I’m planning to sue in small claims court, did anyone also do this and have any tips?
How Equifax Was Breached in 2017
101–110 of 117 posts
Re: How Equifax Was Breached in 2017
#102I’m taking a cybersecurity course right now and this article is timely and informative. I’m a programmer with a lot of Java and database experience, but not really knowledgeable about security practices. Maybe security certification should be more of a requirement in hiring software engineers; I don’t recall it ever being mentioned in job listings. Anyway, it got me wondering, how did devs get away with storing datab…
> an audit should include scanning all files for passwords Please continue taking the security course. Scanning all files for passwords is madness. How do you differentiate "thisissupersecret" and "123fqfqlfni34235r4" and "git@somegitrepo.com" as passwords? You can't, they're all valid passwords for a majority of services. At some point, you need to trust developers to do the right thing, which is impossible.
You're right, but I was thinking of searching for known passwords. For example, if an Oracle db accessed by developers is tekla / tekla1234, then scan for the string "tekla1234". It should not exist in any file. If it exists in a file, then obviously that is a potential leak.
Re: How Equifax Was Breached in 2017
#103I’m taking a cybersecurity course right now and this article is timely and informative. I’m a programmer with a lot of Java and database experience, but not really knowledgeable about security practices. Maybe security certification should be more of a requirement in hiring software engineers; I don’t recall it ever being mentioned in job listings. Anyway, it got me wondering, how did devs get away with storing datab…
A lot of companies are like that. In my previous company people sharing username and password through MS team and I'm sure someone stores them in team folders too.
In the early 90s, at a large financial company I worked for, the system user name/password for a Sybase db was sa/sa. It was so convenient. Of course this was the primordial days but still.
Re: How Equifax Was Breached in 2017
#104I really appreciate detailed breach reports like this. This was the money quote for me: > The attackers continued their search and eventually discovered a mounted NFS share on the web server. This file share contained notes and configuration files used by Equifax engineers, in which they found many database credentials. Seriously, WTF? I get paranoid all the time worrying about my application security - it often feel…
I'm totally with you on this one; but remember, if you have 25 developers in groups of 5, in only takes 1 muppet in any of the 5 groups to have low standards, and voila. I've seen it, in pretty much every large business I've worked in. This goes back to the saying: "you should never hire someone less good than yourself". Sadly when the people hiring literally come from sales or airline customer service, your company…
What is egregious is that Equifax isn't some random company. Equifax is a credit reporting agency and is a goldmine for identity thieves.
After the Equifax breach, I just assume now if an identity thief gives a half assed effort, he can pull up the PII for any American resident. How Experian/Equifax/Transunion can honestly say they have accurate data without physically verifying driver licenses, identity cards, or passports is beyond me.
Re: How Equifax Was Breached in 2017
#105Earlier quoted context omitted.
Better than culture is enforced guarantees, nobody can store the database password on an NFS share if it's not available to them.
If you take away NFS shares without providing a better way to store and manage access controls, engineers will eventually just come up with an even worse solution. I'm skeptical you can even fix this without a culture change, but you definitely can't do it just by taking things away.
Yes, I agree. I realize this isn't feasible everywhere, but having access tied to a user account (and then auditing and limiting that access) can serve as a replacement. E.g., want to select a single row? Fine, but if they're dumping the db something is phishey.
Ironically, user accounts are in one sense more secure (than a system account with a shared password) because they can use 2fa (and there's no inherent need to distribute the password).
Re: How Equifax Was Breached in 2017
#106Earlier quoted context omitted.
Not enough downvotes for this. I'm assuming this is all BS considering you got all the details wrong. It was the CEO who got a $3 million bonus in 2016, not the CIO. Susan Mauldin, who earned a music degree in college, was the Equifax CISO, not their CIO. The reason I'm so salty about your response is when the breach happened, there were tons of news reports denigrating the CISO because she had a music degree. There…
> but I take major issue with the implication that a music degree makes someone unqualified for a tech job OP never said 'a tech job', it is implied it would make someone unqualified for a CISO job though. And as a general rule, I tend to agree.
That's total bullshit. She was a music major in college, presumably some 20 or so years before her job at Equifax, and in the interim she had jobs at major banks and tech companies. People act like she was a musician until just before she plopped into Equifax.
Sundar Pichai majored in metallurgy engineering. How much of his college coursework do you think he uses day-to-day?
Re: How Equifax Was Breached in 2017
#107Earlier quoted context omitted.
Why "snakeoil"? Sounds like the system actually caught the intrusion once operable! The fact it was silently down for god knows how long is another matter... > Remind me again, how did Equifax get SOC 1&2, and ISO27001 certified? You probably already know that these are compliance CYA focused around process not actual measure of how secure the system is (if there could be such a thing).
