Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Equifax Was Breached in 2017

blog.0x7d0.dev

Post reply on HN
Print view View original

71–80 of 117 posts

Re: How Equifax Was Breached in 2017

#71

Post by blisterpeanuts »

I’m taking a cybersecurity course right now and this article is timely and informative. I’m a programmer with a lot of Java and database experience, but not really knowledgeable about security practices.

Maybe security certification should be more of a requirement in hiring software engineers; I don’t recall it ever being mentioned in job listings.

Anyway, it got me wondering, how did devs get away with storing database credentials in a file on an NFS share? That’s sheer recklessness. As a regular procedure, an audit should include scanning all files for passwords, for example; run find-grep-dired or similar on every mount, every disk, every cloud instance etc. And, obviously, require regular password changes.

It should be assumed that the entire system is vulnerable, and hardening should be done regularly and rigorously. A company as big as Equifax (or Target) should have a dedicated team whose job it is to constantly probe and audit. Since, after all, the black hats are constantly probing, too.

Re: How Equifax Was Breached in 2017

#72

Post by simonswords82 »

Nothing irritates me more than two for profit companies (Equifax and Experian) who have a license to print money by collecting my data without my explicit permission. Even with the introduction of GDPR and all the new consumer protection this brought about, I cannot ask them to delete all of my data.

They should not exist, or if they must exist they should be not for profit. It's a total scam.

Re: How Equifax Was Breached in 2017

#73

Post by coev »

jiggawatts wrote: post #49
hn_throwaway_99 wrote: post #44

Earlier quoted context omitted.

Not enough downvotes for this. I'm assuming this is all BS considering you got all the details wrong. It was the CEO who got a $3 million bonus in 2016, not the CIO. Susan Mauldin, who earned a music degree in college, was the Equifax CISO, not their CIO. The reason I'm so salty about your response is when the breach happened, there were tons of news reports denigrating the CISO because she had a music degree. There…

I've worked with several senior people ("Principal Enterprise Architect", etc...) who were music majors, and as a rule they were terrible at their jobs. They just... didn't care about anything even vaguely related to computers. Without exception they got into their positions through nepotism, ass-kissing, or dirty politics. None got there through talent. People who like computers do it as a hobby. They learn programm…

Plenty of us like painting and programming. Your brush is way too broad man.

Re: How Equifax Was Breached in 2017

#74

Post by mnw21cam »

hnthrowaway0315 wrote: post #67
dwd wrote: post #32

Not mentioned here was that the group that exploited the vulnerability handed over to PLA linked individuals who then conducted the exfiltration. https://www.justice.gov/opa/pr/chinese-military-personnel-ch... As far as I am aware the data has never been seen on the open market, so there's a whole other National Security story around whether the information was used to compromise individuals with credit issues for co…

Just curious how can I check whether a data set is on market?

One of the best ways is to look at the HaveIBeenPwned service https://haveibeenpwned.com/ - Troy Hunt goes around spending effort finding these things, so whether he has found it is a reasonable indication of whether it is out there. There's a list of the breaches he has included at http://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches

Edit - sorry, a better list of breaches is at https://haveibeenpwned.com/PwnedWebsites

Re: How Equifax Was Breached in 2017

#75

Post by dncornholio »

jiggawatts wrote: post #49
hn_throwaway_99 wrote: post #44

Earlier quoted context omitted.

Not enough downvotes for this. I'm assuming this is all BS considering you got all the details wrong. It was the CEO who got a $3 million bonus in 2016, not the CIO. Susan Mauldin, who earned a music degree in college, was the Equifax CISO, not their CIO. The reason I'm so salty about your response is when the breach happened, there were tons of news reports denigrating the CISO because she had a music degree. There…

I've worked with several senior people ("Principal Enterprise Architect", etc...) who were music majors, and as a rule they were terrible at their jobs. They just... didn't care about anything even vaguely related to computers. Without exception they got into their positions through nepotism, ass-kissing, or dirty politics. None got there through talent. People who like computers do it as a hobby. They learn programm…

That's pretty descriminating

Re: How Equifax Was Breached in 2017

#76

Post by hnthrowaway0315 »

mnw21cam wrote: post #74
hnthrowaway0315 wrote: post #67

Earlier quoted context omitted.

