5 ms·

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt t

Now would be a great time to go long EFX in my opinion. The stock has been slammed while Equifax is being flogged in the court of public opinion, but I doubt this leak will have any lasting financial impact. Look at the result of the Target and Home Depot breaches: whether you like it or not, the companies are still technically the victims here and no court is going to bankrupt them for data breaches that are more and more becoming the norm.

bob1029 9y ago
>but I doubt this leak will have any lasting financial impact. I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There will be new PII regulations around the corner for sure. I also question the extent of the leak... I keep hearing it was just basic PII, but if someone got a dump of the entire credit history database, a huge range of financial products (e.g. Knowledge-Based Authentication) become entirely compromised.
- cloakandswagger 9y ago
  Equifax has an $18B market cap. Can you name one instance of a government imposed fine for improperly stored PII exceeding even $100M? Furthermore, do you have evidence that the PII was improperly stored, or that Equifax's security practices were lacking in any way? The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.
  - konceptz 9y ago
    "The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that." Not really accurate because the exploit name, especially as generic as RCE, does not tell you how it was done. RCE can be a number of things that can be fixed in numerous ways. For example, file upload functionality with path manipulation and no file type validation may lead to RCE. This can certainly be removed with properly crafted file upload handling. Some RCE, particularly on lower layers of the application stack, may be more difficult to defend against, especially in the case of unknown exploits.
    - cloakandswagger 9y ago
      Fair enough. I more meant that after an attacker has achieved RCE, no amount of encryption or other practices can protect sensitive info in your database.
      - sdenton4 9y ago
        Why does the webserver need access to All of the Datas? Store the data separately, and create use-tokens for webservers to access data once users have authenticated. The webservers should be treated as if they're potentially compromised, not given arbitrary access to a database...
      - duskwuff 9y ago
        Encryption can't save you, but other practices can. Specifically: if you're working with a lot of very sensitive information, you structure your application such that there are multiple layers separating that data from the outside world. In the case of Equifax, that might mean implementing the "credit score check" as an internal service exposed through the public web servers (or whatever).
        kevan 9y ago
        Exactly. While nothing can completely stop attackers, there are multiple techniques you can layer to slow them down. E.g: * Credential vaults that allow only-once retrieval on application startup and only keep credentials in memory * anomaly detectors for request patterns (suspicious payload formats, processing time, CPU/memory usage, etc), * Honeypot records in sensitive data stores (records you know should never be accessed, if they are you've been breached) If you're storing information this sensitive you need to be paranoid, because an attacker has a $4B incentive ($30/identity on the black market * 143 million records) to crack your systems.
      - TheCondor 9y ago
        No you have to use other architectures for defending against that. Equifax sells queries to this data, they also use queries to that data as a trigger to change your credit rating. It seems like you'd want a very tightly audited mechanism for issuing these queries to make sure they are properly billed. Referring to it as a struts issue makes it sound like someone popped a web server, fired up a dub client and started dumping unencrypted tables. It seems amazing that nothing tripped up some monitoring or something.
  - empath75 9y ago
    Having root on a web server shouldn't give you access to 147 million customer records.
    - cloakandswagger 9y ago
      I'm eagerly awaiting the technical details of the attack. If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. I'm wondering if Equifax is using Struts-provided REST for its entire architecture. If that's the case, gaining access to the web server was only the first step. From there the attacker could perform RCE on sensitive services.
      - sillysaurus3 9y ago
        If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. You may want to think twice. Try to design an architecture that doesn't have that. If you think it through, you'll realize the best you can do is not to deny access, but to monitor access so that any statistical deviation in requests-per-hour will trigger an alarm. Yet nobody does that, so why should Equifax have been a pioneer in this method? This is the uncomfortable truth that everyone is obscuring here. There wasn't a solution. Equifax got owned, and they happened to have a trove of data. Everyone now wants to see their heads roll, but you too would find yourself in the same situation if you have an RCE on your servers.
        Iknowsecurity 9y ago
        Agreed
        kelnos 9y ago
        > You may want to think twice. Try to design an architecture that doesn't have that. We have an architecture like that where I work. It's not that hard. Our web applications have very little direct access to databases; most of it is mediated by services downstream of the web app. That's certainly not a silver bullet, but it makes it impossible to exploit a RCE vuln in the web server in such a way that it lets you have arbitrary access to the database.
  - kelnos 9y ago
    > The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that. If the vulnerability used turns out to be the Struts one that was announced at the beginning of the year, then the "magic" here would have been quite muggle-like: update the damn dependency. Not doing so is negligence, plain and simple. (I agree with you, though, that EFX will almost certainly come out of this relatively unscathed.)
    - cloakandswagger 9y ago
      The statement released by Apache said that, if the attack did use the REST plugin vulnerability in Struts, then it would have been a zero-day at the time of use.
      - gaius 9y ago
        You will note that Equifax is not a contributor to Struts - cash or code. They are trying to shift the blame onto something they got for free and work other people did for free.
        elkos 9y ago
        It's my understanding that Equifax is a multibillion dollar org. (Something in the order of 17 billion USD). Since Struts is a major part of their business infrastructure one would expect a contribution to the Struts project and other software they rely on. They could spin it as "Social Responsibility" too. In retrospect it seems more cost effective to do so too, even if Equifax manages somehow to pay only a few hundred million dollars.
