6 ms·

We won't really know until Equifax releases the full RCA (root cause analysis). The attack could be way more sophisticated and involve several hacks through th

We won't really know until Equifax releases the full RCA (root cause analysis). The attack could be way more sophisticated and involve several hacks through the stack. Injecting a JSON blob to the Struts REST deserializer that effectively results in executing payload code would indicate high investment in the attack. The hacker(s) possibly had insider information. They possibly used social hacking techniques to acquire data decryption keys. Given Equifax stores more than 143M records, the initial report would imply some sort of data segmentation limited the scope of damage. If the doors were wide open, why didn't the hackers take 100% of the records? None of this excuses Equifax or removes liability (I've personally initiated a credit freeze and will likely need a LifeLock Plus account for the rest of my life thanks to this breach).

solomatov 9y ago
>Injecting a JSON blob to the Struts REST deserializer that effectively results in executing payload code would indicate high investment in the attack. Why does it indicate high investment? IMO it's similar to SQL injection attack. People, just take a look at points where complicated data can be deserialized and check whether adequate checks can be overcome. As I see from their report here: https://cwiki.apache.org/confluence/display/WW/S2-052 https://cwiki.apache.org/confluence/display/WW/S2-052 they use XStream to deserialize REST data. XStream is basically Java serialization/deserialization to XML instead of binary. As far as I remember from my experience of working with XStream, XStream can deserialize almost any object, even the ones which aren't serializable by default. It's quite trivial to go from here to execution of arbitrary code.
- matchagaucho 9y ago
  > It's quite trivial to go from here to execution of arbitrary code. Code that does what? Dumps all environment vars? OK, maybe that produces a DB2 connection string. Refactor code, re-inject, does the connection work? OK. Refactor code, re-inject and dump all tables. etc... This attack requires an iterative trial-and-error probing process, typically done behind a proxy for many weeks/months. From Equifax's PR: "the unauthorized access occurred from mid-May through July 2017.". That's a reasonable amount of time to probe all systems involved and develop sophisticated code.
  - solomatov 9y ago
    >This attack requires an iterative trial-and-error probing process, typically done behind a proxy for many weeks/months. Of course this attack is quite laborious, but it doesn't require anything special or unique.
    - tetha 9y ago
      It requires human effort. For most attackers, it is vastly more efficient to run automated sql/wordpress-vuln/ssh-user scanners dropping bitcoin miners and botnet nodes. Those require zero human effort and self-replicate. That gives you less publicity than a hundred million personal finance records, but it has a much higher success chance and a more reliable income.
  - sasas 9y ago
    The vulnerabilities have public proof of concept code. You literally get a shell on the machine. I wont link examples here, but they are east to find.

solomatov 9y ago

>Injecting a JSON blob to the Struts REST deserializer that effectively results in executing payload code would indicate high investment in the attack. Why does it indicate high investment? IMO it's similar to SQL injection attack. People, just take a look at points where complicated data can be deserialized and check whether adequate checks can be overcome. As I see from their report here: https://cwiki.apache.org/confluence/display/WW/S2-052 https://cwiki.apache.org/confluence/display/WW/S2-052 they use XStream to deserialize REST data. XStream is basically Java serialization/deserialization to XML instead of binary. As far as I remember from my experience of working with XStream, XStream can deserialize almost any object, even the ones which aren't serializable by default. It's quite trivial to go from here to execution of arbitrary code.

matchagaucho 9y ago
> It's quite trivial to go from here to execution of arbitrary code. Code that does what? Dumps all environment vars? OK, maybe that produces a DB2 connection string. Refactor code, re-inject, does the connection work? OK. Refactor code, re-inject and dump all tables. etc... This attack requires an iterative trial-and-error probing process, typically done behind a proxy for many weeks/months. From Equifax's PR: "the unauthorized access occurred from mid-May through July 2017.". That's a reasonable amount of time to probe all systems involved and develop sophisticated code.
- solomatov 9y ago
  >This attack requires an iterative trial-and-error probing process, typically done behind a proxy for many weeks/months. Of course this attack is quite laborious, but it doesn't require anything special or unique.
  - tetha 9y ago
    It requires human effort. For most attackers, it is vastly more efficient to run automated sql/wordpress-vuln/ssh-user scanners dropping bitcoin miners and botnet nodes. Those require zero human effort and self-replicate. That gives you less publicity than a hundred million personal finance records, but it has a much higher success chance and a more reliable income.
- sasas 9y ago
  The vulnerabilities have public proof of concept code. You literally get a shell on the machine. I wont link examples here, but they are east to find.