Assessment of Data Breaches: Timehop and Sony Case Studies (MITS 5004)

Desklib provides past papers and solved assignments for students. This report analyzes the Timehop and Sony data breaches.

MITS 5004
IT SECURITY
Assessment 2

Contents
Introduction................................................................................................................................3
Part A.........................................................................................................................................4
Question 1..............................................................................................................................4
Question 2..............................................................................................................................6
Part B..........................................................................................................................................8
Conclusion................................................................................................................................11
References................................................................................................................................12

Introduction
In the following assessment, the report in part A (1) is based on the hack that happened in
2017 – 2018 in the Timehop named application. The report covers the reasons, the effects and
the after effects of the breach. Next in part A (2) the synchronous activity’s impacts have
been discussed with a fine detailing of how the base and bound registers and paging work and
then how are they affected by the activity. And at last a report on the popular security breach
incident, the Sony’s PSN outage is made. This report covers all the details of the incident and
the ways Sony could have avoided the breach are discussed.

Part A
Question 1
A mobile application named Timehop which surfaces older social media logs from the
current day but previous or past years, announced that they have experienced a security break
in which had affected the entire database of them having more than 21 million people as
users. It was found out that the whole bunch did not suffer the affect at same extent. Timehop
reported that some hacker accessed into their infrastructure and successfully stole information
about the users including emails, usernames, access keys and telephone numbers. Timehop
reported that since not every other user put their phone numbers or email addresses in their
information section on the application, the attack was not complete. Yet, 22 percent of the
total users (21 million in number) i.e., about 4.7 million had their phone numbers put in the
information in their account and also not all users were having their real names as their
username. But still, the access keys of all the users, the whole 21 million, were stolen. The
access keys of those users were connected to their other social media profiles from where the
Timehop application would take the information about older images and posts. The
application’s organisation said that they have de – authenticated each and every other account
in their database so as to cut the hacker off supplies of getting in to other social media
accounts like twitter, Facebook, Instagram, Messenger etc. And later the organisation said
that they are working with experts in security about the event that happened and to secure
their infrastructure.
According to the reports from investigation, it came out that the intrusion actually happened
on 19th December, 2017. It was when some hacker got the access to an administrator account
in Timehop’s cloud structure. Timehop said that they failed to secure the admin account even
after having a multi – factor authentication mechanism. The hacker got into the account on 4
different days meanwhile December 2017, March 2018 and June the same year during this
time the hacker did the reconnaissance processing. This intrusion was undetected till 4th July
2018, and at that date the hacker started de – filtrating the Timehop’s database. According to
the reports of Timehop, they cut the hacker’s authorisation access off after 2 hours and 19
minutes of the act (Ghosh, 2018).

On 10th July 2018, the Timehop updated a list of details regarding the breach’s investigation.
They updated a timeline of the incident and made it out to the public to see what the hacker
did get from the database.
Combination types of
Personal data
Number of records breached
(in descending order)
Number of GDPR breached
records
Email address and Name 18.6 million 2.9 million
Name and Date of Birth 14.8 million 2.5 million
Email address, Name, Date of
Birth
13.6 million 2.2 million
Name and Phone Number 3.7 million 198000
Name, Date of Birth, Phone
Number
3.6 million 189000
Email address, Name, Phone
Number
3.4 million 181000
Email address, Name, Date of
Birth, Phone Number
3.3 million 174000
(Cimpanu, 2018)
Timehop’s well organised and maintained logs helped them out to discover that a hack was
happened and how the hack was happened. The hacker as reported by the organisation tried
several times to get in the system and dig something out but he or she whoever it was waited
till 4th of July, which was a holiday, to make his / her move. On 5th July the hack was affirmed
and was reported to the various regulatory agencies. Before the duration of 72 hours in which
a company has to inform the users about any break-ins, the Timehop consulted Facebook,
Google, and Twitter in order to confirm any use of Tokens. Tokens allow the application to
gain access to other social media accounts of a user. On the same day the company
investigated if the details were dumped or sold online to some party or not and it brought a
good news as no such activity had happened (Newcomb, 2018).

