Looks like the bad guys may have broken into Equifax using a known hole in Apache Struts

Topic

New Reply

Apache Struts is an open-source package that runs on servers to help Java web developers. Translation: If you don’t understand, you don’t need to worr
[See the full post at: Looks like the bad guys may have broken into Equifax using a known hole in Apache Struts]

4 users thanked author for this post.

Elly, Noel Carboni, ch100, MrBrian

Reply | Quote

Replies

Just to be clear… It’s by no means certain that Struts is the source of the breach. Equifax isn’t saying much.

Reply | Quote

I’m of the opinion that web development is seat-of-the-pants, as compared with real software engineering.

To think that security critical to the foundations of economy can be breached because of the (lack of) quality of web development work is downright scary!

The question then becomes: What do you do? Move to the woods and take up farming? You can hardly get by without credit cards and hope to participate in modern society.

-Noel

3 users thanked author for this post.

Elly, HiFlyer, DeWayne12

Reply | Quote

I think one problem with web developers versus programmers is the nature of the language and tools they use. Markup languages and related tools are content control and layout tools fundamentally. While visually important they are not programming as  there is essentially no logic and data manipulation required. The lingua franca  of the Web, JavaScript, is a badly designed and executed programming language that leads to lots of bugs that are difficult to find and fix. JavaScript is one of three languages that I consider crimes against humanity; the other two are FORTRAN (grounds to never use IBM) and BASIC (crippled FORTRAN that is so bad Dysktra commented that no one who learned BASIC could be taught to program).

Reply | Quote

I guess companies are still going for the lowest bidder when it comes to awarding web development contracts. Many of us who have worked for big companies or specifically government know that contract winners often sub contract the work and that can lead to not getting competent and experienced web developers.

I was surprised to see that Equifax went for a WordPress unsecured web site to offer the hack checker tool. This company is cheap – they should have gone for a sub-domain off their main site with a valid certificate. Their web guys should get pink slips over this entire debacle and so should their management. If a contractor is involved, they should get named and shamed.

The woods are looking a lot safer than the concrete jungle right now.

4 users thanked author for this post.

Elly, GoneToPlaid, HiFlyer, DeWayne12

Reply | Quote

It is even worse than you think. You can type in any last name plus any fictitious last six digits of a SSN and the web page will produce the same message. In other words, the whole page is bogus in terms of whether or not you get a correct response as to whether or not you are affected by this security breach. And of course, Equifax then presents you with a web page which says that you can complete your enrollment for their “free” credit monitoring program which they are offering as a free service to all of their customers. When can you do this? That date is September 15 — exactly the same day that the hackers have threatened to publicly publish all of the stolen data. What a remarkable coincidence!

Moreover, I have strong reasons to suspect that more than one hacker group breached Equifax and that the $2.8 million ransom demand is from just one of them. It is also conceivable that, if two or more independent hacker groups were involved, then one of them wasn’t very good at hiding their tracks such that Equifax and its independent security auditors at this point are only aware of one of them. I say this because there have been a couple of episodes of identity theft of friends which I know, and a recent phone call to me (around two weeks ago) in which the “credit agency” caller claimed that I owed State back taxes. I knew that I did not, yet they persisted in trying to get the last four digits of my SSN. Worse, they had info about all of my previous addresses, and somehow knew my new home phone number which is unpublished. Yet of course my downloaded credit reports do not show any suspicious “pulls” by third parties for advertising and marketing purposes, such as to mail me credit card offers. IN OTHER WORDS, suspicious phone calls combined with the lack of authentic “pulls” by legitimate sources IS YOUR POTENTIAL INDICATOR that your identity has been compromised!

To make matters worse, I tried twice on Equifax to freeze my credit report, yet I was informed that I would have to mail in documents to them in order to freeze my credit info since they couldn’t “verify” my identity. But guess what? Equifax charged me $10 on my credit card twice! One would think that Equifax would only charge me once they had successfully put a freeze on my credit report since that, after all, is what I was paying for. That there is another potential class action lawsuit.

I was stupid to try to put a freeze on my credit report through Equifax. Next, I went to annualcreditreport.com since they are the only free credit report service which is authorized by federal law, and I downloaded my credit reports from the big three credit bureaus. Then I went to TransUnion’s web site to freeze my credit report. It was painless and easy, they charged me only $3, and as a courtesy they also sent my confirmed freeze information to the other credit bureaus as well. I deliberately chose the freeze for 90 days since TransUnion also has an arbitration clause if you choose a longer freeze. In other words, don’t trust any of the credit bureaus as far as you could throw a dead horse. Read the fine print of their Terms Of Service Agreements!!!

Regardless of Equifax’s new claims (due to mounting public outcries) that the data breach does not prevent customers from either filing or joining class action lawsuits against Equifax, keep in mind that some prominent attorneys have chimed in that Equifax’s arbitration clause is very broad and may yet have legal teeth — especially if you are aware of the breech and subsequently decide to take Equifax’s offer for a year of “free” credit monitoring. Thus this brings us right back to my first paragraph. If on September 15 you complete Equifax’s sign-up process for their “free” offer for 1 year of credit monitoring, you potentially could end up excluding yourself from being able to join any class action lawsuit against Equifax. So far, I am aware of two separate class action lawsuits which have been filed against Equifax.

 

4 users thanked author for this post.

HiFlyer, Elly, walker, MrBrian

Reply | Quote

woody wrote:

Just to be clear… It’s by no means certain that Struts is the source of the breach. Equifax isn’t saying much.

Hehe. Equifax is saying that their independent security audit of the attack is nearly complete, yet the details won’t be released for another couple of months. Talk about double-talk! It seems to me that Equifax at this point has no idea how deep this rabbit hole really is.

Reply | Quote

Behind the curtain …
In March 2013 criminals stole credit reports from AnnualCreditReport.com, giving them access to potentially 200 million Americans’ credit reports.

Note: Equifax, Experian and TransUnion, jointly operate AnnualCreditReport.com

The 2013 hack: Equifax said “Our initial investigation shows the perpetrators were able to pass the required authentication measures in place”.

1 user thanked author for this post.

Elly

Reply | Quote

Equifax blames breach on a server flaw it should’ve patched

https://www.engadget.com/2017/09/13/equifax-apache-argentina/

Great. Now that I know all that, what do I do? Where do I go to get my identity back?

I’m saying, it will do no one any good to freeze credit data which is already floating around out there, unencrypted. Ever try to change your Social Security Number? Or your Date of Birth? And are you going to move, to change your Home Addresses for the past two years?

I was not aware of the FreeAnnualCreditReport 2013 breach. That would have had almost the same effect as this Equifax data security breach, and would have affected many more people. Was the leaked database also unencrypted?

-- rc primak

1 user thanked author for this post.

Elly

Reply | Quote