3 ms·
The CVE and the patch came out on March 7. Exploits were already being detected in the wild at the time by perimeter security vendors. See http://blog.talosinte
by guelo 9y ago
The CVE and the patch came out on March 7. Exploits were already being detected in the wild at the time by perimeter security vendors. See http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html http://blog.talosintelligence.com/2017/03/apache-0-day-explo...
Equifax "believes" that the hackers got in on May 13. They had some kind of intrusion detection system that finally detected the intrusion on July 29. 5 months after the "Critical" CVE alert went out. During that time security vendors were adding firewall rules to stop the attack. But apparently Equifax didn't have any other security in front of the Struts server.
That just seems like unconscionable incompetence and malpractice for such a high value target.
- dannyw 9y agoThis should be negligence. Perhaps not criminal negligence, but should be sue-able c
- Flammy 9y ago> They had some kind of intrusion detection system that finally detected the intrusion on July 29. If they had some sort of intrusion detection system, I gotta think they would have picked up on this in days, not more than 2 months later. I feel like this is one of those situations where a dev is saying something like "where is all of the CPU on this database going?" or "Why is the network connection so slow?" and digs into it and finds some strange behavior...