18 ms·

Equifax’s Maddening Unaccountability

477 points by aaronbrethorst 9y ago

kccqzy 9y ago
It's a bit funny how it mentions these two things together in the same article: > Today, almost every piece of software comes with a disclaimer on its user license that basically says that the product may not work as intended […] and that’s the user’s problem. It’s a wonder companies don’t insert “nyah nyah nyah nyah” into the tiny-print legalese. > No software system can be free from bugs […]
- JumpCrisscross 9y ago
  I read a consistent argument. Expecting perfection is wrong. Expecting consumers to shoulder the vast majority of the costs of that imperfection is also wrong.
  - sokoloff 9y ago
    One way or another, I think that consumers are bound to shoulder those costs.
  - HarryHirsch 9y ago
    Expecting perfection is wrong. There's 120 millions of lines of code in an A380, and planes don't crash due to software bugs. Why is it wrong to expect perfection in critical infrastructure? Something went wrong somewhere in software engineering. My HP42s calculator has about 6 insignificant bugs that you need to get out of your way to trigger. Your new cellphone on the other hand, when you turn it on it downloads a gigabyte of updates! That's an outrage.
    - wil421 9y ago
      You're comparing a relatively cheap credit report to a $400 million dollar airplane with a 15-25 billion euro program cost. Not to mention aerospace has a 100 years of innovation and has actual lives at stake. The internet, what 30ish years? Not to mention network security is a relatively new concern.
      - HarryHirsch 9y ago
        At the end of the day it's a liability issue. If a plane crashes due to a software issue there's going to be civil suits to recover damages, very possible they'll also sue for criminal negligence. Why is software immune? You ask yourself about cost of the Office of Personnel Management hack from two years ago, and before that it was the biometrics database from the USCIS.
      - theonemind 9y ago
        With a market cap of $18 billion for Equifax, it seems like they had the resources to get this right. I see the difference as who shoulders the cost. If you pay $400 million for a defective plane, you have one company whose toes you will hold to the fire. If you lose data worth $400 million for 138 million people, you have about $2.89 average per compromised person, so no single person will really go that far out of their way to crucify you, and if one does, they have perhaps tens of thousands of dollars to use in the legal system holding you accountable, not the millions one large wronged party may spend on it. In aggregate economic terms, in actual loss and negligence, I don't see that much difference. If you want to steal a lot, steal a small amount from a large number of people. It looks to me more like a matter of the feasibility of getting away with it.
      - gaius 9y ago
        The Internet was a DARPA project originally. Why shouldn't it be up to Military or Aerospace standards?
- marcoperaza 9y ago
  No economical product manufacturing process can be free from defects. And yet we enforce strict liability for defects leading to injury.
fumigator 9y ago
'Less Secure Than You Think' http://www.cnmeonline.com/myresources/fireeye/fireeye-cso-less-secure-than-you-think.pdf http://www.cnmeonline.com/myresources/fireeye/fireeye-cso-le...
cloakandswagger 9y ago
Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more and more becoming the norm.
- bob1029 9y ago
  >but I doubt this leak will have any lasting financial impact. I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There will be new PII regulations around the corner for sure. I also question the extent of the leak... I keep hearing it was just basic PII, but if someone got a dump of the entire credit history database, a huge range of financial products (e.g. Knowledge-Based Authentication) become entirely compromised.
  - cloakandswagger 9y ago
    Equifax has an $18B market cap. Can you name one instance of a government imposed fine for improperly stored PII exceeding even $100M? Furthermore, do you have evidence that the PII was improperly stored, or that Equifax's security practices were lacking in any way? The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.
    - konceptz 9y ago
      "The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that." Not really accurate because the exploit name, especially as generic as RCE, does not tell you how it was done. RCE can be a number of things that can be fixed in numerous ways. For example, file upload functionality with path manipulation and no file type validation may lead to RCE. This can certainly be removed with properly crafted file upload handling. Some RCE, particularly on lower layers of the application stack, may be more difficult to defend against, especially in the case of unknown exploits.
iamleppert 9y ago
The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.
- kahnjw 9y ago
  You're oversimplifying. This has more to do with politics than SE technical competence. Banking software and systems are regulated end to end, because banking systems are literally the backbone of the global economy. Equifax? Not so much. This exposure hurts consumers, but it doesn't even put a dent in the economy as a whole. That is why these firms are allowed to operate with such shitty security. If they get hacked, whatever, just a few hundred million customers data exposed to identity fraud. It takes a chunk out of Equifax stock but they'll probably survive. What is the incentive for congress to enact laws regulating corporate handling of consumer data? Put it this way. Who do you think is louder in Washington: consumer advocacy groups or corporate lobbyists?
  - KGIII 9y ago
    I'm not sure they actually care in Washington. I was impacted by the OPM breech. I got a form letter and some credit monitoring. All that outrage and, as near as I can tell, not a damned thing has changed. I might be biased and jaded.
    - kahnjw 9y ago
      Thats exactly what I'm saying. There is near zero incentive for congress to enact consumer protection legislation.
      - chiefalchemist 9y ago
        There's incentive (as it's their job, or is said to be). What there isn't is a downside if they don't.
        9y ago
ryanmarsh 9y ago
Americans woke up to news of yet another mass breach of their personal data. Americans woke up to news of yet another mass breach of data about them. FTFY
- herghost 9y ago
  could you elaborate on what you mean by making this distinction, please?
  - gipp 9y ago
    I think the idea is that "personal" implies ownership and the second one doesn't.
  - 15charlimit 9y ago
    People are being pedantic about the actual meaning of words as opposed to the commonly-understood-and-accepted meaning of words. It's annoying, because it distracts from the immediate issue and causes confusion.
codecamper 9y ago
I just read about how the hack was done. Shockingly stupidly easy! 1. They realized that Equifax uses Struts. 2. They modified struts! and 3. Equifax used the updated code on their servers. DUUUUUHHHHHH!
- joefkelley 9y ago
  Do you have a source for 2? I'd like to read more about it.
