Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Equifax Was Breached in 2017

blog.0x7d0.dev

Post reply on HN
Print view View original

81–90 of 117 posts

Re: How Equifax Was Breached in 2017

#81

Post by tialaramex »

dilyevsky wrote: post #12
cookiengineer wrote: post #5

TLDR is: Equifax had no working firewall / intrusion detection for almost a year, because they did not update their snakeoil MITM certificate and forgot about it. Remind me again, how did Equifax get SOC 1&2, and ISO27001 certified? Oh yeah, they probably have a checklist for that, so they must be secure. /s

Why "snakeoil"? Sounds like the system actually caught the intrusion once operable! The fact it was silently down for god knows how long is another matter... > Remind me again, how did Equifax get SOC 1&2, and ISO27001 certified? You probably already know that these are compliance CYA focused around process not actual measure of how secure the system is (if there could be such a thing).

As another person pointed out, it's just usual to name this certificate "snakeoil" because it's just ticking a box mechanically and serves little to no functional purpose. The service won't run without a certificate, this is a certificate, good enough. You might prefer to think of it as a placebo, but "snakeoil" seems to be usual name.

Yes, you're correct ISO standards are very focused on paperwork.

One of the fears some C++ people have is that today ISO 26262 (safety for road vehicles) says they can write car software in C++ because hey, there's an ISO standard for C++ so that's paperwork we can point to - But, wait, why is that enough? C++ is laughably unsuited to this work. Maybe 26262 should be revised to not say that C++ is suitable.

Re: How Equifax Was Breached in 2017

#82

Post by MilStdJunkie »

keyle wrote: post #45
hn_throwaway_99 wrote: post #39

I really appreciate detailed breach reports like this. This was the money quote for me: > The attackers continued their search and eventually discovered a mounted NFS share on the web server. This file share contained notes and configuration files used by Equifax engineers, in which they found many database credentials. Seriously, WTF? I get paranoid all the time worrying about my application security - it often feel…

I'm totally with you on this one; but remember, if you have 25 developers in groups of 5, in only takes 1 muppet in any of the 5 groups to have low standards, and voila. I've seen it, in pretty much every large business I've worked in. This goes back to the saying: "you should never hire someone less good than yourself". Sadly when the people hiring literally come from sales or airline customer service, your company…

It feels like this wouldn't be all that hard to keep out of deployment with a githook and a more-or-less simple regex.

I did something very similar for a publishing system, where, well, long story short, but equivalent of local variables[1] were verboten in the production repo. On the other hand, the writers were constantly asking me to override the precommits, so, well, there's the muppet argument.

[1] https://docs.asciidoctor.org/asciidoc/latest/attributes/cust... Basically, declaring an attribute in an include target. Variable scope is one of those things getting debated in the Asciidoc world these days. Ha ha ha welcome to the 1997 SGML technical steering group, suckas. You're discovering why HTML doesn't have transclusion.

Re: How Equifax Was Breached in 2017

#83

Post by hnthrowaway0315 »

b112 wrote: post #78
hnthrowaway0315 wrote: post #68

Earlier quoted context omitted.

"They routed traffic through approximately 34 servers located in nearly 20 countries to obfuscate their true location, used encrypted communication channels within Equifax’s network to blend in with normal network activity, and deleted compressed files and wiped log files on a daily basis in an effort to eliminate records of their activity." I wonder how they managed to figure that out. Did they have to look into eac…

They had months to work at it. Due to Equifax's incompetence. It should be noted, the "official" report is what investigators have been told, not what really happened behind the scenes. Naturally Equifax and its employees tried to play the poor, innocent, helpless corp, with those dastardly hackers almost mysteriously getting in.

Thanks, might be my misunderstanding but I was trying to figure out how the investigators managed to figure out. Feels like the only sure way is from a leak from China, but theoretically they can also track all those servers.

The whole attack/investigation is super fascinating.

Re: How Equifax Was Breached in 2017

#84

Post by JCM9 »

Having a plaintext file with “notes” containing the login credentials for a database containing actual customer data with PII is borderline criminal negligence. What a friggin disgrace.

Re: How Equifax Was Breached in 2017

#85

Post by totallywrong »

hn_throwaway_99 wrote: post #39

I really appreciate detailed breach reports like this. This was the money quote for me: > The attackers continued their search and eventually discovered a mounted NFS share on the web server. This file share contained notes and configuration files used by Equifax engineers, in which they found many database credentials. Seriously, WTF? I get paranoid all the time worrying about my application security - it often feel…

I work mostly on Infra / DevOps. I'm constantly amazed by the absurdly low standards most devs have when it comes to security. The path of least resistance is chosen 99% of time. You're definitely the exception.

Re: How Equifax Was Breached in 2017

#86

Post by b112 »

rmbyrro wrote: post #79
b112 wrote: post #41

Earlier quoted context omitted.