      - bga 9y ago
        Yet Equifax continues to evade giving details on the attack. That itself is damning evidence they weren't doing everything they should have been to protect their servers and data.
  - ridgeguy 9y ago
    I wonder if the legal concept res ipsa loquitur (the thing speaks for itself) could apply here? It's one foundation of tort law. The argument would be that the very fact that PII security was breached demonstrates defendant's negligent data storage/security practices. If those practices had been adequate, the breach would not have occurred.
    - cloakandswagger 9y ago
      If that's the case then I'd suggest every software developer on this forum immediately switch careers, this one is doomed.
      - ridgeguy 9y ago
        Well, there is that. Maybe reality is that no set of security practices can ever secure PII. If so, that's an even bigger problem than lackadaisical firms like Equifax. But I think higher expectations, helped along with civil legal machinery that's likely to mete out meaningful punishment, would move us faster to finding out whether the problems are mostly just sloppy practice (which responds to economic penalties) or whether they're more fundamental and need a different fix.
  - fred_is_fred 9y ago
    You need to think beyond the fine. There will be costs of new regulations (if passed), increased costs for lobbying against any said efforts, loss of revenue (would you want to have your company name as a partner for Equifax), and finally lawsuits. Going long may make sense but we've not hit bottom yet.
- g051051 9y ago
  > Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There is zero chance of that happening. There's been no hint of this from any reputable source (i.e. not clickbait headlines). Will there be financial repercussions? Fines? Loss of stock value? Absolutely. Will Equifax go out of business or get sold? Absolutely not.
- SilasX 9y ago
  Seriously? I rarely see these deeply enmeshed financial firms get fined into bankruptcy, since they've effectively reached "too big to fail". Kind of optimistic to call that the "best case" scenario.
- chiefalchemist 9y ago
  If that's true. Then it would encourage a prospective suitor to hack them. Wait for the fallout and then buy in. Certainly it's much cheaper to hire a hacker(s) then pay full price, correct?
- nerdponx 9y ago
  New PII regulations sure. Fined directly into bankruptcy? Yeah, ok. Just look to BP, Volvo, or any of the now-dozens of companies responsible for massive data breaches in the last few years.
- pishpash 9y ago
  Knowledge based authentication is crap and therefore worthless. I look forward to it being marked to market.
maxxxxx 9y ago
I thought about that too but it could also be possible that they may get bankrupted by lawsuits. I don't see Equifax as victim. I hope they will go down and be warning for the rest of the financial industry.
- cloakandswagger 9y ago
  Target lost tens of millions of credit card numbers and paid just over $18 million to settle every lawsuit against them. People seem to conflate the way they think things should be with the way things actually are.
  - yborg 9y ago
    Exactly. The costs to EFX will likely be <$100M all out, after all the torch-waving and yelling. Equifax net profit in 2016 was $488M. Longer term, this is actually quite possibly revenue-positive for Equifax - they will trick a non-inconsiderable number of people into signing up for their credit monitoring service, and everyone who wants a credit freeze gets to pay $10 (in Illinois at least). That's $1.45B in potential revenue right there! Once Transunion and Experian see the success of this ploy, they may have strangely poorly secured border networks of their own set up invitingly for the retail hacker...
  - xur17 9y ago
    While I agree with your second statement, losing SSN and financial information is vastly different from losing credit card numbers. If my credit card number is stolen, I have to get a new one, and call the bank if any transactions show up before the new card comes. If my SSN and financial history is stolen, someone can impersonate me. They can sign up for bank accounts, loans, credit cards, etc.
  - mobilefriendly 9y ago
    This data is far more valuable and damaging than a credit card. Credit cards are easily canceled and the public has zero liability.
- chiefalchemist 9y ago
SilasX 9y ago
Did you use that strategy with United Airlines after they injured that guy when bouncing him from the flight?
- cloakandswagger 9y ago
  There's an important difference: consumers choose to fly with UA just like they choose to walk into Chipotle and buy a burrito. The vast majority of EFX's profits come from services that consumers (effectively) don't choose to participate in.
  - KGIII 9y ago
    I get your point but, in this case, the consumers are banks and the likes. You aren't, probably, their customer. I'm not suggesting that's right, but it is how it is.
    - cloakandswagger 9y ago
      What impetus do the banks have to change credit rating providers, especially when it would come at massive cost to themselves and probably take months if not years? The only one I can think of would be consumers refusing to open bank accounts or credit cards with them because they run Equifax checks, which seems improbable.
      - KGIII 9y ago
        Right? I don't think they will change. I am biased and jaded, however.
- mikestew 9y ago
  I did. I made bank on that one (I bought calls, but same difference.)
megaframe 9y ago
Doesn't seem low enough to me, at least not low enough to warrant the risk. It has hit a lower price in a 1yr term... Just saying I've been burned with that kind of thinking, sometimes it's best to wait for the anger to settle out and buy into the curve up then try to guess the bottom.
outoftacos 9y ago
The only viable path forward now is to dissolve these three agencies and reform how we manage identity and credit in the United States. It might take a few years, but shareholders and employees of these three companies should start making other plans if they haven't wisely started to already.
mikestew 9y ago
Now would be a great time to go long EFX in my opinion I agree with the sentiment, and I’m keeping my eye out for an opportunity. But I don’t think they’ve been hammered enough. I mean, it’s not like they’ve hit a 52 week low or anything. Maybe if I can find some in-the-money calls for a reasonable price...
c3534l 9y ago
> The stock has been slammed Equifax's stock hasn't been this low since... oh, last November. Hm. Not really sure I'd call that slammed.
jMyles 9y ago
> whether you like it or not, the companies are still technically the victims here Wait, what?! What does whether I "like it or not" have to do with Equifax's profound negligence?

