Equifax Was Warned (vice.com) 86
Lorenzo Franceschi-Bicchierai, reporting for Motherboard: Months before its catastrophic data breach, a security researcher warned Equifax that it was vulnerable to the kind of attack that later compromised the personal data of more than 145 million Americans, Motherboard has learned. Six months after the researcher first notified the company about the vulnerability, Equifax patched it -- but only after the massive breach that made headlines had already taken place, according to Equifax's own timeline. This revelation opens the possibility that more than one group of hackers broke into the company. And, more importantly, it raises new questions about Equifax's own security practices, and whether the company took the right precautions and heeded warnings of serious vulnerabilities before its disastrous hack. Late last year, a security researcher started looking into some of the servers and websites that Equifax had on the internet. In just a few hours, after scanning the company's public-facing infrastructure, the researcher couldn't believe what they had found. One particular website allowed them to access the personal data of every American, including social security numbers, full names, birthdates, and city and state of residence, the researcher told Motherboard.
Regardless of any warning (Score:5, Insightful)
Re: (Score:2, Informative)
Re: Regardless of any warning (Score:5, Informative)
Re: (Score:1)
sure dumbass
Senate votes to roll back Obama-era rule allowing consumers to join forces to sue banks and credit-card companies [marketwatch.com]
Speak for yourself (Score:2, Insightful)
that's what we voted for. so get over it.
"We"? Speak for yourself. I didn't vote for Trump and I'm certainly not about to "get over it" until he is removed from office.
Re:Regardless of any warning (Score:5, Interesting)
Except most of the harmed never signed any agreement that includes FORCED ARBITRATION in their relations with Equifax, because the harmed are NOT Equifax customers. That means that all effected US citizens who are not Equifax customers CAN sue directly or via class action.
The issue will be showing that you were damaged specifically by Equifax's negligence. They will likely defend themselves via all the reports of the similar losses of the same and similar personal data via other corporations also piss poor security practices.
It will be very hard for any specific individual or class to show losses specific to Equifax. Sure , you may be able to show identity theft and losses because of it, but was that specifically because of Equifax? Good luck proving that.
Equifax certainly does deserve the "Corporate Death Penalty." But there are many ways for them to avoid it, followed by a fresh coat of paint and likely a new name. Just watch....
Today there is no such thing as a responsible corporate citizen. There probably never was.
Re:Regardless of any warning (Score:5, Insightful)
Yeah, but the only way to cripple Equafax would be to make it toxic to do business with them.
The real message would be class action against the banks that hand over the information to places with poorly vetted security.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2, Insightful)
I don't really care about if they were warned or not. I care about tearing apart the existing social security number as an authentication mechanism. Equifax has destroyed that for us, we need to deal with the reality that it needs to be changed out with something better ASAP. (Whether it's a smart card, or just a longer number system with new numbers or something. It's been due for a revamp for decades. The problem with revamps is that typically they allow legacy systems to exist. We need to kill it with fi
Re: (Score:2)
Equfax did nothing wrong...
TROLLFACE.TIFF
Re: Regardless of any warning (Score:2)
Re:Regardless of any warning (Score:5, Interesting)
This is a classic example of perverse incentives. Equifax gets paid when people need fraud protection (directly and indirectly), so the more cavalierly they handle consumer data, the better off they are.
Re: (Score:2)
Re: (Score:2)
And this is why Equifax need to be sued and go bankrupt, handing all of its money to people who got their information stolen. It won't be much per person, so it is not even fair for the people, but it will be the only fair measure, as well as an important step for the future.
Business school will then teach "Security is important, remember the Equifax case ...".
And yes, I'm aware everyone at Equifax will loose their jobs, but that the kind of decision that need to be made.
Re: (Score:2)
While true. those that messed up will not supper much in the way of consequences. And that is why this thing will continue.
Re:Linux in Action! (Score:5, Informative)
Apache Struts had plenty of quality control. The bugs in question were patched LONG before any breach. The fact that it's open source is what enabled a third-party security company to discover and report the security vulnerability so quickly.