Just curious how can I check whether a data set is on market?

One of the best ways is to look at the HaveIBeenPwned service https://haveibeenpwned.com/ - Troy Hunt goes around spending effort finding these things, so whether he has found it is a reasonable indication of whether it is out there. There's a list of the breaches he has included at http://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches Edit - sorry, a better list of breaches is at https://haveibeenpwned.com/PwnedW…

Thanks a lot, didn't know this guy.

Re: How Equifax Was Breached in 2017

#77

Post by mysterydip »

keyle wrote: post #45
hn_throwaway_99 wrote: post #39

I really appreciate detailed breach reports like this. This was the money quote for me: > The attackers continued their search and eventually discovered a mounted NFS share on the web server. This file share contained notes and configuration files used by Equifax engineers, in which they found many database credentials. Seriously, WTF? I get paranoid all the time worrying about my application security - it often feel…

I'm totally with you on this one; but remember, if you have 25 developers in groups of 5, in only takes 1 muppet in any of the 5 groups to have low standards, and voila. I've seen it, in pretty much every large business I've worked in. This goes back to the saying: "you should never hire someone less good than yourself". Sadly when the people hiring literally come from sales or airline customer service, your company…

All it takes is outsourcing one portion to the lowest bidder, and you get what you pay for.

Re: How Equifax Was Breached in 2017

#78

Post by b112 »

hnthrowaway0315 wrote: post #68
dwd wrote: post #60

Earlier quoted context omitted.

Been a few years since I read it, but worth a look due to the detail it goes into. https://www.hsgac.senate.gov/wp-content/uploads/imo/media/do...

"They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax’s network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity." I wonder how they managed to figure that out. Did they have to look into eac…

They had months to work at it. Due to Equifax's incompetence.

It should be noted, the "official" report is what investigators have been told, not what really happened behind the scenes. Naturally Equifax and its employees tried to play the poor, innocent, helpless corp, with those dastardly hackers almost mysteriously getting in.

Re: How Equifax Was Breached in 2017

#79

Post by rmbyrro »

b112 wrote: post #41
dwd wrote: post #32

Not mentioned here was that the group that exploited the vulnerability handed over to PLA linked individuals who then conducted the exfiltration. https://www.justice.gov/opa/pr/chinese-military-personnel-ch... As far as I am aware the data has never been seen on the open market, so there's a whole other National Security story around whether the information was used to compromise individuals with credit issues for co…

Also mis-mentioned, is that I heard nothing was "missed" but security upgrades were not possible due to the age of the stack. Pre-0 days are one thing. But leaving systems unpatched for months, because your stack is too old, is a common, but inexcusable theme. This is why it is vital to use libraries, frameworks, with a stable, unchanging LTS branch. Failure to do so, means a security update that needs to be applied…

You're certainly right.

But in this case, no LTS would have covered, since the system was decades old.

The issue was that they had a poorly maintained service, hugely outdated, which is hard to secure, mingled with their main up-to-date stack.

Lesson: isolate the bad lemons from the good ones.

Re: How Equifax Was Breached in 2017

#80

Post by yomlica8 »

dataflow wrote: post #42
dwd wrote: post #36

Earlier quoted context omitted.

That is not correct for a data brokerage as the data is the business. Lose your monopoly on that data and you have no business. If it is information collected as part of doing business, then yes; they don't care. A good reason to question any Gov attempt to implement centralisation of data like identity or medical records.

> Lose your monopoly on that data and you have no business. Could you elaborate on how Equifax would have gone out of business if all their data had been stolen?

Doesn't track to me. There is no loss to Equifax really from losing all the data besides a fine. I doubt many of their customers are willing or able to purchase their data from dark markets at a discount, and the data would age unless the hack remained in place.
Post reply on HN