Also mis-mentioned, is that I heard nothing was "missed" but security upgrades were not possible due to the age of the stack. Pre-0 days are one thing. But leaving systems unpatched for months, because your stack is too old, is a common, but inexcusable theme. This is why it is vital to use libraries, frameworks, with a stable, unchanging LTS branch. Failure to do so, means a security update that needs to be applied…

You're certainly right. But in this case, no LTS would have covered, since the system was decades old. The issue was that they had a poorly maintained service, hugely outdated, which is hard to secure, mingled with their main up-to-date stack. Lesson: isolate the bad lemons from the good ones.

What's happening, is companies are doing a risk assessment, and thinking "well, it probably won't be hacked, we don't need to replace this with something that is auditable, and secure".

That needs to 100% end. There are also cases where companies think, "Well, it will take use 3 weeks to update this stack, we'll leave the old, vulnerable code online for that 3 weeks, plus testing, and plus (of course) push, so 2 months, even though this is a very easily exploitable, high profile CVE".

That too needs to end.

The only way that can end, is if fines are WELL beyond any possible savings, including being 100s of times more than those savings, so that companies will TREMBLE IN FEAR at the very idea of leaving unpatched servers online. Your stack will take 2 months + testing to upgrade?

Because you chose a stack without an easy way to upgrade instantly?

then you take your stack offline, and tough if it bankrupts you.

Because otherwise, we'll fine the company dry, and its directors, and jail the CTO, and the employees who knew.

Re: How Equifax Was Breached in 2017

#87

Post by hn_throwaway_99 »

inhumantsar wrote: post #63
hn_throwaway_99 wrote: post #44

Earlier quoted context omitted.

Not enough downvotes for this. I'm assuming this is all BS considering you got all the details wrong. It was the CEO who got a $3 million bonus in 2016, not the CIO. Susan Mauldin, who earned a music degree in college, was the Equifax CISO, not their CIO. The reason I'm so salty about your response is when the breach happened, there were tons of news reports denigrating the CISO because she had a music degree. There…

It was also widely reported that she had no apparent security background, so maybe provide some evidence that the shade was unwarranted? Of course lots of people get into tech from non tech but it's not a reason to go off on the commenter with an angry screed. Also, she was CSO not CISO or CIO not that there's much of a difference between those titles in practice anyway.

Show me any reference that says she didn't have a security background in her actual job experience. I couldn't find her roles but she had jobs at First Data, Sun Trust Bank, and Hewlett Packard. This article makes the same point: https://www.thesslstore.com/blog/equifaxs-cso-music-major-co...

Re: How Equifax Was Breached in 2017

#88

Post by coldpie »

keyle wrote: post #45
hn_throwaway_99 wrote: post #39

I really appreciate detailed breach reports like this. This was the money quote for me: > The attackers continued their search and eventually discovered a mounted NFS share on the web server. This file share contained notes and configuration files used by Equifax engineers, in which they found many database credentials. Seriously, WTF? I get paranoid all the time worrying about my application security - it often feel…

I'm totally with you on this one; but remember, if you have 25 developers in groups of 5, in only takes 1 muppet in any of the 5 groups to have low standards, and voila. I've seen it, in pretty much every large business I've worked in. This goes back to the saying: "you should never hire someone less good than yourself". Sadly when the people hiring literally come from sales or airline customer service, your company…

> This goes back to the saying: "you should never hire someone less good than yourself".

It's a good idea, but now your product is twice as expensive as the other guy's, and you're not going to win any bids that way, and now you're out of business.

Re: How Equifax Was Breached in 2017

#89

Post by raarts »

hn_throwaway_99 wrote: post #44
RachelF wrote: post #25

Earlier quoted context omitted.

A tiny penalty. The CIO got a $3M bonus, too. Odd thing is that she had a music degree and little experience in IT, but was an old friend of the board members.

Not enough downvotes for this. I'm assuming this is all BS considering you got all the details wrong. It was the CEO who got a $3 million bonus in 2016, not the CIO. Susan Mauldin, who earned a music degree in college, was the Equifax CISO, not their CIO. The reason I'm so salty about your response is when the breach happened, there were tons of news reports denigrating the CISO because she had a music degree. There…

> but I take major issue with the implication that a music degree makes someone unqualified for a tech job

OP never said 'a tech job', it is implied it would make someone unqualified for a CISO job though. And as a general rule, I tend to agree.

Re: How Equifax Was Breached in 2017

#90

Post by nunez »

> The attackers continued their search and eventually discovered a mounted NFS share on the web server. This file share contained notes and configuration files used by Equifax engineers, in which they found many database credentials.

Crazy that the user that ACIS was running as had enough permissions to access NFS mounts to begin with.

It’s also crazy that the attackers even found ACIS.

This was an insanely dedicated attack.

Post reply on HN