Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Equifax Was Breached in 2017

blog.0x7d0.dev

Post reply on HN
Print view View original

111–117 of 117 posts

Re: How Equifax Was Breached in 2017

#111

Post by totallywrong »

mejutoco wrote: post #97
totallywrong wrote: post #85

Earlier quoted context omitted.

I work mostly on Infra / DevOps. I'm constantly amazed by the absurdly low standards most devs have when it comes to security. The path of least resistance is chosen 99% of time. You're definitely the exception.

IMO often this just reflects the priorities of the organization. While it is the responsibility of devs, some system needs to be put in place to actually enforce it. Like, do not have an nfs shared volume, or incentivise anybody to report these, and give incentives for it. Otherwise "just be very careful" advice slows development to a halt.

I only half agree. Of course the company needs to have processes in place. But having shared storage can serve a multitude of legit purposes, and I feel like some alarm should go off in a developer's mind when he thinks of just dumping secrets there. Or the next one who comes and use them.

Or you might not have shared storage, and then they'll just put the creds in a Google spreadsheet like I've seen very recently.

Re: How Equifax Was Breached in 2017

#112

Post by hnthrowaway0315 »

blisterpeanuts wrote: post #103
hnthrowaway0315 wrote: post #91

Earlier quoted context omitted.

A lot of companies are like that. In my previous company people sharing username and password through MS team and I'm sure someone stores them in team folders too.

In the early 90s, at a large financial company I worked for, the system user name/password for a Sybase db was sa/sa. It was so convenient. Of course this was the primordial days but still.

Sybase! Ah, my father has a book about that. Yeah I get back in the days many are ignorant about security.

Re: How Equifax Was Breached in 2017

#113

Post by TheHappyOddish »

dwd wrote: post #32

Not mentioned here was that the group that exploited the vulnerability handed over to PLA linked individuals who then conducted the exfiltration. https://www.justice.gov/opa/pr/chinese-military-personnel-ch... As far as I am aware the data has never been seen on the open market, so there's a whole other National Security story around whether the information was used to compromise individuals with credit issues for co…

What an odd thing to do. I assume the US has no way to enforce this, so it's effectively just... a press release?

I also found this funny:

> “Today, we hold PLA hackers accountable for their criminal actions, and we remind the Chinese government that we have the capability to remove the Internet’s cloak of anonymity and find the hackers that nation repeatedly deploys against us.

And then:

> The details contained in the charging document are allegations. > The defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.

Re: How Equifax Was Breached in 2017

#114

Post by ahhfgshando6698 »

hn_throwaway_99 wrote: post #39

I really appreciate detailed breach reports like this. This was the money quote for me: > The attackers continued their search and eventually discovered a mounted NFS share on the web server. This file share contained notes and configuration files used by Equifax engineers, in which they found many database credentials. Seriously, WTF? I get paranoid all the time worrying about my application security - it often feel…

It's nfs so I always assume corporate acceptance of Microsoft is the root cause. Old companies like this are often incredibly insecure due primarily to the wildly irresponsible practice of having everything on active directory and network drives in general.

Once you've got a whole company that relies on dumping stuff on a network drive you're pretty much fucked, it's very difficult to get non-technical users to switch to SFTP. It's like pulling teeth.

Re: How Equifax Was Breached in 2017

#115

Post by [deleted] »

eli wrote: post #93
foota wrote: post #50

Earlier quoted context omitted.

Better than culture is enforced guarantees, nobody can store the database password on an NFS share if it's not available to them.

If you take away NFS shares without providing a better way to store and manage access controls, engineers will eventually just come up with an even worse solution. I'm skeptical you can even fix this without a culture change, but you definitely can't do it just by taking things away.

[deleted]

Re: How Equifax Was Breached in 2017

#116

Post by JamesSwift »

blisterpeanuts wrote: post #102
tekla wrote: post #100

Earlier quoted context omitted.

> an audit should include scanning all files for passwords Please continue taking the security course. Scanning all files for passwords is madness. How do you differentiate "thisissupersecret" and "123fqfqlfni34235r4" and "git@somegitrepo.com" as passwords? You can't, they're all valid passwords for a majority of services. At some point, you need to trust developers to do the right thing, which is impossible.

You're right, but I was thinking of searching for known passwords. For example, if an Oracle db accessed by developers is tekla / tekla1234, then scan for the string "tekla1234". It should not exist in any file. If it exists in a file, then obviously that is a potential leak.

And where do you intend to store these "bad" passwords in order to scan??

Re: How Equifax Was Breached in 2017

#117

Post by ponyboy123 »

JamesSwift wrote: post #116
blisterpeanuts wrote: post #102

Earlier quoted context omitted.

You're right, but I was thinking of searching for known passwords. For example, if an Oracle db accessed by developers is tekla / tekla1234, then scan for the string "tekla1234". It should not exist in any file. If it exists in a file, then obviously that is a potential leak.

And where do you intend to store these "bad" passwords in order to scan??

Don’t be so mean to the guy.

One approach would be to have passwords of a known format, that are rotated frequently, and to verify that you’re not finding any strings matching those patterns save to disk or in log files, etc.

Post reply on HN