> a popular plugin called REST Why cant tech 'journalists' get someone who knows what they're talking about to proofread their articles?
[deleted]
Hackers who broke into Equifax exploited a flaw in open-source server software
51–60 of 84 posts
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#52This is based on a report from Baird Equity Research. Some key items from that report: * "Our understanding is data retained by EFX primarily generated through consumer interactions was breached via the Apache Struts flaw (i.e., core databases not believed to have been breached)." * "Key EFX databases are not known to have been breached as part of the incident, including the consumer credit file, TWN, NCTUE, IXI, or…
> Our understanding is that data entered (and retained) through consumer portals/interactions
Why was such sensitive data "retained" at the edge?
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#53> a popular plugin called REST Why cant tech 'journalists' get someone who knows what they're talking about to proofread their articles?
Remember this the next time you read anything in the news about an industry you don't understand.
The Gell Mann amnesia effect - https://seekerblog.com/2006/01/31/the-murray-gell-mann-amnes...
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#54> a popular plugin called REST Why cant tech 'journalists' get someone who knows what they're talking about to proofread their articles?
There is actually a plugin called REST: http://struts.apache.org/docs/rest-plugin.html
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#55I find the title irritating, as it seems to impugn open source software as a category. Why is the licensing model even relevant? A better phrasing would be something like "...flaw in a popular web framework" or "...flaw in Apache Struts."
> Why is the licensing model even relevant?
Licensing model directly affects the availability of source code, and this technically facilitates exploit discovery.
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#56Regarding CVE-2017-9805, I’m genuinely in awe over how remote code execution in Java is even possible. Why should it even be possible to deserialize data on the wire into executable code? Also, can someone shed light on the technical side of this? E.g., how does the JVM compile Java code it receives on the wire into Java byte code? Does the JVM runtime have a built-in Java compiler that outputs Java byte code that it…
I am not sure about this exploit but what can be done is you can send a Class type over the wire.
It contains Java bytecode and when de-serialized it will use some ClassLoader to construct the Class instance. While doing that the static intializer of that class will be executed.
This probably is not what is going on here but is a possibility.
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#57Regarding CVE-2017-9805, I’m genuinely in awe over how remote code execution in Java is even possible. Why should it even be possible to deserialize data on the wire into executable code? Also, can someone shed light on the technical side of this? E.g., how does the JVM compile Java code it receives on the wire into Java byte code? Does the JVM runtime have a built-in Java compiler that outputs Java byte code that it…
the JVM lets you modify stuff at runtime with reflection
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#58I find the title irritating, as it seems to impugn open source software as a category. Why is the licensing model even relevant? A better phrasing would be something like "...flaw in a popular web framework" or "...flaw in Apache Struts."
> Why is the licensing model even relevant? Licensing model directly affects the availability of source code, and this technically facilitates exploit discovery.
Also, many open source proponents claim that open source software is more secure because the “many eyes” theory will lead to bugs and vulnerabilities being discovered sooner. This and other high profile exploits like heartbleed show how well this theory applies in practice is questionable.
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#59> a popular plugin called REST Why cant tech 'journalists' get someone who knows what they're talking about to proofread their articles?
There is actually a plugin called REST: http://struts.apache.org/docs/rest-plugin.html
If that's the plugin that was affected, then I think the author did nothing wrong. What would be the point to explain what REST - as a concept - is, in a non technical article.
Re: Hackers who broke into Equifax exploited a flaw in open-source server software
#60Earlier quoted context omitted.
> Why is the licensing model even relevant? Licensing model directly affects the availability of source code, and this technically facilitates exploit discovery.
Also, many open source proponents claim that open source software is more secure because the “many eyes” theory will lead to bugs and vulnerabilities being discovered sooner. This and other high profile exploits like heartbleed show how well this theory applies in practice is questionable.
I find that conclusion presumptuous. Unless you can say how many bugs would have been discovered had the source been closed, then it doesn't make sense to claim the opposite.
Also, do we know that e.g. this and Heartbleed were discovered by reading the source? If they weren't then the availability of the source code is inconsequential IMO.