3 firmware that generally turns PlayStation 3 into some developer unit activating
some features that usually a user can not access. Most importantly, the Rebug provides the
user trusted access into Sony’s internal network for developers. And once such an intrusion is
happened it is easy for the intruder to hack a lot of things from the network (Anthony, 2011).
The ways in which the attack could have avoided would have been very far clearer if the
reason behind the attack and the way of attack was clear. But since there was no sign of
information about it, there are only some implications which are thought of as to avoid such
attacks, they are –
 Email – all the mails going inside the PSN must have been encrypted. As passwords
and security numbers are not the only sensitive information.

 Training the employees – Sony should have taught each of their employees about the
best and secure practices.
 IT Departments – they also needed to be sharpened by conducting frequent vigilance
and scans to kill viruses.
 Updating – security requirements change weekly. Technologies like network intrusion
detectors and penetrating tests could have helped to build a better security.
 A contingency plan – Sony should have been more alert about breaches and the ways
to handle them (Reidel, 2018).

Conclusion
The above assignment has been completed with all the required solutions. The report in Part
A is containing the incident of Equifax cyber break in happened in 2017. The learning from
this incident was to involve the private third parties as less as one can into their organisation.
The next section contains the reasons why asynchronous input/output activity is considered as
problem in memory protection schemes. And the last section contains a report on the 2011
cyber attack on PlayStation Network, which taught some do’s such as regularly updating, or
having a contingency plan.

Resources
Anthony, S. (2011, June 17). How the PlayStation Network was Hacked - ExtremeTech.
ExtremeTech website. Retrieved from: https://www.extremetech.com/gaming/84218-how-
the-playstation-network-was-hacked
Bonner, L. (2012). Cyber Risk: How the 2011 Sony Data Breach and the Need for Cyber Risk
Insurance Policies Should Direct the Federal Response to Rising Data Breaches Part of the
Internet Law Commons, Legislation Commons, Privacy Law Commons, and the Science and
Technology Law Commons Recommended Citation Cyber Risk: How the 2011 Sony Data
Breach and the Need for Cyber Risk Insurance Policies Should Direct the Federal Response
to Rising Data Breaches (p. 40). Retrieved from
https://openscholarship.wustl.edu/cgi/viewcontent.cgi?
article=1581&context=law_journal_law_policy
epic.org. (2017). EPIC - Equifax Data Breach. Epic.org. Retrieved from:
https://epic.org/privacy/data-breach/equifax/
Gressin, S. (2017, September 8). The Equifax Data Breach: What to Do. Consumer
Information. Retrieved from https://www.consumer.ftc.gov/blog/2017/09/equifax-data-
breach-what-do?utm_source=slider
Identity Theft | USAGov. (2019). Usa.gov. Retrieved from https://www.usa.gov/identity-
theft?utm_campaign=%2B%20Money%20and
%20Shopping&utm_content=60372677&utm_medium=social&utm_source=twitter
Kristin. (2017, September 9). Identity theft protection following the Equifax data breach |
Consumer Financial Protection Bureau. Consumer Financial Protection Bureau. Retrieved
from https://www.consumerfinance.gov/about-us/blog/identity-theft-protection-following-
equifax-data-breach/
Kumar, V. (2018, February 12). Operating System | Paging - GeeksforGeeks. GeeksforGeeks
Retrieved from https://www.geeksforgeeks.org/operating-system-paging/