Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Equifax Was Breached in 2017

blog.0x7d0.dev

Post reply on HN
Print view View original

51–60 of 117 posts

Re: How Equifax Was Breached in 2017

#51

Post by hn_throwaway_99 »

yuliyp wrote: post #24
Roark66 wrote: post #18

Earlier quoted context omitted.

Personally I think the root cause of this was bad documentation practices. If the old system was properly documented they would've scanned the right folder. Likewise with the certificate, if there was documentation to indicate when that cert expires (or monitoring to alert few weeks in advance) they would have a functioning ids and these web shells would be found immediately. Unfortunately, out of half a dozen fortun…

That feels like the wrong conclusion. Assuming documentation will be followed properly is not a reasonable security strategy. Validation and monitoring is needed. That their NIDS gracefully degraded to a "don't monitor the payloads" when it was expected that it would be monitoring those and nobody noticed is a problem. A scan of a system which misses a web server running it without erroring is a problem.

Couldn't agree with this more. While I think it's important to have good documentation, it is nearly always a very bad idea to rely on that documentation being 100% correct. Businesses simply have way too many moving parts to assume the state of the world is always up-to-date in the documentation.

You also highlight a very good point. Things like security software should "break loudly", i.e. beyond just sending alerts (which can be ignored), there should be some explicitly "painful" steps that occur if the security system is in a broken state for long.

Re: How Equifax Was Breached in 2017

#52

Post by x86a »

k1rcher wrote: post #9

Wow, the fact that they remained undetected for so long and used wget for data exfiltration.. Hopefully security posture has increased since

using wget here does not make it more embarrassing as its user agent was almost certainly randomized to look like normal web traffic. Normal traffic downloading lots of 10MB files... well, yeah that's not great.

Re: How Equifax Was Breached in 2017

#53

Post by hn_throwaway_99 »

jiggawatts wrote: post #49
hn_throwaway_99 wrote: post #44

Earlier quoted context omitted.

Not enough downvotes for this. I'm assuming this is all BS considering you got all the details wrong. It was the CEO who got a $3 million bonus in 2016, not the CIO. Susan Mauldin, who earned a music degree in college, was the Equifax CISO, not their CIO. The reason I'm so salty about your response is when the breach happened, there were tons of news reports denigrating the CISO because she had a music degree. There…

I've worked with several senior people ("Principal Enterprise Architect", etc...) who were music majors, and as a rule they were terrible at their jobs. They just... didn't care about anything even vaguely related to computers. Without exception they got into their positions through nepotism, ass-kissing, or dirty politics. None got there through talent. People who like computers do it as a hobby. They learn programm…

Sorry you had that experience, but that certainly wasn't mine. Don't want to reveal too much but some very high level people in the tech world that you've probably heard of (or at least heard of their companies) have strong musical backgrounds.

Re: How Equifax Was Breached in 2017

#54

Post by hn_throwaway_99 »

foota wrote: post #50
hn_throwaway_99 wrote: post #48

Earlier quoted context omitted.

I agree with all that, with the one small caveat that more than anything else I think what is most important about security is a strong security culture at a company. All the checklists and compliance frameworks in the world are doomed in the face of a poor security culture. On the flip side, a strong and constantly reinforced security culture can help protect against the occasional muppet. One example: years ago I s…

Better than culture is enforced guarantees, nobody can store the database password on an NFS share if it's not available to them.

I honestly believe that enforced guarantees come about through security culture though.

Meaning a strong security culture means you do appropriate secrets management, and importantly, everyone understands how secrets management should be done. That way if you have the occasional breach in your automated enforced guarantees (e.g. the article talks about how Equifax missed one of their vulnerable systems to patch), that if people see a problem they will speak up.

That is, I agree with enforcing guarantees as much as possible, but any engineer on that team who came across an NFS file with DB credentials should have spoken up loudly about "Why TF are these DB credentials present on a network drive?"

Re: How Equifax Was Breached in 2017

#55

Post by stef25 »

RachelF wrote: post #28
schemescape wrote: post #8

> Malicious actors had been exfiltrating data for several months and had already collected personal information from 163 million customers. I don't think "customers" is the right term, considering I never wanted them collecting data about me.

Yes, this is what most people don't understand with data breaches: it's not the company's data, it's data on others. That's why they don't really care about protecting it.