  - codecamper 9y ago
    a $ 14 billion company gives away the only secret data that they exist to protect. Why? Because they used Struts. How difficult is it to write a slimmed down, secure version of Struts?
- Iknowsecurity 9y ago
  It is more: - Critical remote execution bug was discovered in Struts2. - The vulnerability goes public too quickly. - Hackers start scanning the Internet - Equifax is found vulnerable. - Vulnerability is exploited.
  - codecamper 9y ago
    $14 billion company cannot convert what the servlet API gives into a method call on a certain object + a bit of reflection to update methods & print them into form elements. Super complicate! If the $14 billion can't do that then they certainly cannot protect data.
chiefalchemist 9y ago
There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?
- cloakandswagger 9y ago
  Common misconception. They actually do need your approval, it's just that that approval is buried in the mountains of legalese you sign whenever you sign up for a bank account, credit card or loan.
  - skybrian 9y ago
    Although, in the case of identity fraud, they don't have your approval. Someone else signed the paperwork.
  - _dark_matter_ 9y ago
    So, if I don't want to give them my approval, I must: not sign up for a bank account, never open a credit card, avoid getting a mortgage, buy only in cash, stop renting [0], only apply to some jobs [1], not take out student loans... [0] Some landlords require credit approval [1] Some jobs check credit
    - djsumdog 9y ago
      You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).
      - umanwizard 9y ago
        Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?
outoftacos 9y ago
That was so satisfying to read, it's rare that I come across a voice angrier than my own in the New York Times of all places. Makes me think there is hope this world won't fall apart after all.
- roywiggins 9y ago
  Tufekci is a national treasure.
deleted 9y ago
[deleted]
Iknowsecurity 9y ago
Of all vulnerabilities that created massive amount of personal data leaks this may be the biggest but it is hardly the one caused by the most negligence. Linkedin using unsalted sha hashes is a lot more maddening. Here you have a vulnerability being disclosed and not enough time to patch your code.
tarr11 9y ago
PII is the nuclear waste of the internet. Incredibly expensive to store safely, and constantly vulnerable to a catastrophe.
- mi100hael 9y ago
  And once it leaks, it's damn near impossible to clean up.
  - sounds 9y ago
    I feel like it's worth pointing out the the internet was a better place before people started using it for PII. Credit agencies were about PII before the internet, but internet companies that collect all this PII toxify the internet.
wyager 9y ago
We have the technology to manage credit in ways that are vastly more private and secure than a giant, poorly run, insecure personal data repository. Using strong cryptography, we can build pseudonymous trust graphs where nodes in the graph (cryptographic identities) publish cryptographically auditable trust relationships. Using various graph exploration techniques (e.g. unrolling the trust graph into a trust DAG with known creditors as terminal nodes and calculating path properties to those nodes, using proof-of-burn and non-distributive path combination to disincentivize Sybil attacks on the trust graph, etc.) we can estimate trustworthiness (or, more specifically, creditworthiness) of cryptographic identities rather than legal identities. In the end, you're probably still going to want to link at least one cryptographic with your bank account, but you would have vastly more control over the relationship between privacy and public verifiability of trustworthiness. If course, just because this is possible doesn't mean it's going to happen. The primary obstacles to an open, secure trust system are that A) it's harder to make people manage their own trust network than it is to spy on them B) trust networks rely on the network effect and C) there's no obvious way to make money off it. Any extant system that resembles what I've described is mostly limited to tech nerds. I'm not sure what it would take to trick/convince the general population to use such a system.
danjoc 9y ago
"I’m not unsympathetic to the needs of software developers." Yes she is. I read this as completely unrealistic expectations from the author. Struts is maintained by one person. https://github.com/apache/struts/graphs/contributors https://github.com/apache/struts/graphs/contributors "Most software failures and data breaches aren’t inevitable; they are a result of neglect and underinvestment in product reliability and security." The attack happened in late July. The bug was fixed/reported in early September. It was a zero day. That's not neglect.
- grzm 9y ago
  > Struts is maintained by one person. I see nowhere in the op-ed piece where Tufekci mentions Struts or implies that she holds Struts responsible for this. She is clearly laying this at Equifax's feet, and their responsibility in their choice of software and the industry as a whole for actively pushing against better software practices and responsibility. The section you quoted is followed by: > Some number of unexpected errors — bugs — are unavoidable in computer programs. It would be unreasonable to allow a consumer to sue a software company every time a program suffered a glitch. She's laying out a much more nuanced argument than you're given her credit for. You're right in that this seems to be zero-day which are more difficult to defend against, but there are practices (among them, defense in depth, and pen tests) which can limit the attack surface. Also actively looking for known exploit types (rather than specific exploit instances). For example, buffer overflows are a known attack vector in C, so people harden their code against buffer overflows. Deserialization attacks are known in Java, so people harden their code against deserialization attacks. SQL injection attacks are a known exploit type, so people learn to parameterize their SQL queries. It's clear that this is something you care about and are passionate about. For topics that affect me like this, I consciously take a breath and re-read what I've reacted to, to see if my second (or third) read matches up with my first.
  - danjoc 9y ago
    She's blaming the software industry and software failure. That's Apache, and Struts. If she wanted to lay it on Equifax, she might go into the fact that the Chief Information Security Officer at Equifax holds a masters in music, https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic... The people that actually "do" are Chief Peon of Cube Farms, doing whatever the boss with a music degree tells them is priority. >You're right in that this seems to be zero-day which are more difficult to defend against There's no nuance. It is under-reporting the facts to make her hit piece look stronger. It's never the leadership's fault when there's a failure in the US, but they happily take credit when there is success. >but there are practices Which don't help at all against a zero-day in a dependency.
keyle 9y ago