It's a double-edged sword, since not patching your systems means that vulnerabilities are published for all to see. But the patch was available.
Re:Linux in Action! (Score:5, Insightful)
It doesn't matter what you use if you don't patch it.
Yes and no. (Score:2)
Over any period, the number of Linux kernel flaws will absolutely dwarf the number of flaws patched in the OpenBSD kernel [openbsd.org].
There are consequences when choosing popularity over correctness [forbes.com].
Re: (Score:2)
OK, but this particular case was a flaw in Apache Struts - so no matter their OS they would need to apply the patch.
Re: (Score:2)
Counting metrics are useless. Unless you take into account what was actually patched, you will come to invalid conclusions like yours.
Re: (Score:2)
It's so old, half the M fell off!
Re: (Score:3)
That's why I prefer commercial software with well established quality control.
And what commercial software is that? It's not like all commercial software has great quality control. Have read this >month's security bulletins from the likes of Oracle [oracle.com], Microsoft [microsoft.com], etc. Also in the case of Struts, it had been patched months prior to the intrusion.
Re: (Score:2)
Well, with morons like you around, at least the hackers need not worry about getting more opportunities in the future.
Enron them (Score:1, Insightful)
They ought to be on the hook for damages to every person affected — with a meaningful minimum even for those of us, who can not demonstrate actual harm. Just because my details are now accessible to anyone anonymously.
Yes, it will bankrupt them, and that'd be a good thing. Have them go the way of Enron and Ashley Whatshername...
Re: (Score:2)
Have them go the way of Enron and Ashley Whatshername...
Equifax is a "systemically important financial institution" like AIG, according to FedGov. You are (paradoxically) asking for bailouts, more risky behavior, and creeping fascism [econlib.org].
Re: (Score:1)
So would've been Enron, if we had this ruinous (and, yes, fascist) concept back then.
I most certainly am not.
Smells (Score:2)
This smells of Class Action Lawsuit !
Or more than one...
Government and independent watchdogs needed (Score:2)
I think we need private and governmental bodies where people can submit complaints about security vulnerabilities.
Governmental body: Something like the CFPB but for security and privacy related concerns.
Private watchdog groups: We also need an org that exists that can be notified whenever a security or privacy vulnerability is reported to a company. Such a group could keep track of info, be designated as a proxy to be provided with updates/responses on when and if a security or privacy vulnerability is be
Re: (Score:2)
With the system we have, those watchdogs will fall to regulatory capture, and at best, be a rubber-stamping department.
The only thing that really can break this trend is Europe's GDPR. Time will tell if it actually will get companies to do something about security, or if it winds up being a joke, like SOX (where it was used to jail a guy who ran over his fishing bag limit at its best.) I'm sure BRICS will have similar laws on the books soon, because they want to stick it to US companies, so even that migh
That's why data collection should be illegal (Score:1)
This is exactly why such personal information collection should be illegal. Of course there wouldn't be a problem if companies applied proper security mesures, but that's exactly the problem: There will never be appropriate security mesures in place. Ever. Period. No amount of legislation will ever change that. History has shown time and time again that hackers will always win.. The consequences of such information falling into the wrong hands are just too great.
So until the system is changed in a way that
A certificate system... (Score:3)
There is a way to have enough data for a transaction, but no more. A certificate based system, where one's ID card just validates the cardholder is whom they claim to be, and is a repository for certificates. For example, a certificate showing the person is over age 21. That way, they can go to a bar in the US, and the cert provides what the bar needs to know to comply with the law. The bar doesn't need names, ages, or anything else. Just that the bearer is over 21.
This could be extended to a lot of ot
Re: (Score:2)
From a technical point of view, you are of course correct.
But the sad, unfortunate truth is that even hard core techies haven't been able to do this among ourselves. We could use certificates and PGP (or GPG) to secure our communications, but who in real life actually does that? If we can't do it, how can one expect the increasingly dumbed-down masses to?
To your point on small, scattered databases: gathering them all into a single point of contact sounds like a business plan that would easily get funded
Re: (Score:2)
You have proposed a
(x) technical
( ) legislative
( ) market-based
( ) vigilante
solution to fighting fraud.