Come on man ... no company wants their DB leaked regardless of what's inside. There's probably zero Western companies in 2023 that "don't care" about PPI leaking from their systems.

Re: How Equifax Was Breached in 2017

#56

Post by stef25 »

jiggawatts wrote: post #49
hn_throwaway_99 wrote: post #44

Earlier quoted context omitted.

Not enough downvotes for this. I'm assuming this is all BS considering you got all the details wrong. It was the CEO who got a $3 million bonus in 2016, not the CIO. Susan Mauldin, who earned a music degree in college, was the Equifax CISO, not their CIO. The reason I'm so salty about your response is when the breach happened, there were tons of news reports denigrating the CISO because she had a music degree. There…

I've worked with several senior people ("Principal Enterprise Architect", etc...) who were music majors, and as a rule they were terrible at their jobs. They just... didn't care about anything even vaguely related to computers. Without exception they got into their positions through nepotism, ass-kissing, or dirty politics. None got there through talent. People who like computers do it as a hobby. They learn programm…

> People who like computers do it as a hobby. They learn programming at a young age, they get a CS degree or a hard science degree, and then they spend their spare time on tech forums like HN.

Well that's me and trust me, you don't want me in charge of any IT department. Maybe it's cause I also like music.

Re: How Equifax Was Breached in 2017

#57

Post by jiggawatts »

hn_throwaway_99 wrote: post #53
jiggawatts wrote: post #49

Earlier quoted context omitted.

I've worked with several senior people ("Principal Enterprise Architect", etc...) who were music majors, and as a rule they were terrible at their jobs. They just... didn't care about anything even vaguely related to computers. Without exception they got into their positions through nepotism, ass-kissing, or dirty politics. None got there through talent. People who like computers do it as a hobby. They learn programm…

Sorry you had that experience, but that certainly wasn't mine. Don't want to reveal too much but some very high level people in the tech world that you've probably heard of (or at least heard of their companies) have strong musical backgrounds.

Very high level people in the tech world are often politicians, climbing the ladder through their social skills.

I've observed an inverse relationship between technical skill and career progression in all technical industries.

It's always the pimply junior contractor tech who is the Global Administrator doing the actual work, and the "very high level people" struggle with copy-paste from one email to another.

Re: How Equifax Was Breached in 2017

#58

Post by dwd »

forkerenok wrote: post #40
dwd wrote: post #36

Earlier quoted context omitted.

That is not correct for a data brokerage as the data is the business. Lose your monopoly on that data and you have no business. If it is information collected as part of doing business, then yes; they don't care. A good reason to question any Gov attempt to implement centralisation of data like identity or medical records.

> Lose your monopoly on that data and you have no business. But do these breaches affect their monopoly? My thinking is: 1. B2B customers won't go on darknet to source illegal data dumps. 2. This data, even if it doesn't quickly become effectively stale, would be considered stale by businesses very quickly if it's not connected to the continuous data ingestion pipeline.

1) Customers, probably not. Competitors I would not be so sure they wouldn't have look.

2) This is not specific to the data that underlines consumer credit scoring; a broker could be selling products derived from data on historical house prices or car sales for example. A competitor might use it to compare and validate their own dataset or simply have a look. Third party investigators, journalists, etc though could have a field day fact-checking it.

Re: How Equifax Was Breached in 2017

#60

Post by dwd »

b112 wrote: post #41
dwd wrote: post #32

Not mentioned here was that the group that exploited the vulnerability handed over to PLA linked individuals who then conducted the exfiltration. https://www.justice.gov/opa/pr/chinese-military-personnel-ch... As far as I am aware the data has never been seen on the open market, so there's a whole other National Security story around whether the information was used to compromise individuals with credit issues for co…

Also mis-mentioned, is that I heard nothing was "missed" but security upgrades were not possible due to the age of the stack. Pre-0 days are one thing. But leaving systems unpatched for months, because your stack is too old, is a common, but inexcusable theme. This is why it is vital to use libraries, frameworks, with a stable, unchanging LTS branch. Failure to do so, means a security update that needs to be applied…

Been a few years since I read it, but worth a look due to the detail it goes into.

https://www.hsgac.senate.gov/wp-content/uploads/imo/media/do...

Post reply on HN