You! You didn't pay a small bill 4 years ago because you changed address and a debt collector marked you as naughty. No loan for you! Hahaha! ... Oh, we just leaked all of your information. Ah well, today is a new day, ... dum diddly dum...
- woogiewonka 9y ago
  Fury!
cprayingmantis 9y ago
So how can I stop using Equifax? Or at the very least how can I find banks or other agencies that don't use Equifax? Is there any way to stop them from hoarding all my data without my explicit consent?
- Zagitta 9y ago
  You can't, you're the product not the user unfortunately.
- ovao 9y ago
  To my knowledge you can't stop, per se. If you're savvy you can avoid seeking credit from any institution that pulls Equifax, by asking from what CRA(s) your report will be pulled and simply walking out if they tell you they pull Equifax. This doesn't guarantee that they won't report to Equifax, however, and it certainly doesn't guarantee that Equifax won't come up with the information by other means. Unfortunately, also, it's safe to assume that Experian and TransUnion operate just as badly as Equifax, so attempting to live an Equifax-free existence probably isn't particularly useful. If Equifax does suffer for this leak, actually, it's a relatively safe bet that they will take security more seriously so as to better protect their interests.
- kahnjw 9y ago
  You might be able to find a credit Beaureu that does not report to equifax. Might be better off calling your representatives in Washington and telling them we need better consumer data protection regulations. Good luck.
endgame 9y ago
Maybe this will finally be the "Three Mile Island Incident of Data" that Maciej Cegłowski talks about? If not, I don't know what will. http://idlewords.com/talks/haunted_by_data.htm http://idlewords.com/talks/haunted_by_data.htm
- SmirkingRevenge 9y ago
  The 3-mile island of data leaks will happen when the ISP DNS lookups and browser history logs get matched up with the credit data and all the other datasets that are floating around.
alexkavon 9y ago
Will the SSA (social security administration) office be issuing new numbers?
deleted 9y ago
[deleted]
mark-r 9y ago
The author likens this to automotive safety, but I think a better analogy would be airline safety. When an airplane goes down, an immediate investigation is done by third parties to find the cause. Then remedial steps are drawn up and the entire industry is expected to follow them, not just the company involved in the accident. Data breaches need to be held to this standard.
- mixmastamyk 9y ago
  This is a great idea I'm afraid will never happen.
  - letsgetphysITal 9y ago
    I don't know. One airline disaster is arguably less economically destructive than this breach. It could end a $70B company, or lead to a bailout, or ruin credit application processes for years causing the US economy to stumble. Nothing makes things change faster than disrupting the money flow.
drewmol 9y ago
Equifax played a slightly different version if this commercial during Monday Night Football a few times, it takes no accountability, but also doubles-down, claims your info might* be on the dark-web(*because they just negligently released it), and offers a "dark-web-scan" service to help find it... https://www.youtube.com/watch?v=vjrydnr_pvQ https://www.youtube.com/watch?v=vjrydnr_pvQ
- saym 9y ago
  So convenient to offer the problem AND the solution.
- kahnjw 9y ago
  Experian != Equifax
  - throwawayjava 9y ago
    For sufficiently weak notions of equality. ;-)
  - drewmol 9y ago
    Thanks, that was my mistake I confused the two and didn't even notice before posting. Too late to delete my inaccurate comment(mods?). It certainly makes sense for Experian to advertise this service given their competitors recent leak.
orange_county 9y ago
"Most software failures and data breaches aren’t inevitable; they are a result of neglect and underinvestment in product reliability and security." How do we know that Equifax fell into this category? That this was due to negligence? I see a lot of disdain towards Equifax but yet the breach details have not been out yet.
- throwawayjava 9y ago
  The 6.66 billion dollar question.
jamesmattis 9y ago
Whatever happened at Equifax was disastrous. But I really liked the way that they are containing it. Their CEO released a statement. They launched a specific site for security scans for their user for free. They are communicating it to their customers transparently. With that I also saw that cyber security is and will be the biggest threats of the next decade. They are many cyber security companies these days but I didn't see a single company moving forward to support the Equifax team to figure out what happened and how it can be prevented. Cyber security companies should have volunteered for the cause.
- mhb 9y ago
  Since they are being so thoughtful, maybe they could offer to pay the charges to freeze affected accounts.
- hmhrex 9y ago
  > But I really liked the way that they are containing it. Please let this be sarcasm... > They are communicating it to their customers transparently. They knew well in advance that there was an issue and did not communicate it well. They have 3 higher managers that look to have sold their stock based on the knowledge. There are some reports that they knew up to 3 months ahead of their announcement. > They launched a specific site for security scans for their user for free. Things that are wrong with this site: - The site screams "phishing" when you look at the URL. - Asks for SIX digits of your SSN. If you know the state of the person filling out the form and they were issued their SSN before 2011, you only need to try a few numbers to figure out their whole SSN. - Gives random results when you fill out the form - You possibly forfeit being able to sue them by filling out the form. - When you fill out the form they basically advertise their own product to you. At this point, as a consumer, it feels like they are doing everything in their power to get away with not being held accountable for not storing this data properly. 8 in 10 US credit card holders have their SSN and possibly other information out there. This means that I'm at high risk to have my identity stolen in the future, not just the next twelve months that Equifax is offering me free Identity Theft Protection. Last but not least, when you freeze your credit score, they give you a PIN to unfreeze it. But if you were to lose it, you'll only need some identification to get a new PIN and unfreeze it. But they've already released that identification and it's being sold around. So no luck there.
deleted 9y ago
[deleted]
running101 9y ago
One more reason to move away from current financial system to bitcoin.
gwenzek 9y ago
Naive question from Europe. What's the influence such NYT article may have on the legislators?
gadders 9y ago
>> I’m still dealing with the damage to my credit rating that resulted when I forgot to return a library book and a collection agency was called in (for a paltry sum). ... >>Zeynep Tufekci (@zeynep), an associate professor at the School of Information and Library Science at the University of North Carolina You'd think she of all people would know better.