Specifically, your plan fails to account for:
(x) people are dicks
(x) average people won't understand it
(x) companies will fuck up the implementation
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
Furthermore, this is what I think about you:
(x) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid
Complete and total incompetence! (Score:2)
Re: (Score:3)
You're angry and you should be. But this rabbit-hole is a lot deeper than some guys at Equifax - in short, Equifax doesn't owe you, the consumer, anything. They aren't charged with protecting you, like the way a cop has a duty to protect you from a criminal, or a soldier is charged not to aid and comfort the enemy. Equifax has all their data because banks, whom you entrust with your money and from whom you borrow money, give it to them. They store it, perform analytics on it, and sell it back to the bank
Re: (Score:2)
Re: (Score:2)
I was under the impression that it was illegal for companies to use SSN as an identifier. Why do the credit reporting agencies still get away with doing it?
I suppose that is just one of the many laws that don't apply to financial institutions.
Re: (Score:2)
Apparently its just illegal to ask for it: http://www.timesunion.com/loca... [timesunion.com]
Since credit agencies don't ask for ANY of the data they have on you, they just take it, it is ok for them to do whatever they like.
Re: (Score:2)
With all due respect, I think that's a bunch of bullshit. There HAS to be something that can be done about this or our entire economy could come crashing down. Legislators, judges, and law enforcement will FIND ways to punish them.
With likewise respect, the power is in the legislators. Unless there's a consumer protection law that's been broken, there's little that judges and courts can do short of people just plain suing, such as in a class-action. But in the latter you have to prove harm, prove that Equifax caused the harm, and prove that Equifax had a duty not to cause the harm - and prove all of this to a jury. With Enron, it was easy because $billions were lost in fraud, plain lying about how much money they had, lied about wh
Re: (Score:2)
This happens when IT departments get too big! (Score:5, Insightful)
I've worked in big companies for a long time and I'm not surprised. The IT security people are usually in-house, but I wouldn't be shocked if they were offshore or totally outsourced. When the IT security team is contacted by a "researcher" telling them somehting's vulnerable, big IT departments will take forever to put anything into place. First the security team has to run it up the flagpole to their management, then their management has a meeting to decide what course of action to recommend to the server team. The server team (who also may be offshored or outsourced, which introduces more delays) will be told that they have a vulnerability to patch. Application owners affected will need to be contacted to determine when a good time to patch will be. Worse still, if it's a shared service like a service bus or core application component, you have to coordinate that among all the systems' users. Only then can a change management notice be raised, then discussed at the Change Approval Board meeting, then scheduled. At any point, this can also be delayed by the application owner saying they can't take the downtime.
I'm sure all the DevOps kids will say "dude, just put it in the cloud and CI/CD it...we release 20 times a day!" Legacy financial systems are a different animal. You might be able to release the web front-ends to a system like that 20 times a day, but big company IT's complexity and culture make it hard to apply this to the core.
Re:This happens when IT departments get too big! (Score:4, Interesting)
You hit upon the real problem: Companies put more focus on the bottom line, than doing what is right for their customers. Hence operating with minimal IT workforce, and resorting to off-shoring and other cost saving methods that directly impact their ability to deliver quality code, and more importantly keep it updated to avoid zero day exploits (as studies have found most zero day exploits take 6 months to a year to find and a fix to be coded, yet the average time for systems in the wild to be updated is 3 to 5 years). IT should know every piece of code that is placed in the network and its source.
So, what's the fix, aside from reforming corporation and stock market rules? Corporations need to know that if they don't take security seriously there will be bad outcomes for them. Lawsuits are one mechanism for this. Another is through customer choices - boycott companies that don't take security seriously. For corporations that actually want to make changes to deal with this correctly, IT culture needs to change in the following ways:
* IT should know every piece of code that is placed in the network and its source. This means having an absolutely clear understanding of every library, framework, and any non-standard custom extensions deployed. This will serve two purposes. On the one hand it will ensure that IT is being proactive about patching to avoid zero day exploits. On the other hand it will drive simplification and good software engineering; another way of saying this is KISS (Keep It Simple, Stupid). The more complex systems you put into place - and more importantly the more that complexity comes from code that is generated outside of your own organization, the more likely there are for bugs (potentially exploitable zero days) to exist within the overall code base.
