Hackers who broke into Equifax exploited a flaw in open-source server software
1–10 of 84 posts
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#2To give nuance to the clickbait:
"The vulnerability in Struts was just recently discovered by security researchers, who announced it earlier this week on Sept. 4. According to the researchers, the bug has existed since 2008."
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#3Humm, just got an apache struts security update from Redhat, and confluence doesn't have an update for it. Interesting...
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#4Take this with a grain of salt: They claim that the Struts vulnerability in question is specifically CVE-2017-9805, and cite a William Baird & Co. report [1]. However, the report in question says nothing about a specific CVE, only that it was "the Apache Struts flaw". Struts has had multiple vulnerabilities recently, such as one back in February (CVE-2017-5638). It's possible it was one of these that they failed to patch.
[1] https://baird.bluematrix.com/docs/pdf/dbf801ef-f20e-4d6f-91c...
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#5This is based on a report from Baird Equity Research.
Some key items from that report:
* "Our understanding is data retained by EFX primarily generated through consumer interactions was breached via the Apache Struts flaw (i.e., core databases not believed to have been breached)."
* "Key EFX databases are not known to have been breached as part of the incident, including the consumer credit file, TWN, NCTUE, IXI, or its commercial credit database. Our understanding is that data entered (and retained) through consumer portals/interactions (consumers inquiring about their credit reports, disputes, etc.) and data around it was breached via the Apache Struts flaw."
* "the breach is believed to have occurred from mid-May through July" and was discovered on July 29.
It's not clear whether this is referring to the Struts problem just announced or if it's the Struts problem earlier in the year, but if it's the just-announced one then it means that someone was actively exploiting it in the wild since at least May of this year. The timeframe would fit better for the early-2017 vulnerability [1] which was apparently also being exploited in the wild in March.
Obviously if they had enough access to the system it would be possible to connect through to the databases being accessed, but if this was all scraping of data passing through rather than at-rest then it may also indicate a lot more sophistication in the attack - unless there's a small number of points where the attackers could copy out data, this likely required a fair amount of analysis of Equifax's code to shim things in and grab data without breaking things.
The other interesting question is more along the lines of "If you haven't interacted with Equifax and haven't applied for anything involving credit, does that lessen the risk that you're impacted?"
[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5638 (Apache Struts Jakarta Multipart Parser file upload vulnerability for RCE)
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#6Take this with a grain of salt: They claim that the Struts vulnerability in question is specifically CVE-2017-9805, and cite a William Baird & Co. report [1]. However, the report in question says nothing about a specific CVE, only that it was "the Apache Struts flaw". Struts has had multiple vulnerabilities recently, such as one back in February (CVE-2017-5638). It's possible it was one of these that they failed to p…
I just hope the EFX breach used an older exploit and not a zero-day. That may have some influence on their perceived liability.
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#7Take this with a grain of salt: They claim that the Struts vulnerability in question is specifically CVE-2017-9805, and cite a William Baird & Co. report [1]. However, the report in question says nothing about a specific CVE, only that it was "the Apache Struts flaw". Struts has had multiple vulnerabilities recently, such as one back in February (CVE-2017-5638). It's possible it was one of these that they failed to p…
I just hope the EFX breach used an older exploit and not a zero-day. That may have some influence on their perceived liability.
Why do you hope that? Do you want them to be liable?
If it was a zero-day then they legitimately may not be at fault.
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#8This is based on a report from Baird Equity Research. Some key items from that report: * "Our understanding is data retained by EFX primarily generated through consumer interactions was breached via the Apache Struts flaw (i.e., core databases not believed to have been breached)." * "Key EFX databases are not known to have been breached as part of the incident, including the consumer credit file, TWN, NCTUE, IXI, or…
I would guess that you have any sort of credit history or digital financial trail, companies are sending it to Equifax. Could be something as simple as a cell phone service.
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#9To give nuance to the clickbait: "The vulnerability in Struts was just recently discovered by security researchers, who announced it earlier this week on Sept. 4. According to the researchers, the bug has existed since 2008."
Equifax discovered the hack on July 29, more than a month before this vulnerability was discovered.
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#10[deleted]