It's a bit funny how it mentions these two things together in the same article: > Today, almost every piece of software comes with a disclaimer on its user license that basically says that the product may not work as intended […] and that’s the user’s problem. It’s a wonder companies don’t insert “nyah nyah nyah nyah” into the tiny-print legalese. > No software system can be free from bugs […]

JumpCrisscross 9y ago
I read a consistent argument. Expecting perfection is wrong. Expecting consumers to shoulder the vast majority of the costs of that imperfection is also wrong.
- sokoloff 9y ago
  One way or another, I think that consumers are bound to shoulder those costs.
- HarryHirsch 9y ago
  Expecting perfection is wrong. There's 120 millions of lines of code in an A380, and planes don't crash due to software bugs. Why is it wrong to expect perfection in critical infrastructure? Something went wrong somewhere in software engineering. My HP42s calculator has about 6 insignificant bugs that you need to get out of your way to trigger. Your new cellphone on the other hand, when you turn it on it downloads a gigabyte of updates! That's an outrage.
  - wil421 9y ago
    You're comparing a relatively cheap credit report to a $400 million dollar airplane with a 15-25 billion euro program cost. Not to mention aerospace has a 100 years of innovation and has actual lives at stake. The internet, what 30ish years? Not to mention network security is a relatively new concern.
    - HarryHirsch 9y ago
      At the end of the day it's a liability issue. If a plane crashes due to a software issue there's going to be civil suits to recover damages, very possible they'll also sue for criminal negligence. Why is software immune? You ask yourself about cost of the Office of Personnel Management hack from two years ago, and before that it was the biometrics database from the USCIS.
    - theonemind 9y ago
      With a market cap of $18 billion for Equifax, it seems like they had the resources to get this right. I see the difference as who shoulders the cost. If you pay $400 million for a defective plane, you have one company whose toes you will hold to the fire. If you lose data worth $400 million for 138 million people, you have about $2.89 average per compromised person, so no single person will really go that far out of their way to crucify you, and if one does, they have perhaps tens of thousands of dollars to use in the legal system holding you accountable, not the millions one large wronged party may spend on it. In aggregate economic terms, in actual loss and negligence, I don't see that much difference. If you want to steal a lot, steal a small amount from a large number of people. It looks to me more like a matter of the feasibility of getting away with it.
    - gaius 9y ago
      The Internet was a DARPA project originally. Why shouldn't it be up to Military or Aerospace standards?
marcoperaza 9y ago
No economical product manufacturing process can be free from defects. And yet we enforce strict liability for defects leading to injury.