bob1029 9y ago

>but I doubt this leak will have any lasting financial impact. I am going to have to stop you there. As someone who works in the financial sector, I have quite a different view of this situation. Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There will be new PII regulations around the corner for sure. I also question the extent of the leak... I keep hearing it was just basic PII, but if someone got a dump of the entire credit history database, a huge range of financial products (e.g. Knowledge-Based Authentication) become entirely compromised.

cloakandswagger 9y ago
Equifax has an $18B market cap. Can you name one instance of a government imposed fine for improperly stored PII exceeding even $100M? Furthermore, do you have evidence that the PII was improperly stored, or that Equifax's security practices were lacking in any way? The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.
- konceptz 9y ago
  "The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that." Not really accurate because the exploit name, especially as generic as RCE, does not tell you how it was done. RCE can be a number of things that can be fixed in numerous ways. For example, file upload functionality with path manipulation and no file type validation may lead to RCE. This can certainly be removed with properly crafted file upload handling. Some RCE, particularly on lower layers of the application stack, may be more difficult to defend against, especially in the case of unknown exploits.
  - cloakandswagger 9y ago
    Fair enough. I more meant that after an attacker has achieved RCE, no amount of encryption or other practices can protect sensitive info in your database.
    - sdenton4 9y ago
      Why does the webserver need access to All of the Datas? Store the data separately, and create use-tokens for webservers to access data once users have authenticated. The webservers should be treated as if they're potentially compromised, not given arbitrary access to a database...
    - duskwuff 9y ago
      Encryption can't save you, but other practices can. Specifically: if you're working with a lot of very sensitive information, you structure your application such that there are multiple layers separating that data from the outside world. In the case of Equifax, that might mean implementing the "credit score check" as an internal service exposed through the public web servers (or whatever).
      - kevan 9y ago
        Exactly. While nothing can completely stop attackers, there are multiple techniques you can layer to slow them down. E.g: * Credential vaults that allow only-once retrieval on application startup and only keep credentials in memory * anomaly detectors for request patterns (suspicious payload formats, processing time, CPU/memory usage, etc), * Honeypot records in sensitive data stores (records you know should never be accessed, if they are you've been breached) If you're storing information this sensitive you need to be paranoid, because an attacker has a $4B incentive ($30/identity on the black market * 143 million records) to crack your systems.
    - TheCondor 9y ago
      No you have to use other architectures for defending against that. Equifax sells queries to this data, they also use queries to that data as a trigger to change your credit rating. It seems like you'd want a very tightly audited mechanism for issuing these queries to make sure they are properly billed. Referring to it as a struts issue makes it sound like someone popped a web server, fired up a dub client and started dumping unencrypted tables. It seems amazing that nothing tripped up some monitoring or something.
- empath75 9y ago
  Having root on a web server shouldn't give you access to 147 million customer records.
  - cloakandswagger 9y ago
    I'm eagerly awaiting the technical details of the attack. If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. I'm wondering if Equifax is using Struts-provided REST for its entire architecture. If that's the case, gaining access to the web server was only the first step. From there the attacker could perform RCE on sensitive services.
    - sillysaurus3 9y ago
      If it turns out that their web server has 100% unfettered access to the database then I'll gladly pick up a pitchfork as well. You may want to think twice. Try to design an architecture that doesn't have that. If you think it through, you'll realize the best you can do is not to deny access, but to monitor access so that any statistical deviation in requests-per-hour will trigger an alarm. Yet nobody does that, so why should Equifax have been a pioneer in this method? This is the uncomfortable truth that everyone is obscuring here. There wasn't a solution. Equifax got owned, and they happened to have a trove of data. Everyone now wants to see their heads roll, but you too would find yourself in the same situation if you have an RCE on your servers.