Even though the Timehop handled the break in very well, there still were some lessons it
taught the company. The ways through which such acts could be avoided were as follows:
 Practising security hygiene – this involves regularly conduction mock drills for
security purposes. A target would be attacked and the counter attack must be planned
according to the severity of the attack.
 Having Strong passwords – Strong passwords are mandatory. A strong password
should contain a mixture of alphabets, numbers and special characters.
 Regularly changing the passwords – the passwords once created no matter how
strong they are must be changed regularly. This is needed to avoid any breach caused
due to password leakage.
 Multi factor authentication – this is another must in today’s era. The passwords
should be there but with that some other credentials too should be added to
authenticate one’s originality (Chin, 2018).
Question 2
Paging is one storage mechanism which is used to dig out processes from secondary storage
to put in the main memory. The processes are put into the main memory in the form of pages.
The major idea for paging is for dividing each and every process into pages. And the main
memory is also gets divided into units called frames. A single page of a process occupies the
space of one frame from main memory. Usually the pages can find any suitable location to be
placed inside the memory but their priority is to look for contiguous holes or frames first.
These pages of processes are taken to the memory only if it is required to be put otherwise the
pages do reside inside the secondary storage. The size of frames and pages depends on the
operating systems, but inside a single system the frames and the pages are uniform in size.
And since the pages are needed to be mapped with the frames, they both are of same size.
The paging process allows the process to be stored at different locations inside the memory
by breaking down to pages and hence is called a non – contiguous allocation of memory. This
solves the issue of exterior fragmentation. Even though the paging may avoid exterior but it
suffers from interior fragmentation. There is always a need of maintaining a page table which
consumes a lot space (Singhal, 2019).
The base and bound is set of two registers which are aimed at relocating a process inside a
range of all possible addresses. The base provides the address corresponding to the zero

virtual address and the bound provides the highest permissible virtual address. At every
storage reference, the virtual address is looked up with the bound register and then is added
with the base register to get a physical address. And in case the process exceeds the bound
range the operating system falls into a trap. Each process in the system has a entire private
memory and the size of it is determined by the bound register. The processes are kept isolated
from one another in this way. In the case of a process being loaded there is no need of address
relocation and that process including other processes too has their own bound and base values
saved inside the control block of the process (Ousterhout, 2013).
Now, the synchronous activities does not allow the Operating system to run multiple
processes at a same time by keeping one in the front and running the others in backend but
the asynchronous activities allows the operating system to do so. As the synchronous
mechanism does not allows so, it is more efficient in utilising the memory efficiently, but the
asynchronous activity falls into the trap of ruining the processes by manipulating the data or
its location. This leads to conflict between the data which is read by one process and the same
data being written or overwritten by another process. This way paging is harmed in the
asynchronous process as the pages from different processes when are allocated the same task
or to perform different tasks on the same data, the data experiences variation as disturbances
in such cases. If taking the base and bound registers into account here the asynchronous
activities affects their functioning too. For example, if some information is there and two
different processes are in line to access it, then according their base values they will access it,
but because of the asynchronous activity the data would be undecided to fall into which limit
i.e., bound by value may be confused. Hence, asynchronous event being an independent
activity causes the deterioration of data usage and its protection (Oracle, 2019).

Part B
On 26th April 2011, Sony broke a bad news. The news was that there had been a security
breach in their network which had caused a compromise of personal details of millions of
users worldwide. It was the largest breach in its kind to hit a gaming corporation. This breach
led to the shut – down of the PlayStation server for more than a week and the online services
for more than weeks.
It all began when a world known group of hackers called the Anonymous got their interest in
Sony. They were bombarding the Sony’s servers with several DDoS attacks (Distributed
Denial of Services). They already had brought the PlayStation Network to their knees many
times in April. The reason behind this was the Anonymous was upset because of the “wholly
unforgivable” legalised actions on the PlayStation 3 crack founder named George Hotz.
According to the Anonymous, the info that Hotz discovered – the ways to play pirated games
and the ways to run the software Homebrew – was leaked into public domain, which was a
favour Hotz did to Sony by telling them their weak points in detecting a loophole. The
Anonymous stopped their attacks the network in the name of hurting the users only, the
gamers. However, a few weeks after that the PlayStation network was attacked again and this
time things seemed different. After two days of this attack the Sony itself took down their
online services for PlayStation network. They posted a message on their wall “Our support
teams are investigating the cause of the problem, including the possibility of targeted
behaviour by an outside party. Our engineers are continuing to work to restore and maintain
the services, and we appreciate our customers' continued support”. This was the day – one of
the network outage and for another couple of weeks (three weeks) the PlayStation Network
was off. At the first day Sony informed the users that they would bring the network online
within forty eight hours but the next day they said that there was intrusion from some external
party and they are conduction a thorough investigation against it in order to bring the
PlayStation Network back online with more security and fluency. And so far the company did
not reveal any information about the personal details of users being compromised. And then
finally on the evening of 26th March 2011, Sony announced the real deal, about they had lost
the personal information of about 77 million users worldwide (Phillips, 2016). The personal
details in the PlayStation profile data involved the usernames, email addresses, home
addresses, passwords, birth dates and the real names the users. Along with that the billing