fumigator 9y ago

'Less Secure Than You Think' http://www.cnmeonline.com/myresources/fireeye/fireeye-cso-less-secure-than-you-think.pdf http://www.cnmeonline.com/myresources/fireeye/fireeye-cso-le...

cloakandswagger 9y ago

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more and more becoming the norm.

bob1029 9y ago
>but I doubt this leak will have any lasting financial impact. I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There will be new PII regulations around the corner for sure. I also question the extent of the leak... I keep hearing it was just basic PII, but if someone got a dump of the entire credit history database, a huge range of financial products (e.g. Knowledge-Based Authentication) become entirely compromised.
- cloakandswagger 9y ago
  Equifax has an $18B market cap. Can you name one instance of a government imposed fine for improperly stored PII exceeding even $100M? Furthermore, do you have evidence that the PII was improperly stored, or that Equifax's security practices were lacking in any way? The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.
  - konceptz 9y ago
    "The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that." Not really accurate because the exploit name, especially as generic as RCE, does not tell you how it was done. RCE can be a number of things that can be fixed in numerous ways. For example, file upload functionality with path manipulation and no file type validation may lead to RCE. This can certainly be removed with properly crafted file upload handling. Some RCE, particularly on lower layers of the application stack, may be more difficult to defend against, especially in the case of unknown exploits.

iamleppert 9y ago

The problem is incompetence in our industry. Anyone who has worked long enough knows that technical competency is not rewarded (outside a few rare firms) in software engineering.

kahnjw 9y ago
You're oversimplifying. This has more to do with politics than SE technical competence. Banking software and systems are regulated end to end, because banking systems are literally the backbone of the global economy. Equifax? Not so much. This exposure hurts consumers, but it doesn't even put a dent in the economy as a whole. That is why these firms are allowed to operate with such shitty security. If they get hacked, whatever, just a few hundred million customers data exposed to identity fraud. It takes a chunk out of Equifax stock but they'll probably survive. What is the incentive for congress to enact laws regulating corporate handling of consumer data? Put it this way. Who do you think is louder in Washington: consumer advocacy groups or corporate lobbyists?
- KGIII 9y ago
  I'm not sure they actually care in Washington. I was impacted by the OPM breech. I got a form letter and some credit monitoring. All that outrage and, as near as I can tell, not a damned thing has changed. I might be biased and jaded.
  - kahnjw 9y ago
    Thats exactly what I'm saying. There is near zero incentive for congress to enact consumer protection legislation.
    - chiefalchemist 9y ago
      There's incentive (as it's their job, or is said to be). What there isn't is a downside if they don't.
      - 9y ago

