Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Equifax Was Breached in 2017

blog.0x7d0.dev

Post reply on HN
Print view View original

91–100 of 117 posts

Re: How Equifax Was Breached in 2017

#91

Post by hnthrowaway0315 »

blisterpeanuts wrote: post #71

I’m taking a cybersecurity course right now and this article is timely and informative. I’m a programmer with a lot of Java and database experience, but not really knowledgeable about security practices. Maybe security certification should be more of a requirement in hiring software engineers; I don’t recall it ever being mentioned in job listings. Anyway, it got me wondering, how did devs get away with storing datab…

A lot of companies are like that. In my previous company people sharing username and password through MS team and I'm sure someone stores them in team folders too.

Re: How Equifax Was Breached in 2017

#92

Post by g051051 »

b112 wrote: post #41
dwd wrote: post #32

Not mentioned here was that the group that exploited the vulnerability handed over to PLA linked individuals who then conducted the exfiltration. https://www.justice.gov/opa/pr/chinese-military-personnel-ch... As far as I am aware the data has never been seen on the open market, so there's a whole other National Security story around whether the information was used to compromise individuals with credit issues for co…

Also mis-mentioned, is that I heard nothing was "missed" but security upgrades were not possible due to the age of the stack. Pre-0 days are one thing. But leaving systems unpatched for months, because your stack is too old, is a common, but inexcusable theme. This is why it is vital to use libraries, frameworks, with a stable, unchanging LTS branch. Failure to do so, means a security update that needs to be applied…

The initial vulnerability was in the "modern" web application that fronted the legacy mainframe application. It was completely patchable, but was missed as described in the article.

Re: How Equifax Was Breached in 2017

#93

Post by eli »

foota wrote: post #50
hn_throwaway_99 wrote: post #48

Earlier quoted context omitted.

I agree with all that, with the one small caveat that more than anything else I think what is most important about security is a strong security culture at a company. All the checklists and compliance frameworks in the world are doomed in the face of a poor security culture. On the flip side, a strong and constantly reinforced security culture can help protect against the occasional muppet. One example: years ago I s…

Better than culture is enforced guarantees, nobody can store the database password on an NFS share if it's not available to them.

If you take away NFS shares without providing a better way to store and manage access controls, engineers will eventually just come up with an even worse solution.

I'm skeptical you can even fix this without a culture change, but you definitely can't do it just by taking things away.

Re: How Equifax Was Breached in 2017

#95

Post by b112 »

g051051 wrote: post #92
b112 wrote: post #41

Earlier quoted context omitted.

Also mis-mentioned, is that I heard nothing was "missed" but security upgrades were not possible due to the age of the stack. Pre-0 days are one thing. But leaving systems unpatched for months, because your stack is too old, is a common, but inexcusable theme. This is why it is vital to use libraries, frameworks, with a stable, unchanging LTS branch. Failure to do so, means a security update that needs to be applied…

The initial vulnerability was in the "modern" web application that fronted the legacy mainframe application. It was completely patchable, but was missed as described in the article.

A little bird told me otherwise.

Re: How Equifax Was Breached in 2017

#96

Post by qingcharles »

hn_throwaway_99 wrote: post #39

I really appreciate detailed breach reports like this. This was the money quote for me: > The attackers continued their search and eventually discovered a mounted NFS share on the web server. This file share contained notes and configuration files used by Equifax engineers, in which they found many database credentials. Seriously, WTF? I get paranoid all the time worrying about my application security - it often feel…

I rooted a major web hosting provider back in the early 2000s by uploading a web shell as a profile pic (they weren't checking pictures were image files).

Once I was in it didn't take long from rummaging around in the files to first find the database credentials in a config file, then eventually finding the root password to their servers, which in fact was simply "internet" o_O

I was a nice guy so I sent them an email with their passwords and told them they might want to upgrade their forum software.

Re: How Equifax Was Breached in 2017

#97

Post by mejutoco »

totallywrong wrote: post #85
hn_throwaway_99 wrote: post #39

I really appreciate detailed breach reports like this. This was the money quote for me: > The attackers continued their search and eventually discovered a mounted NFS share on the web server. This file share contained notes and configuration files used by Equifax engineers, in which they found many database credentials. Seriously, WTF? I get paranoid all the time worrying about my application security - it often feel…

I work mostly on Infra / DevOps. I'm constantly amazed by the absurdly low standards most devs have when it comes to security. The path of least resistance is chosen 99% of time. You're definitely the exception.

IMO often this just reflects the priorities of the organization.

While it is the responsibility of devs, some system needs to be put in place to actually enforce it. Like, do not have an nfs shared volume, or incentivise anybody to report these, and give incentives for it. Otherwise "just be very careful" advice slows development to a halt.

Re: How Equifax Was Breached in 2017

#98

Post by electrondood »

jiggawatts wrote: post #49
hn_throwaway_99 wrote: post #44

Earlier quoted context omitted.

Not enough downvotes for this. I'm assuming this is all BS considering you got all the details wrong. It was the CEO who got a $3 million bonus in 2016, not the CIO. Susan Mauldin, who earned a music degree in college, was the Equifax CISO, not their CIO. The reason I'm so salty about your response is when the breach happened, there were tons of news reports denigrating the CISO because she had a music degree. There…

I've worked with several senior people ("Principal Enterprise Architect", etc...) who were music majors, and as a rule they were terrible at their jobs. They just... didn't care about anything even vaguely related to computers. Without exception they got into their positions through nepotism, ass-kissing, or dirty politics. None got there through talent. People who like computers do it as a hobby. They learn programm…

Sorry, this is utter bullshit. Got into engineering late, and this mindset is just typical engineer snobbery. It's like the toxic "10x engineer" trope that also needs to die, as if taking an unconventional career path or not living and breathing open source contributions and tech blogs in your spare time means you aren't a Real EngineerTM

Re: How Equifax Was Breached in 2017

#99

Post by IE6 »

wordpad25 wrote: post #14

Wasn't Equifax Chief of Security a Music major? That was hilarious to read about...

You'de be really surprised how irrelevant a major and degree can be - for example I used to work with an engineer who carries a highly technical PhD and required extensive assistance with even the simplest tasks (often hour+ just to understand the ask and then more time on engineering a solution) - and I also had an art major intern who really just wanted to be a dropshipper who devoured any work I gave them and delivered amazing stuff.

Re: How Equifax Was Breached in 2017

#100

Post by tekla »

blisterpeanuts wrote: post #71

I’m taking a cybersecurity course right now and this article is timely and informative. I’m a programmer with a lot of Java and database experience, but not really knowledgeable about security practices. Maybe security certification should be more of a requirement in hiring software engineers; I don’t recall it ever being mentioned in job listings. Anyway, it got me wondering, how did devs get away with storing datab…

> an audit should include scanning all files for passwords

Please continue taking the security course. Scanning all files for passwords is madness. How do you differentiate "thisissupersecret" and "123fqfqlfni34235r4" and "git@somegitrepo.com" as passwords? You can't, they're all valid passwords for a majority of services.

At some point, you need to trust developers to do the right thing, which is impossible.

Post reply on HN