* IT costs need to be viewed as a cost of doing business, rather than something that can be dispensed with or minimized. To do security right takes resources, and this has increased relevance not only with breaches that we've seen happening, but also to meet corporate requirements from a legal and regulatory perspective (e.g. Sarbanes-Oxley). Costs can be managed, if companies are willing to invest in building automation to help them manage what they've got - and doing that first item above (weeding out overly complex designs).
* IT needs to also change their culture from what I call a 'shrink-wrapped' software mentality - where software is thrown over the wall to operations and the developers walk away and never work on it again, to a culture that values long term developer ownership and maintenance of systems they have created in partnership with operational teams. This is related to something else that I see a lot of in IT: brain drain. Basically, due to nomadic existence of developers in an organization either through rotation or vendor outsourcing, long term knowledge of integration between existing systems and new development is lost every year to 18 months - breaking the ability of the company to quickly patch or otherwise modify systems in response to security issues or simply the need for responses to competitive forces.
We could transform IT from a necessary burden to a much needed and appreciated partner in business. But, that will require the decisiveness on the part of CTOs, and CEOs to dedicate resources to that specific mission.
Re: (Score:2)
In fact, I can confidently predict the organisations involved will plead "not guilty by reason of corporate insanity" - and that will be extremely difficult to refute.
Re: (Score:2)
Three points however.
1) Equifax doesn't have "financial" systems. They are an information broker.
2) Equifax I don't think have really been around long enough to really have what I would consider "Legacy" systems.
3) Even if you could consider them either #1 or #2, typically the security and the security vulnerabilities are not going to be located on the systems themselves, but rather how they are connected to the outside world, which also would be neither #1 or #2.
Disclaimer: I manage a lot of real legacy sy
What was the warning? (Score:4, Funny)
Data altered? (Score:2)
Could it be proved either way? Speaking of a real can of worms legally, can one now challenge that data if you don't like it under the assumption it's been hacked?
Could you get a security clearance via hacking OPM? Ramifications are interesting here. If one had content of both, they'd know who to blackmail as well. And these are the guys who want
It's okay now, though - they can't be sued! (Score:1)
Be reasonable.. (Score:1)
Of course they were warned (Score:2)
However, the sad fact of the industry is that a great many (though not all) organizations are told over and over by those who know internally of the risks.
But security is hard. There is no room for cutting corners. You either have partitioned networks, or not, locked down firewalls, or not, encryption, or not, and so forth. But too often, cuts are made for expediency. When good, fast, or cheap is chosen in such domains, you don't usually even get to chose two: you get to chose one. And too often, the d
Re: (Score:3)
Re: (Score:2)
Cost amputation, then, if you want. But the fact that they cut so deep as to be criminally negligent does not undermine the basic argument that in the eyes of those who have the final say in what is resourced and paid for and what is not, there is no significant penalty for security breaches, but there is a penalty for paying the high cost of good security.
Deregulation for the win (Score:4, Interesting)
The US doesn't even have a current Cabinet-level person doing anything related to security in a real way. "Giuliani Security & Safety" does NOT count. Rob Joyce has TWO full time jobs, one as the "White House Cybersecurity Coordinator" and another as "acting deputy homeland security adviser to the President". While those may have overlapping duties, it's obvious that cybersecurity needs to be it's own separate gig. I would even go so far as to say we need a "Commercial Cybersecurity Czar" to separate out the government vs public, as these are quite different in scope and approach.
However, seeing the kind of people Trumps likes to appoint, I would expect someone who thinks cybersecurity is a "hoax" and believes that corporations will be forced to secure themselves "if only allowed to by the invisible hand of the free market"; who would then nullify HIPAA and censure / fire / dismantle the part of NIST that writes the 800 series.
This is what happens (Score:1)