ryanmarsh 9y ago

Americans woke up to news of yet another mass breach of their personal data. Americans woke up to news of yet another mass breach of data about them. FTFY

herghost 9y ago
could you elaborate on what you mean by making this distinction, please?
- gipp 9y ago
  I think the idea is that "personal" implies ownership and the second one doesn't.
- 15charlimit 9y ago
  People are being pedantic about the actual meaning of words as opposed to the commonly-understood-and-accepted meaning of words. It's annoying, because it distracts from the immediate issue and causes confusion.

codecamper 9y ago

I just read about how the hack was done. Shockingly stupidly easy! 1. They realized that Equifax uses Struts. 2. They modified struts! and 3. Equifax used the updated code on their servers. DUUUUUHHHHHH!

joefkelley 9y ago
Do you have a source for 2? I'd like to read more about it.
- codecamper 9y ago
  a $ 14 billion company gives away the only secret data that they exist to protect. Why? Because they used Struts. How difficult is it to write a slimmed down, secure version of Struts?
Iknowsecurity 9y ago
It is more: - Critical remote execution bug was discovered in Struts2. - The vulnerability goes public too quickly. - Hackers start scanning the Internet - Equifax is found vulnerable. - Vulnerability is exploited.
- codecamper 9y ago
  $14 billion company cannot convert what the servlet API gives into a method call on a certain object + a bit of reflection to update methods & print them into form elements. Super complicate! If the $14 billion can't do that then they certainly cannot protect data.

chiefalchemist 9y ago

There's something very disturbing about the fact that they can collect my personal information (without my approval); profit on that info (without compensating me); and then get hacked and I have no reasonable recourse for what they've done?? How can they not be liable? How is this not negligence?

cloakandswagger 9y ago
Common misconception. They actually do need your approval, it's just that that approval is buried in the mountains of legalese you sign whenever you sign up for a bank account, credit card or loan.
- skybrian 9y ago
  Although, in the case of identity fraud, they don't have your approval. Someone else signed the paperwork.
- _dark_matter_ 9y ago
  So, if I don't want to give them my approval, I must: not sign up for a bank account, never open a credit card, avoid getting a mortgage, buy only in cash, stop renting [0], only apply to some jobs [1], not take out student loans... [0] Some landlords require credit approval [1] Some jobs check credit
  - djsumdog 9y ago
    You also can only buy cars from individuals (dealerships run credit checks, even if you pay with cash/check/direct draft) and you probably can't get power, water, gas or Internet in your name (you'd need a roommate and have to pay them).
    - umanwizard 9y ago
      Why would a dealership need to do a credit check if I showed up with a briefcase full of money to buy a car?

outoftacos 9y ago

That was so satisfying to read, it's rare that I come across a voice angrier than my own in the New York Times of all places. Makes me think there is hope this world won't fall apart after all.

roywiggins 9y ago
Tufekci is a national treasure.

deleted 9y ago

[deleted]

Iknowsecurity 9y ago

Of all vulnerabilities that created massive amount of personal data leaks this may be the biggest but it is hardly the one caused by the most negligence. Linkedin using unsalted sha hashes is a lot more maddening. Here you have a vulnerability being disclosed and not enough time to patch your code.

tarr11 9y ago

PII is the nuclear waste of the internet. Incredibly expensive to store safely, and constantly vulnerable to a catastrophe.

mi100hael 9y ago
And once it leaks, it's damn near impossible to clean up.
- sounds 9y ago
  I feel like it's worth pointing out the the internet was a better place before people started using it for PII. Credit agencies were about PII before the internet, but internet companies that collect all this PII toxify the internet.