      - Iknowsecurity 9y ago
        Agreed
      - kelnos 9y ago
        > You may want to think twice. Try to design an architecture that doesn't have that. We have an architecture like that where I work. It's not that hard. Our web applications have very little direct access to databases; most of it is mediated by services downstream of the web app. That's certainly not a silver bullet, but it makes it impossible to exploit a RCE vuln in the web server in such a way that it lets you have arbitrary access to the database.
- kelnos 9y ago
  > The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that. If the vulnerability used turns out to be the Struts one that was announced at the beginning of the year, then the "magic" here would have been quite muggle-like: update the damn dependency. Not doing so is negligence, plain and simple. (I agree with you, though, that EFX will almost certainly come out of this relatively unscathed.)
  - cloakandswagger 9y ago
    The statement released by Apache said that, if the attack did use the REST plugin vulnerability in Struts, then it would have been a zero-day at the time of use.
    - gaius 9y ago
      You will note that Equifax is not a contributor to Struts - cash or code. They are trying to shift the blame onto something they got for free and work other people did for free.
      - elkos 9y ago
        It's my understanding that Equifax is a multibillion dollar org. (Something in the order of 17 billion USD). Since Struts is a major part of their business infrastructure one would expect a contribution to the Struts project and other software they rely on. They could spin it as "Social Responsibility" too. In retrospect it seems more cost effective to do so too, even if Equifax manages somehow to pay only a few hundred million dollars.
    - bga 9y ago
      Yet Equifax continues to evade giving details on the attack. That itself is damning evidence they weren't doing everything they should have been to protect their servers and data.
- ridgeguy 9y ago
  I wonder if the legal concept res ipsa loquitur (the thing speaks for itself) could apply here? It's one foundation of tort law. The argument would be that the very fact that PII security was breached demonstrates defendant's negligent data storage/security practices. If those practices had been adequate, the breach would not have occurred.
  - cloakandswagger 9y ago
    If that's the case then I'd suggest every software developer on this forum immediately switch careers, this one is doomed.
    - ridgeguy 9y ago
      Well, there is that. Maybe reality is that no set of security practices can ever secure PII. If so, that's an even bigger problem than lackadaisical firms like Equifax. But I think higher expectations, helped along with civil legal machinery that's likely to mete out meaningful punishment, would move us faster to finding out whether the problems are mostly just sloppy practice (which responds to economic penalties) or whether they're more fundamental and need a different fix.
- fred_is_fred 9y ago
  You need to think beyond the fine. There will be costs of new regulations (if passed), increased costs for lobbying against any said efforts, loss of revenue (would you want to have your company name as a partner for Equifax), and finally lawsuits. Going long may make sense but we've not hit bottom yet.
g051051 9y ago
> Best case scenario (for the organization) is that it is fined directly into bankruptcy and someone like FIS acquires them for pennies on the dollar. I am still waiting for CFPB to drop a nuclear bomb over this issue. There is zero chance of that happening. There's been no hint of this from any reputable source (i.e. not clickbait headlines). Will there be financial repercussions? Fines? Loss of stock value? Absolutely. Will Equifax go out of business or get sold? Absolutely not.
SilasX 9y ago
Seriously? I rarely see these deeply enmeshed financial firms get fined into bankruptcy, since they've effectively reached "too big to fail". Kind of optimistic to call that the "best case" scenario.
chiefalchemist 9y ago
If that's true. Then it would encourage a prospective suitor to hack them. Wait for the fallout and then buy in. Certainly it's much cheaper to hire a hacker(s) then pay full price, correct?
nerdponx 9y ago
New PII regulations sure. Fined directly into bankruptcy? Yeah, ok. Just look to BP, Volvo, or any of the now-dozens of companies responsible for massive data breaches in the last few years.
pishpash 9y ago
Knowledge based authentication is crap and therefore worthless. I look forward to it being marked to market.

