Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax’s Maddening Unaccountability

nytimes.com

Post reply on HN
Print view View original

101–110 of 238 posts

Re: Equifax’s Maddening Unaccountability

#101

Post by munin »

sillysaurus3 wrote: post #82
kelnos wrote: post #74

Earlier quoted context omitted.

> You may want to think twice. Try to design an architecture that doesn't have that. We have an architecture like that where I work. It's not that hard. Our web applications have very little direct access to databases; most of it is mediated by services downstream of the web app. That's certainly not a silver bullet, but it makes it impossible to exploit a RCE vuln in the web server in such a way that it lets you hav…

Have you had a netpen? Give me access to your web server (aka an RCE) and I can probably find a way to pivot to your downstream databases.

I have done netpens. Almost always it is as you describe. Sometimes someone has their shit together and it is not.

Re: Equifax’s Maddening Unaccountability

#102

Post by jeremyjh »

kelnos wrote: post #74
sillysaurus3 wrote: post #60

Earlier quoted context omitted.

If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. You may want to think twice. Try to design an architecture that doesn't have that. If you think it through, you'll realize the best you can do is not to deny access, but to monitor access so that any statistical deviation in requests-per-hour will trigger an alarm. Yet nobody does that, so wh…

> You may want to think twice. Try to design an architecture that doesn't have that. We have an architecture like that where I work. It's not that hard. Our web applications have very little direct access to databases; most of it is mediated by services downstream of the web app. That's certainly not a silver bullet, but it makes it impossible to exploit a RCE vuln in the web server in such a way that it lets you hav…

And let me guess. Those services give the webservers...the data that they ask for?

Once you've compromised a server, learning how to ask for the data you want is not hard. You have access to all the webserver's code, can make full dumps of communications occurring normally in the app, etc.

Re: Equifax’s Maddening Unaccountability

#103

Post by c3534l »

cloakandswagger wrote: post #6

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more an…

> The stock has been slammed

Equifax's stock hasn't been this low since... oh, last November. Hm. Not really sure I'd call that slammed.

Re: Equifax’s Maddening Unaccountability

#104

Post by ma2rten »

barsonme wrote: post #94
ma2rten wrote: post #85

Earlier quoted context omitted.

Yes! Germany and I presume other European countries have a much better system. The main difference is that there is no magic number that any one can use to borrow money in your name. Lenders have to verify a person's identity using ID. Further more, to get loan you don't have build up a score first. You could get a margage if you have never borrowed money in your life but have a stable income.

> You could get a margage if you have never borrowed money in your life but have a stable income. Same in the US, although it's a bit of a pain in the ass. It's my understanding, though, (correct me if I'm wrong!) that Germany is a bit less thrilled about credit than most other countries—even in Europe.

I don't think so? Germans have less credit cards, but they are still borrow money in the form of overdraft loans on their bank accounts.

Re: Equifax’s Maddening Unaccountability

#105

Post by zmmmmm »

losteric wrote: post #88
chiefalchemist wrote: post #38

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?

I still hold that this shouldn't matter to consumers. My priority of problems is * When fraud happens, banks can pass the pain and burden of proof onto consumers. * Banks use insecure SSNs for authorization; some data is used for validating eligibility, authenticating the application, and authorizing the loan. * There are minimal regulations on storing different classes of personal information (We need sarbanes-oxley…

At some level I think the banks are stuck in a conflict of interest with regard to risk. The reason we need banks and credit agencies is precisely because there is risk. If transacting parties could trust each other without an intermediary we could all just trade directly and all would be fine. So banks are actually disincentivised to create a world where risk is very low. They also don't want it to be very high. They need just enough risk that it is both (a) too big a problem for us to ignore and (b) small enough of a problem that they can solve it (for a fee, of course), but finally (c) still big enough of a problem that they are relatively insulated from competition.

I think it's no coincidence that the current state of affairs sits right at the sweet spot of these intersecting interests. And the problem is that the model requires an element of risk which is quite hard to control. Every now and then it flares up and becomes much bigger than they want. So we have incidents like this where the insecurities inherent in the system get exploited on a massive scale and the risk threatens to cross from profitable to massively unprofitable.

Re: Equifax’s Maddening Unaccountability

#106

Post by sillysaurus3 »

theossuary wrote: post #98
sillysaurus3 wrote: post #82

Earlier quoted context omitted.

Have you had a netpen? Give me access to your web server (aka an RCE) and I can probably find a way to pivot to your downstream databases.

That's the point, you have to pivot. If you don't have to jump through another host or two to get unfettered database access from web tier, you're doing it wrong.

It wouldn't have changed Equifax's situation at all. Everyone would still be just as outraged.

It occurs to me that maybe it might seem like pivoting is a big process that takes months. In reality you can map out an internal network within a few hours. Most people keep the servers at the edge of their network meticulously up to date. Once you're inside, you find way more old software. Not to mention creds just laying around the system in many cases since the devs don't expect anybody to be able to access them.

I feel like the worst offense Equifax could be accused of is not getting regular pentests. A netpen would have caught the outdated Struts issue, and they had money to get monthly tests. But very few of us get regular pentests.

Re: Equifax’s Maddening Unaccountability

#107

Post by tyingq »

chiefalchemist wrote: post #38

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?

I suspect it will become a priority soon. Somebody is likely to pastebin the data for some cabinet members, Congresspersons, etc. Then the matter will make it to the front of the queue.

Re: Equifax’s Maddening Unaccountability

#108

Post by TheCondor »

cloakandswagger wrote: post #30
konceptz wrote: post #26

Earlier quoted context omitted.

"The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that." Not really accurate because the exploit name, especially as generic as RCE, does not tell you how it was done. RCE can be a number of things that can be fixed in numerous ways. For example, file upload functionality with path manipulation and no file type validation may lead to RCE. This can certainly be removed w…

Fair enough. I more meant that after an attacker has achieved RCE, no amount of encryption or other practices can protect sensitive info in your database.

No you have to use other architectures for defending against that. Equifax sells queries to this data, they also use queries to that data as a trigger to change your credit rating. It seems like you'd want a very tightly audited mechanism for issuing these queries to make sure they are properly billed. Referring to it as a struts issue makes it sound like someone popped a web server, fired up a dub client and started dumping unencrypted tables.

It seems amazing that nothing tripped up some monitoring or something.

Re: Equifax’s Maddening Unaccountability

#109

Post by ridgeguy »

cloakandswagger wrote: post #19
bob1029 wrote: post #11

Earlier quoted context omitted.

>but I doubt this leak will have any lasting financial impact. I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There w…

Equifax has an $18B market cap. Can you name one instance of a government imposed fine for improperly stored PII exceeding even $100M? Furthermore, do you have evidence that the PII was improperly stored, or that Equifax's security practices were lacking in any way? The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.

I wonder if the legal concept res ipsa loquitur (the thing speaks for itself) could apply here? It's one foundation of tort law.

The argument would be that the very fact that PII security was breached demonstrates defendant's negligent data storage/security practices. If those practices had been adequate, the breach would not have occurred.

Re: Equifax’s Maddening Unaccountability

#110

Post by keyle »

You! You didn't pay a small bill 4 years ago because you changed address and a debt collector marked you as naughty. No loan for you! Hahaha! ... Oh, we just leaked all of your information. Ah well, today is a new day, ... dum diddly dum...
Post reply on HN