71–80 of 238 posts
The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.
The problem is lack of commercial incentives. Apple, Google, Facebook, etc all have serious dollars at stake if they don't get security right. Equifax on the other hand...
Earlier quoted context omitted.
I'm eagerly awaiting the technical details of the attack. If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. I'm wondering if Equifax is using Struts-provided REST for its entire architecture. If that's the case, gaining access to the web server was only the first step. From there the attacker could perform RCE on sensitive services.
If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. You may want to think twice. Try to design an architecture that doesn't have that. If you think it through, you'll realize the best you can do is not to deny access, but to monitor access so that any statistical deviation in requests-per-hour will trigger an alarm. Yet nobody does that, so wh…
Earlier quoted context omitted.
Common misconception. They actually do need your approval, it's just that that approval is buried in the mountains of legalese you sign whenever you sign up for a bank account, credit card or loan.
So, if I don't want to give them my approval, I must: not sign up for a bank account, never open a credit card, avoid getting a mortgage, buy only in cash, stop renting [0], only apply to some jobs [1], not take out student loans... [0] Some landlords require credit approval [1] Some jobs check credit
Earlier quoted context omitted.
I'm eagerly awaiting the technical details of the attack. If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. I'm wondering if Equifax is using Struts-provided REST for its entire architecture. If that's the case, gaining access to the web server was only the first step. From there the attacker could perform RCE on sensitive services.
If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. You may want to think twice. Try to design an architecture that doesn't have that. If you think it through, you'll realize the best you can do is not to deny access, but to monitor access so that any statistical deviation in requests-per-hour will trigger an alarm. Yet nobody does that, so wh…
We have an architecture like that where I work. It's not that hard. Our web applications have very little direct access to databases; most of it is mediated by services downstream of the web app. That's certainly not a silver bullet, but it makes it impossible to exploit a RCE vuln in the web server in such a way that it lets you have arbitrary access to the database.
Earlier quoted context omitted.
We have all agreed. We gave permission to any company that extends credit. They give our information to these credit reporting agencies on an on-going basis, personal information, including what our payment behavior and history is. All of this comes down to trust. We trust our banks and credit card companies. They trust Equifax. Equifax's customer is your bank or credit lending company, not us. It's actually very sim…
Since when does Uber ask for use of your camera or access to photos? And for what?
Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more an…
I agree with the sentiment, and I’m keeping my eye out for an opportunity. But I don’t think they’ve been hammered enough. I mean, it’s not like they’ve hit a 52 week low or anything. Maybe if I can find some in-the-money calls for a reasonable price...
Earlier quoted context omitted.
Common misconception. They actually do need your approval, it's just that that approval is buried in the mountains of legalese you sign whenever you sign up for a bank account, credit card or loan.
Yes, but you really have zero choice. Unless you decide that you can live without a cell phone, rental car, credit card, mortgage or bank account the rest of your life.
Linkedin using unsalted sha hashes is a lot more maddening. Here you have a vulnerability being disclosed and not enough time to patch your code.
Earlier quoted context omitted.
Did you use that strategy with United Airlines after they injured that guy when bouncing him from the flight?
There's an important difference: consumers choose to fly with UA just like they choose to walk into Chipotle and buy a burrito. The vast majority of EFX's profits come from services that consumers (effectively) don't choose to participate in.
I'm not suggesting that's right, but it is how it is.