I like how this news was posted on Friday afternoon before the Memorial Day weekend.
Taking out the trash, as it were
First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
111–120 of 171 posts
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#112Earlier quoted context omitted.
Pretty good, everything was probably set up and configured with default settings by that unpaid intern they had running their infrastructure back in 2003.
default settings would wipe/rotate logs after some time, no?
Rotate maybe, not wipe. As far as I'm aware for most webservers you have to tell it to rotate the logs based on some criteria, otherwise it just keeps appending.
If debugging is turned off it's entirely possible that they have been appending lines to the same log file for the last 20 years and haven't run out of disk space which would cause them to notice. Say 200 bytes in the log per request, and even averaging 10000 (probably more than they get) requests per day, in 20 years that's only 13GB.
It's also entirely possible they turned logging off or redirected to /dev/null in order to "be more efficient".
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#113Where does one go to learn how to not cause this one day?
OWASP Top 10 list. OWASP's website is kind of a mess in my opinion, but there are numerous external write-ups about the top vulnerability types.
https://www.cloudflare.com/learning/security/threats/owasp-t...
Also this github repo maintained by OWASP seems pretty exhaustive. The cheatsheets directory has a lot of different vulnerability classes.
https://github.com/OWASP/CheatSheetSeries/blob/master/cheats...
This "Insecure Direct Object Reference" was recently combined into the "Broken Access Control" category with a few others.
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#114A lot of discussion on technical side, but not from organisational.
How could audit, both internal and external, not find this? 2003 to today is 16 years. Audit is a last line of defence and certainly not to be relied on upon as a buddy to catch your errors. But... how? This is a major financial institution in the most developed country in the world (the clue's in the name). It should subscribe to the the highest integrity and tightest scrutiny. This seems an opportunity for both internal and external auditors to tighten their game.
Outside of audit, surely an employee might have noticed? Was there no formal method to speak up without fear of recrimination? According to Wikipedia [1] there are eighteen thousand employees. Someone never noticed?
This seems an organsiational failing, not a technical one.
[1] https://en.wikipedia.org/wiki/First_American_Corporation
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#115Whenever you are compelled to upload/send a photocopy of an ID document it is sensible to write the date and purpose / file reference on it. If it appears in a document dump at some later date you know the path and date of the leak.
This is excellent advice. You might not be able to write on, for example, a passport taking a photo of, but can certainly put a postit note-type sticker on it.
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#116I just closed on my first house this week, and First American was of course my title company. I'll be interested to see if my data is included in this breach settlement or not.
I did notice when I was reviewing my docs that they emailed links to unauthenticated copies of docs, but they were mostly public records so I didn't think twice about it.
So they have my Name, address, email, SSN, copy of ID, copy of check from my bank with account/routing on it and much more, all in the open apparently.
I just went through an SSO implementation with a small team for a large user base. It was a bigger project than we had anticipated, but nonetheless manageable. I can't fathom that a financial institution of that scale could be that lax with basic security. Wouldn't their systems be subject to some regulation and require some kind of audit on a regular basis? Is this a failure of auditing systems, as well as internal security or even basic IT?
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#117A lot of discussion on technical side, but not from organisational. How could audit, both internal and external, not find this? 2003 to today is 16 years. Audit is a last line of defence and certainly not to be relied on upon as a buddy to catch your errors. But... how? This is a major financial institution in the most developed country in the world (the clue's in the name). It should subscribe to the the highest int…
You can access documents all the way back to 2003.
That doesn’t necessarily mean that this hole has existed that long.
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#118> He said anyone who knew the URL for a valid document at the Web site could view other documents just by modifying a single digit in the link. Good thing he didn't post this bug online after getting no response. I remember reading about someone who did that on an AT&T website a while back and was sent to jail for simply incrementing an id number in the URL and talked about it on Twitter.
That was probably about weev, and they were after him long before that case, so it's not likely that it would get some random person (that the FBI doesn't have a file on and an interest in picking up) in the same trouble.
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#119Earlier quoted context omitted.
default settings would wipe/rotate logs after some time, no?
Rotate maybe, not wipe. As far as I'm aware for most webservers you have to tell it to rotate the logs based on some criteria, otherwise it just keeps appending. If debugging is turned off it's entirely possible that they have been appending lines to the same log file for the last 20 years and haven't run out of disk space which would cause them to notice. Say 200 bytes in the log per request, and even averaging 1000…
[deleted]
Re: First American Financial Corp. Leaked Hundreds of Millions of Insurance Records
#120I did a penetration test for $NATIONALINSURER and they had an FTP site with weak credentials where all the remote offices uploaded claims. Millions of records and scans of SSNs, home addresses, bank information, etc. Their mitigating controls were: we put it behind a firewall. Then again I didn't expect much, their MSSQL in prod had SA/SA credentials active.
I'm currently fighting against management dragging their feet on using 2FA. On HIPAA PHI. (I know HIPAA doesn't actually mandate 2FA, but it's recommended by many best practices and guides.) Apparently some tech folks don't like the inconvenience of 2FA.
2FA freaks me out. It means I'll be locked out of all my key accounts and services if ever my phone breaks or gets lost. Probably right when I need these services most.