addresses, purchase history too were at a risk of being compromised. The users around the
world were all stormed out about the news and were mad at the corporation for keeping it to
them for a week and not disclosing it the day it happened or within seventy two hours of the
breach. The PlayStation users thought of changing their passwords immediately but they
could not as the network was brought down by the Sony itself. Within a day, there were
lawsuits filed against the Sony Inc. For a few more days the investigation continued, the
involvement of the Anonymous was doubted. The United Kingdom regulated their
investigation too. The Sony Inc. representative Sir Stringer drafted a letter for apologising to
the public. He wrote, “Dear Friends, I know this has been a frustrating time for all of you,"
"To date, there is no confirmed evidence any credit card or personal information has been
misused, and we continue to monitor the situation closely.” Out of the 77 million users of
PlayStation Network only 10 million had posted their credit card details for renting and
purchasing content (Baker, 2011).
The reason of the breach is known to be the possession of an administrator’s personal
computer by the hacker. This provided him the rights to gain any sensitive information
related to the users. This could have been achieved by sending some malicious software via
mail to the admin which would have got installed into the system. Sony never revealed whom
they were working with in order to deal with this situation. There were a lot of theories put in
front to guess the real hacker behind the incident, but there were only assumptions made and
till date there is still no surety about who was the mastermind behind the hack of the century.
There have been guesses such as the Anonymous, but they were never into computer crimes
and they also refused to take the responsibility of this attack. Another guess was the Chinese
hackers, who were known to be very much sophisticated, but stealing the data of gamers
would not cause much benefit to them. And many other assumptions were made (Poulsen,
2011).
The face behind the attack is still unknown but the ways in which the attack could have been
avoided were evaluated in due time to avoid any future repetitions. The following were the
measures:
 Proper encryption of passwords and sensitive information – it was believed that Sony
ignored this important aspect that’s why the data got leaked so easily.
 Assigning a position to look over security matters

 Introducing latest security technologies like automated monitoring systems, more
advanced firewalls etc.
 Mock drills could have been planned out in the organisation to get ready for any
security breach
 Meeting with latest standards for security requirements such as regular updates, latest
software, latest devices (Ogg, 2011).

Conclusion
This assessment is completed with the detailed explanation of each section. This assessment
has provided an insight to the cyber security aspects the generation needs to deal and comply
with. A minor mistake can cause a lot of loss, it may be the loss of trust among the clients and
market or it can be financial and worst it can be both. Hence, there is a need to be well aware
of the security standards and the practices needed to be followed.

References
Baker, L. B. (2011). Sony PlayStation suffers massive data breach. Retrieved from
https://www.reuters.com/article/us-sony-stoldendata/sony-playstation-suffers-massive-data-
breach-idUSTRE73P6WB20110427
Chin, M. (2018). Tom’s Guide. Retrieved from https://www.tomsguide.com/us/timehop-data-
breach,news-27575.html
Cimpanu, C. (2018). Timehop Security Breach Affects the Company’s Entire 21 Million
Userbase. Retrieved from https://www.bleepingcomputer.com/news/security/timehop-
security-breach-affects-the-company-s-entire-21-million-userbase/
Ghosh, S. (2018). Social media memories app Timehop got hit by a data breach affecting 21
million users. Retrieved from https://www.businessinsider.in/Social-media-memories-app-
Timehop-got-hit-by-a-data-breach-affecting-21-million-users/articleshow/64917606.cms
Newcomb, A. (2018). Timehop breach: U.S. company navigates Europe’s new data privacy
rules. Retrieved from https://www.nbcnews.com/tech/tech-news/timehop-breach-u-s-
company-navigates-europe-s-new-data-n890511
Ogg, E. (2011). The PlayStation Network breach (FAQ). Retrieved from
https://www.cnet.com/news/the-playstation-network-breach-faq/
Oracle. (2019). Understanding Synchronous and Asynchronous Processing. Retrieved from
https://docs.oracle.com/cd/E24705_01/doc.91/e24264/sync_async_processing.htm#EOTWK
00192
Ousterhout, J. (2013). Virtual Memory. Retrieved from https://web.stanford.edu/~ouster/cgi-
bin/cs140-winter13/lecture.php?topic=vm
Phillips, T. (2016). Five years ago today, Sony admitted the great PSN hack. Retrieved from
https://www.eurogamer.net/articles/2016-04-26-sony-admitted-the-great-psn-hack-five-years-
ago-today