171–180 of 238 posts
Equifax played a slightly different version if this commercial during Monday Night Football a few times, it takes no accountability, but also doubles-down, claims your info might* be on the dark-web(*because they just negligently released it), and offers a "dark-web-scan" service to help find it... https://www.youtube.com/watch?v=vjrydnr_pvQ
Experian != Equifax
;-)
Earlier quoted context omitted.
Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?
They don't. I just bought a car from a dealership on August 1 without a credit check. The dealership wanted to run a credit check if I were to pay with a personal check, but not if I paid with certified funds. I called my bank to have my debit card limit raised to $40,000 for 24 hours and paid for the car on my debit card with no credit check.
The author likens this to automotive safety, but I think a better analogy would be airline safety. When an airplane goes down, an immediate investigation is done by third parties to find the cause. Then remedial steps are drawn up and the entire industry is expected to follow them, not just the company involved in the accident. Data breaches need to be held to this standard.
Earlier quoted context omitted.
> The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that. If the vulnerability used turns out to be the Struts one that was announced at the beginning of the year, then the "magic" here would have been quite muggle-like: update the damn dependency. Not doing so is negligence, plain and simple. (I agree with you, though, that EFX will almost certainly come out of this rel…
The statement released by Apache said that, if the attack did use the REST plugin vulnerability in Struts, then it would have been a zero-day at the time of use.
Earlier quoted context omitted.
Expecting perfection is wrong. There's 120 millions of lines of code in an A380, and planes don't crash due to software bugs. Why is it wrong to expect perfection in critical infrastructure? Something went wrong somewhere in software engineering. My HP42s calculator has about 6 insignificant bugs that you need to get out of your way to trigger. Your new cellphone on the other hand, when you turn it on it downloads a…
You're comparing a relatively cheap credit report to a $400 million dollar airplane with a 15-25 billion euro program cost. Not to mention aerospace has a 100 years of innovation and has actual lives at stake. The internet, what 30ish years? Not to mention network security is a relatively new concern.
I just read about how the hack was done. Shockingly stupidly easy! 1. They realized that Equifax uses Struts. 2. They modified struts! and 3. Equifax used the updated code on their servers. DUUUUUHHHHHH!
It is more: - Critical remote execution bug was discovered in Struts2. - The vulnerability goes public too quickly. - Hackers start scanning the Internet - Equifax is found vulnerable. - Vulnerability is exploited.
If the $14 billion can't do that then they certainly cannot protect data.
Earlier quoted context omitted.
I'm eagerly awaiting the technical details of the attack. If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. I'm wondering if Equifax is using Struts-provided REST for its entire architecture. If that's the case, gaining access to the web server was only the first step. From there the attacker could perform RCE on sensitive services.
If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. You may want to think twice. Try to design an architecture that doesn't have that. If you think it through, you'll realize the best you can do is not to deny access, but to monitor access so that any statistical deviation in requests-per-hour will trigger an alarm. Yet nobody does that, so wh…
The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.
To be fair, it's not 'technical competency' but rather a broad range of operational, process, product and engineering competencies. Also, a lot of companies just don't have a thoughtful process for this. Think of how much data Google and FB have, and they've never been breached. As much as I loathe them, I actually feel more 'secure' with the data that is supposed to be secure with FB than with my local bank. FB depe…
Earlier quoted context omitted.
The credit system sucks. But has anybody created a better alternative yet?
Yes! Germany and I presume other European countries have a much better system. The main difference is that there is no magic number that any one can use to borrow money in your name. Lenders have to verify a person's identity using ID. Further more, to get loan you don't have build up a score first. You could get a margage if you have never borrowed money in your life but have a stable income.
Article is in english: https://www.deutschepost.de/en/p/postident/identifizierungsv...
Earlier quoted context omitted.
I'm eagerly awaiting the technical details of the attack. If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. I'm wondering if Equifax is using Struts-provided REST for its entire architecture. If that's the case, gaining access to the web server was only the first step. From there the attacker could perform RCE on sensitive services.
If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. You may want to think twice. Try to design an architecture that doesn't have that. If you think it through, you'll realize the best you can do is not to deny access, but to monitor access so that any statistical deviation in requests-per-hour will trigger an alarm. Yet nobody does that, so wh…