wyager 9y ago

We have the technology to manage credit in ways that are vastly more private and secure than a giant, poorly run, insecure personal data repository. Using strong cryptography, we can build pseudonymous trust graphs where nodes in the graph (cryptographic identities) publish cryptographically auditable trust relationships. Using various graph exploration techniques (e.g. unrolling the trust graph into a trust DAG with known creditors as terminal nodes and calculating path properties to those nodes, using proof-of-burn and non-distributive path combination to disincentivize Sybil attacks on the trust graph, etc.) we can estimate trustworthiness (or, more specifically, creditworthiness) of cryptographic identities rather than legal identities. In the end, you're probably still going to want to link at least one cryptographic with your bank account, but you would have vastly more control over the relationship between privacy and public verifiability of trustworthiness. If course, just because this is possible doesn't mean it's going to happen. The primary obstacles to an open, secure trust system are that A) it's harder to make people manage their own trust network than it is to spy on them B) trust networks rely on the network effect and C) there's no obvious way to make money off it. Any extant system that resembles what I've described is mostly limited to tech nerds. I'm not sure what it would take to trick/convince the general population to use such a system.

danjoc 9y ago

"I’m not unsympathetic to the needs of software developers." Yes she is. I read this as completely unrealistic expectations from the author. Struts is maintained by one person. https://github.com/apache/struts/graphs/contributors https://github.com/apache/struts/graphs/contributors "Most software failures and data breaches aren’t inevitable; they are a result of neglect and underinvestment in product reliability and security." The attack happened in late July. The bug was fixed/reported in early September. It was a zero day. That's not neglect.

grzm 9y ago
> Struts is maintained by one person. I see nowhere in the op-ed piece where Tufekci mentions Struts or implies that she holds Struts responsible for this. She is clearly laying this at Equifax's feet, and their responsibility in their choice of software and the industry as a whole for actively pushing against better software practices and responsibility. The section you quoted is followed by: > Some number of unexpected errors — bugs — are unavoidable in computer programs. It would be unreasonable to allow a consumer to sue a software company every time a program suffered a glitch. She's laying out a much more nuanced argument than you're given her credit for. You're right in that this seems to be zero-day which are more difficult to defend against, but there are practices (among them, defense in depth, and pen tests) which can limit the attack surface. Also actively looking for known exploit types (rather than specific exploit instances). For example, buffer overflows are a known attack vector in C, so people harden their code against buffer overflows. Deserialization attacks are known in Java, so people harden their code against deserialization attacks. SQL injection attacks are a known exploit type, so people learn to parameterize their SQL queries. It's clear that this is something you care about and are passionate about. For topics that affect me like this, I consciously take a breath and re-read what I've reacted to, to see if my second (or third) read matches up with my first.
- danjoc 9y ago
  She's blaming the software industry and software failure. That's Apache, and Struts. If she wanted to lay it on Equifax, she might go into the fact that the Chief Information Security Officer at Equifax holds a masters in music, https://www.hollywoodlanews.com/equifax-chief-security-officer/ https://www.hollywoodlanews.com/equifax-chief-security-offic... The people that actually "do" are Chief Peon of Cube Farms, doing whatever the boss with a music degree tells them is priority. >You're right in that this seems to be zero-day which are more difficult to defend against There's no nuance. It is under-reporting the facts to make her hit piece look stronger. It's never the leadership's fault when there's a failure in the US, but they happily take credit when there is success. >but there are practices Which don't help at all against a zero-day in a dependency.

keyle 9y ago

You! You didn't pay a small bill 4 years ago because you changed address and a debt collector marked you as naughty. No loan for you! Hahaha! ... Oh, we just leaked all of your information. Ah well, today is a new day, ... dum diddly dum...

woogiewonka 9y ago
Fury!

cprayingmantis 9y ago

So how can I stop using Equifax? Or at the very least how can I find banks or other agencies that don't use Equifax? Is there any way to stop them from hoarding all my data without my explicit consent?

Zagitta 9y ago
You can't, you're the product not the user unfortunately.
ovao 9y ago
To my knowledge you can't stop, per se. If you're savvy you can avoid seeking credit from any institution that pulls Equifax, by asking from what CRA(s) your report will be pulled and simply walking out if they tell you they pull Equifax. This doesn't guarantee that they won't report to Equifax, however, and it certainly doesn't guarantee that Equifax won't come up with the information by other means. Unfortunately, also, it's safe to assume that Experian and TransUnion operate just as badly as Equifax, so attempting to live an Equifax-free existence probably isn't particularly useful. If Equifax does suffer for this leak, actually, it's a relatively safe bet that they will take security more seriously so as to better protect their interests.
kahnjw 9y ago
You might be able to find a credit Beaureu that does not report to equifax. Might be better off calling your representatives in Washington and telling them we need better consumer data protection regulations. Good luck.

