Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Equifax’s Maddening Unaccountability

nytimes.com

Post reply on HN
Print view View original

231–238 of 238 posts

Re: Equifax’s Maddening Unaccountability

#231

Post by drewmol »

kahnjw wrote: post #168
drewmol wrote: post #158

Equifax played a slightly different version if this commercial during Monday Night Football a few times, it takes no accountability, but also doubles-down, claims your info might* be on the dark-web(*because they just negligently released it), and offers a "dark-web-scan" service to help find it... https://www.youtube.com/watch?v=vjrydnr_pvQ

Experian != Equifax

Thanks, that was my mistake I confused the two and didn't even notice before posting. Too late to delete my inaccurate comment(mods?). It certainly makes sense for Experian to advertise this service given their competitors recent leak.

Re: Equifax’s Maddening Unaccountability

#232

Post by danjoc »

gipp wrote: post #228
danjoc wrote: post #222

Earlier quoted context omitted.

"No software system can be free from bugs (or intruders), and users must be mindful of the risks. But the inherent lack of perfect automotive safety doesn’t mean we don’t try to make cars safer. Obviously, people should drive more carefully, but seatbelts, airbags and better car design reduce injury enormously, and that has been great for the industry as well as consumers. The software industry should be no different…

If I build an airbag in my garage, and Honda shows up tomorrow and puts it in their car, and it fails because I don't know how to make good airbags, I would not be legally liable for those failures. Honda, however, would be. Your analogy does not hold up. You're reading some _very_ specific things into what is a very general statement. I get why you'd be upset if she was attacking the things you say she is, but she i…

>If I build an airbag in my garage, and Honda shows up tomorrow and puts it in their car, and it fails because I don't know how to make good airbags, I would not be legally liable for those failures.

https://en.wikipedia.org/wiki/Takata_Corporation

Re: Equifax’s Maddening Unaccountability

#233

Post by gipp »

danjoc wrote: post #232
gipp wrote: post #228

Earlier quoted context omitted.

If I build an airbag in my garage, and Honda shows up tomorrow and puts it in their car, and it fails because I don't know how to make good airbags, I would not be legally liable for those failures. Honda, however, would be. Your analogy does not hold up. You're reading some _very_ specific things into what is a very general statement. I get why you'd be upset if she was attacking the things you say she is, but she i…

>If I build an airbag in my garage, and Honda shows up tomorrow and puts it in their car, and it fails because I don't know how to make good airbags, I would not be legally liable for those failures. https://en.wikipedia.org/wiki/Takata_Corporation

If they have liability, it is assumed as part of their supplier contract with Honda. Open source software does not have this, and nowhere does the author suggest that should be the case -- they _certainly_ do not suggest such an assumption be implied without a license, or forced to be in all OSS licenses, which would be the only way your complaint makes sense.

Re: Equifax’s Maddening Unaccountability

#234

Post by danjoc »

gipp wrote: post #233
danjoc wrote: post #232

Earlier quoted context omitted.

>If I build an airbag in my garage, and Honda shows up tomorrow and puts it in their car, and it fails because I don't know how to make good airbags, I would not be legally liable for those failures. https://en.wikipedia.org/wiki/Takata_Corporation

If they have liability, it is assumed as part of their supplier contract with Honda. Open source software does not have this, and nowhere does the author suggest that should be the case -- they _certainly_ do not suggest such an assumption be implied without a license, or forced to be in all OSS licenses, which would be the only way your complaint makes sense.

>Open source software does not have this, and nowhere does the author suggest that should be the case

"the underlying reason is political, and it’s pretty simple: Big corporations have poured large amounts of money into our political system, helping to create a regulatory environment in which consumers shoulder more and more of the risk, and companies less and less."

The author is suggesting a political solution. Regulation. Laws that say "Your open source license can't exempt you from a, b, c, d."

You could then exempt yourself from lawsuit in your open source license, but that will be automatically void, like a non-compete clause in a California employment contract. Struts would be sued for the breach in her imagined world.