As another person pointed out, it's just usual to name this certificate "snakeoil" because it's just ticking a box mechanically and serves little to no functional purpose. The service won't run without a certificate, this is a certificate, good enough. You might prefer to think of it as a placebo, but "snakeoil" seems to be usual name. Yes, you're correct ISO standards are very focused on paperwork. One of the fears…
Funny you mention ISO 26262 and somewhat were pointing to the dumpster fire that is Misra-C :D
Eversince ISO 21434 got rolled out, all Tiers are panicking because they need to introduce modern CI/CD pipelines that work with source verification. Simple things like generating an SBOM become impossible because even the Tiers that sold you their software don't have the source code themselves and just redistribute binaries from another Tier down the line.
I am somewhat a strong opponent of using C for these kind of areas because in the automotive industry I learned the hard way that these firmwares are pretty much the definition of unmaintainable.
Sometimes Tiers even cannot compile their own software anymore because they lack licenses of old Vektor DaVinci versions, and they literally have deals with Vektor where they send zip files and an excel spreadsheet that reflects the dependencies of kernel modules, and a _person_ not a program sends back the compiled firmware.
Re: How Equifax Was Breached in 2017
#108Earlier quoted context omitted.
A tiny penalty. The CIO got a $3M bonus, too. Odd thing is that she had a music degree and little experience in IT, but was an old friend of the board members.
Not enough downvotes for this. I'm assuming this is all BS considering you got all the details wrong. It was the CEO who got a $3 million bonus in 2016, not the CIO. Susan Mauldin, who earned a music degree in college, was the Equifax CISO, not their CIO. The reason I'm so salty about your response is when the breach happened, there were tons of news reports denigrating the CISO because she had a music degree. There…
As a former insider, I agree with all of this. Thanks for being a voice of sanity.
The music degree scrutiny is unnecessarily derogatory and borderline misogynistic. She was a fine executive and predictably the first one thrown under the bus. I can't say she revolutionized anything, but I had no complaints about her competence. (By comparison, the male C-levels in the company I currently work under have relevant degrees from impressive institutions. I see them watching porn, engaging in insider trading and doing God knows what on Tor...while our latest two product launches failed.)
Equifax's fate was sealed by the CEO himself. We had highly-competent security teams that kept up with CVEs, ran CABs, everything a "secure" org should do...but there was always a top-down culture of "I'm not saying don't patch systems, but don't impact production" at every level. This sort of event was inevitable under Smith's leadership.
Re: How Equifax Was Breached in 2017
#109Not mentioned here was that the group that exploited the vulnerability handed over to PLA linked individuals who then conducted the exfiltration. https://www.justice.gov/opa/pr/chinese-military-personnel-ch... As far as I am aware the data has never been seen on the open market, so there's a whole other National Security story around whether the information was used to compromise individuals with credit issues for co…
Also mis-mentioned, is that I heard nothing was "missed" but security upgrades were not possible due to the age of the stack. Pre-0 days are one thing. But leaving systems unpatched for months, because your stack is too old, is a common, but inexcusable theme. This is why it is vital to use libraries, frameworks, with a stable, unchanging LTS branch. Failure to do so, means a security update that needs to be applied…
> This is why it is vital to use libraries, frameworks, with a stable, unchanging LTS branch. Failure to do so, means a security update that needs to be applied instantly, cannot be done, without extensive app changes.
It's also another reason why it's important to provide such things.
It's amazing to me how many people seriously argue it's fine to aggressively drop support for old versions and old features to focus on the newest stuff (and that it's totally fine for table-stakes of "having software" is to have engineers continuously working to keep up with changing dependencies.
The reality is the cheapest thing for society is to offer very long term support for old versions, even if it's just security patches, or well-tested backwards-compatibly features in newer versions. It's not sexy work, but it's important.
Re: How Equifax Was Breached in 2017
#110Earlier quoted context omitted.
Also mis-mentioned, is that I heard nothing was "missed" but security upgrades were not possible due to the age of the stack. Pre-0 days are one thing. But leaving systems unpatched for months, because your stack is too old, is a common, but inexcusable theme. This is why it is vital to use libraries, frameworks, with a stable, unchanging LTS branch. Failure to do so, means a security update that needs to be applied…
> This is why it is vital to use libraries, frameworks, with a stable, unchanging LTS branch. Failure to do so, means a security update that needs to be applied instantly, cannot be done, without extensive app changes. It's also another reason why it's important to provide such things. It's amazing to me how many people seriously argue it's fine to aggressively drop support for old versions and old features to focus…
Quite true.
But such things do exist, you just have to vet things first.
For example, stick to a non-rolling distro, such as debia n stable. Everything there will have around 3 years support, with all the security updates done for you.
Debian backports almost all security patches, or sticks with an LTS variant of something (like php) for its lifetime.
No surprise API changes, no sudden need for code changes.
So many people use the latest shiny, and literally only because they're told to. Many need nothing from that bleeding edge version.
When it comes to frameworks, some have LTS versions, stick with those.
And things like node? Heh.