endgame 9y ago

Maybe this will finally be the "Three Mile Island Incident of Data" that Maciej Cegłowski talks about? If not, I don't know what will. http://idlewords.com/talks/haunted_by_data.htm http://idlewords.com/talks/haunted_by_data.htm

SmirkingRevenge 9y ago
The 3-mile island of data leaks will happen when the ISP DNS lookups and browser history logs get matched up with the credit data and all the other datasets that are floating around.

alexkavon 9y ago

Will the SSA (social security administration) office be issuing new numbers?

deleted 9y ago

[deleted]

mark-r 9y ago

The author likens this to automotive safety, but I think a better analogy would be airline safety. When an airplane goes down, an immediate investigation is done by third parties to find the cause. Then remedial steps are drawn up and the entire industry is expected to follow them, not just the company involved in the accident. Data breaches need to be held to this standard.

mixmastamyk 9y ago
This is a great idea I'm afraid will never happen.
- letsgetphysITal 9y ago
  I don't know. One airline disaster is arguably less economically destructive than this breach. It could end a $70B company, or lead to a bailout, or ruin credit application processes for years causing the US economy to stumble. Nothing makes things change faster than disrupting the money flow.

drewmol 9y ago

Equifax played a slightly different version if this commercial during Monday Night Football a few times, it takes no accountability, but also doubles-down, claims your info might* be on the dark-web(*because they just negligently released it), and offers a "dark-web-scan" service to help find it... https://www.youtube.com/watch?v=vjrydnr_pvQ https://www.youtube.com/watch?v=vjrydnr_pvQ

saym 9y ago
So convenient to offer the problem AND the solution.
kahnjw 9y ago
Experian != Equifax
- throwawayjava 9y ago
  For sufficiently weak notions of equality. ;-)
- drewmol 9y ago
  Thanks, that was my mistake I confused the two and didn't even notice before posting. Too late to delete my inaccurate comment(mods?). It certainly makes sense for Experian to advertise this service given their competitors recent leak.

orange_county 9y ago

"Most software failures and data breaches aren’t inevitable; they are a result of neglect and underinvestment in product reliability and security." How do we know that Equifax fell into this category? That this was due to negligence? I see a lot of disdain towards Equifax but yet the breach details have not been out yet.

throwawayjava 9y ago
The 6.66 billion dollar question.

jamesmattis 9y ago

Whatever happened at Equifax was disastrous. But I really liked the way that they are containing it. Their CEO released a statement. They launched a specific site for security scans for their user for free. They are communicating it to their customers transparently. With that I also saw that cyber security is and will be the biggest threats of the next decade. They are many cyber security companies these days but I didn't see a single company moving forward to support the Equifax team to figure out what happened and how it can be prevented. Cyber security companies should have volunteered for the cause.

mhb 9y ago
Since they are being so thoughtful, maybe they could offer to pay the charges to freeze affected accounts.
hmhrex 9y ago
> But I really liked the way that they are containing it. Please let this be sarcasm... > They are communicating it to their customers transparently. They knew well in advance that there was an issue and did not communicate it well. They have 3 higher managers that look to have sold their stock based on the knowledge. There are some reports that they knew up to 3 months ahead of their announcement. > They launched a specific site for security scans for their user for free. Things that are wrong with this site: - The site screams "phishing" when you look at the URL. - Asks for SIX digits of your SSN. If you know the state of the person filling out the form and they were issued their SSN before 2011, you only need to try a few numbers to figure out their whole SSN. - Gives random results when you fill out the form - You possibly forfeit being able to sue them by filling out the form. - When you fill out the form they basically advertise their own product to you. At this point, as a consumer, it feels like they are doing everything in their power to get away with not being held accountable for not storing this data properly. 8 in 10 US credit card holders have their SSN and possibly other information out there. This means that I'm at high risk to have my identity stolen in the future, not just the next twelve months that Equifax is offering me free Identity Theft Protection. Last but not least, when you freeze your credit score, they give you a PIN to unfreeze it. But if you were to lose it, you'll only need some identification to get a new PIN and unfreeze it. But they've already released that identification and it's being sold around. So no luck there.

deleted 9y ago

[deleted]

running101 9y ago

One more reason to move away from current financial system to bitcoin.

gwenzek 9y ago

Naive question from Europe. What's the influence such NYT article may have on the legislators?

gadders 9y ago

>> I’m still dealing with the damage to my credit rating that resulted when I forgot to return a library book and a collection agency was called in (for a paltry sum). ... >>Zeynep Tufekci (@zeynep), an associate professor at the School of Information and Library Science at the University of North Carolina You'd think she of all people would know better.