Re: Equifax’s Maddening Unaccountability

#235

Post by elkos »

gaius wrote: post #174
cloakandswagger wrote: post #84

Earlier quoted context omitted.

The statement released by Apache said that, if the attack did use the REST plugin vulnerability in Struts, then it would have been a zero-day at the time of use.

You will note that Equifax is not a contributor to Struts - cash or code. They are trying to shift the blame onto something they got for free and work other people did for free.

It's my understanding that Equifax is a multibillion dollar org. (Something in the order of 17 billion USD). Since Struts is a major part of their business infrastructure one would expect a contribution to the Struts project and other software they rely on. They could spin it as "Social Responsibility" too.

In retrospect it seems more cost effective to do so too, even if Equifax manages somehow to pay only a few hundred million dollars.

Re: Equifax’s Maddening Unaccountability

#236

Post by jamesmattis »

hmhrex wrote: post #215
jamesmattis wrote: post #210

Whatever happened at Equifax was disastrous. But I really liked the way that they are containing it. Their CEO released a statement. They launched a specific site for security scans for their user for free. They are communicating it to their customers transparently. With that I also saw that cyber security is and will be the biggest threats of the next decade. They are many cyber security companies these days but I d…

> But I really liked the way that they are containing it. Please let this be sarcasm... > They are communicating it to their customers transparently. They knew well in advance that there was an issue and did not communicate it well. They have 3 higher managers that look to have sold their stock based on the knowledge. There are some reports that they knew up to 3 months ahead of their announcement. > They launched a…

I accept my mistake in judging the situation. Thanks a lot for elaborating it. I agree to all your points.

Re: Equifax’s Maddening Unaccountability

#237

Post by codecamper »

joefkelley wrote: post #51
codecamper wrote: post #24

I just read about how the hack was done. Shockingly stupidly easy! 1. They realized that Equifax uses Struts. 2. They modified struts! and 3. Equifax used the updated code on their servers. DUUUUUHHHHHH!

Do you have a source for 2? I'd like to read more about it.

a $ 14 billion company gives away the only secret data that they exist to protect. Why? Because they used Struts. How difficult is it to write a slimmed down, secure version of Struts?

Re: Equifax’s Maddening Unaccountability

#238

Post by kelnos »

jeremyjh wrote: post #102
kelnos wrote: post #74

Earlier quoted context omitted.

> You may want to think twice. Try to design an architecture that doesn't have that. We have an architecture like that where I work. It's not that hard. Our web applications have very little direct access to databases; most of it is mediated by services downstream of the web app. That's certainly not a silver bullet, but it makes it impossible to exploit a RCE vuln in the web server in such a way that it lets you hav…

And let me guess. Those services give the webservers...the data that they ask for? Once you've compromised a server, learning how to ask for the data you want is not hard. You have access to all the webserver's code, can make full dumps of communications occurring normally in the app, etc.

It's different, though. If my web server has direct database access, and it gets compromised, an attacker can go in and directly do "SELECT * FROM users" and get all my data in one go. If the database is behind a restrictive service, and they compromise just the web server, then they have to sit on the web server and pull each user record one at a time. And they might not even be able to, depending on search options -- like they might just be able to do "GET /users/{userId}", and if you don't know the user IDs, you get nothing (our user IDs happen to be randomly-generated 128-bit numbers, so searching through that space would take a while). Even if they can get past that hurdle, the extra traffic it would require to pull down the full database with one request per user would certainly set off alarms, and doing it slowly enough to not set off alarms would just take too long.

Of course, another option would be to use the web server compromise to then jump to the database service and compromise that box as well, but, again, more hurdles to jump means less of a chance of success.

Nothing is perfectly secure, but you can design systems with defense in both breadth and depth, and you can slow down or defeat many attackers that way. It's not about making Fort Knox, it's just about making breaking in more expensive than they can handle.

Post reply on HN