Sony was running unpatched Apache with no firewall for months before breach