Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax securities fraud class action [pdf]

securities.stanford.edu

Post reply on HN
Print view View original

61–70 of 227 posts

Re: Equifax securities fraud class action [pdf]

#61

Post by nerdponx »

jfoster wrote: post #38
teddyuk wrote: post #29

Earlier quoted context omitted.

It happens quite a lot - nowadays services are deployed into the cloud where people are more security concious but when people deploy on-prem they are often more negligent

Interesting point. Does having physical access to the hardware make people feel overly secure?

In my personal experience, yes.

There is an unbelievable amount of sensitive data, whether corporate or personal, unencrypted on network shared drives and laptops across corporate America.

I'm pretty much a lay person when it comes to security, so I don't know generally how safe or unsafe that is. But there is definitely a sense that, as long as you don't get phished, everything on-prem is basically "secure" and IT is just taking care of it.

For example my employer had strict rules about data that can be stored on a cloud service, but less-strict rules about data that can be stored on an on-prem network drive.

Re: Equifax securities fraud class action [pdf]

#62

Post by ownagefool »

aloknnikhil wrote: post #35

These security nightmares begs the question: Why don't databases use asymmetric keys and authenticate & authorize access? Why are we still reliant on password based authentication? If it's simply the question of key management and distribution, that's a solved problem.

Not all databases require passwords to authenticate. I'd imagine most popular ones don't nowadays.

https://www.postgresql.org/docs/12/client-authentication.htm...

I imagine developing something like equifax today, you'd want to hook up it up to your SSO, and used row based security so a user can only read their row, and then you focus your efforts making sure user accounts, especially privileged ones such as staff, aren't being abused. (You'd still probably establish system to system level trust, such as keys between your API and DB).

But it's so much easier and cheaper just to connect using a username and password, and then do whatever the framework you chose does by default.

Re: Equifax securities fraud class action [pdf]

#63

Post by dragonwriter »

Note that this is an order on a motion to dismiss; none of the fact claims reported here are findings by the court, they are allegations made against Equifax. In a motion to dismiss, the facts in dispute are viewed in the light most favorable to the non-moving party, and here Equifax and other defendants are moving to dismiss. That's why the supporting reference for every fact claim is to the complaint against Equifax in the case, and “According to the plaintiff” is liberally scattered throughout the document.

Re: Equifax securities fraud class action [pdf]

#65

Post by cyberferret »

Tsk! I remember reading a white hat pen-test report once where a major US bank had their master MS-SQL server left at the default root user 'sa' and no password. From memory the pen-test team got full access to the main transaction tables within a minute.

If I remember correctly, they immediately stopped the testing and reported it to management, but I believe they never heard back as to whether the problem was fixed. If anyone knows more details about this, I am sure we would all appreciate an update.

Re: Equifax securities fraud class action [pdf]

#66

Post by nerdponx »

skratchpixels wrote: post #53
zer0faith wrote: post #32

Why is Equifax still a thing?

This was my thought. Why do we need three credit reporting agencies? TransUnion and Experian should be enough. I go through my reports and all three are pretty much the same.

As tempting as it is to thirst for blood in this case, what do you really want to go after is upper management.

Credit rating isn't exactly a free market, but I'm very skeptical that we should reduce any significant oligopoly from three corporations to two.

Re: Equifax securities fraud class action [pdf]

#68

Post by pmccarren »

sn41 wrote: post #48

This is quite strong policy. Usually in most sinister incompetent companies, the user name is "admin" and the password is "password". On a serious note: there should be a mandated, periodic, third-party security audit by neutral parties for all entities which deal with user data beyond a certain specified level of sensitivity. It should not be left to their discretion when to run such an audit from their end. Whether…

How would one motivate these companies to _actually do something_ with the results of the audit? Perhaps, buried deep in the burrows of their bureaucratic empire, are several audit reports outlining this vulnerability..

Re: Equifax securities fraud class action [pdf]

#69

Post by RankingMember »

> On August 2, 2017, Equifax notified the FBI of the Data Breach. It also retained legal counsel to guide its investigation into the breach. The same day, Equifax’s legal counsel retained Mandiant to assist in the investigation into the incident. Experts would later note that these steps suggested that Equifax knew that the Data Breach was serious. In the days immediately following the discovery of the Data Breach, Gamble and Ploder sold more than $1 million in Equifax stock. On August 1, Gamble, Equifax’s Chief Financial Officer, sold stock for $946,374, representing more than thirteen percent of his holdings. On August 2, Ploder sold stock for $250,458, representing four percent of his holdings. These sales were not made pursuant to a Rule 10b5–1 trading plan. Smith would later state in congressional testimony that Ploder and Gamble would have been in many of the meetings he had concerning the Data Breach.

Am I crazy or is this not blatant insider trading?

Re: Equifax securities fraud class action [pdf]

#70

Post by pmccarren »

ericmay wrote: post #52
sn41 wrote: post #48

This is quite strong policy. Usually in most sinister incompetent companies, the user name is "admin" and the password is "password". On a serious note: there should be a mandated, periodic, third-party security audit by neutral parties for all entities which deal with user data beyond a certain specified level of sensitivity. It should not be left to their discretion when to run such an audit from their end. Whether…

Right. We do this with accounting firms, and I think we should do it with data security as well. Does it cost money? Sure. But that's the cost of doing business. If you have personal info like this and you profit from it, then you are also responsible for safeguarding it.

In being careful to not build an impossible barrier-to-entry, perhaps the requirement becomes active upon certain criteria (e.g. number of users)
Post reply on HN