3 ms·
I just read about how the hack was done. Shockingly stupidly easy! 1. They realized that Equifax uses Struts. 2. They modified struts! and 3. Equifax used t
by codecamper 9y ago
I just read about how the hack was done. Shockingly stupidly easy!
1. They realized that Equifax uses Struts. 2. They modified struts!
and 3. Equifax used the updated code on their servers.
DUUUUUHHHHHH!
- joefkelley 9y agoDo you have a source for 2? I'd like to read more about it.
- codecamper 9y agoa $ 14 billion company gives away the only secret data that they exist to protect. Why? Because they used Struts. How difficult is it to write a slimmed down, secure version of Struts?
- Iknowsecurity 9y agoIt is more: - Critical remote execution bug was discovered in Struts2. - The vulnerability goes public too quickly. - Hackers start scanning the Internet - Equifax is found vulnerable. - Vulnerability is exploited.
- codecamper 9y ago$14 billion company cannot convert what the servlet API gives into a method call on a certain object + a bit of reflection to update methods & print them into form elements. Super complicate! If the $14 billion can't do that then they certainly cannot protect data.