maxxxxx 9y ago

I thought about that too but it could also be possible that they may get bankrupted by lawsuits. I don't see Equifax as victim. I hope they will go down and be warning for the rest of the financial industry.

cloakandswagger 9y ago
Target lost tens of millions of credit card numbers and paid just over $18 million to settle every lawsuit against them. People seem to conflate the way they think things should be with the way things actually are.
- yborg 9y ago
  Exactly. The costs to EFX will likely be <$100M all out, after all the torch-waving and yelling. Equifax net profit in 2016 was $488M. Longer term, this is actually quite possibly revenue-positive for Equifax - they will trick a non-inconsiderable number of people into signing up for their credit monitoring service, and everyone who wants a credit freeze gets to pay $10 (in Illinois at least). That's $1.45B in potential revenue right there! Once Transunion and Experian see the success of this ploy, they may have strangely poorly secured border networks of their own set up invitingly for the retail hacker...
- xur17 9y ago
  While I agree with your second statement, losing SSN and financial information is vastly different from losing credit card numbers. If my credit card number is stolen, I have to get a new one, and call the bank if any transactions show up before the new card comes. If my SSN and financial history is stolen, someone can impersonate me. They can sign up for bank accounts, loans, credit cards, etc.
- mobilefriendly 9y ago
  This data is far more valuable and damaging than a credit card. Credit cards are easily canceled and the public has zero liability.
chiefalchemist 9y ago

SilasX 9y ago

Did you use that strategy with United Airlines after they injured that guy when bouncing him from the flight?

cloakandswagger 9y ago
There's an important difference: consumers choose to fly with UA just like they choose to walk into Chipotle and buy a burrito. The vast majority of EFX's profits come from services that consumers (effectively) don't choose to participate in.
- KGIII 9y ago
  I get your point but, in this case, the consumers are banks and the likes. You aren't, probably, their customer. I'm not suggesting that's right, but it is how it is.
  - cloakandswagger 9y ago
    What impetus do the banks have to change credit rating providers, especially when it would come at massive cost to themselves and probably take months if not years? The only one I can think of would be consumers refusing to open bank accounts or credit cards with them because they run Equifax checks, which seems improbable.
    - KGIII 9y ago
      Right? I don't think they will change. I am biased and jaded, however.
mikestew 9y ago
I did. I made bank on that one (I bought calls, but same difference.)

megaframe 9y ago

Doesn't seem low enough to me, at least not low enough to warrant the risk. It has hit a lower price in a 1yr term... Just saying I've been burned with that kind of thinking, sometimes it's best to wait for the anger to settle out and buy into the curve up then try to guess the bottom.

outoftacos 9y ago

The only viable path forward now is to dissolve these three agencies and reform how we manage identity and credit in the United States. It might take a few years, but shareholders and employees of these three companies should start making other plans if they haven't wisely started to already.

mikestew 9y ago

Now would be a great time to go long EFX in my opinion I agree with the sentiment, and I’m keeping my eye out for an opportunity. But I don’t think they’ve been hammered enough. I mean, it’s not like they’ve hit a 52 week low or anything. Maybe if I can find some in-the-money calls for a reasonable price...

c3534l 9y ago

> The stock has been slammed Equifax's stock hasn't been this low since... oh, last November. Hm. Not really sure I'd call that slammed.

jMyles 9y ago

> whether you like it or not, the companies are still technically the victims here Wait, what?! What does whether I "like it or not" have to do with Equifax's profound negligence?