4 ms·

In multiple threads now I've seen you express this sentiment. I just don't buy it. Vanguard hasn't had a leak like this. USAA hasn't had a leak like this. ETrad

by js2 9y ago

In multiple threads now I've seen you express this sentiment. I just don't buy it. Vanguard hasn't had a leak like this. USAA hasn't had a leak like this. ETrade, Fidelity, etc, no leaks like this of which I'm aware (correct me if I'm wrong). These are big plodding institutions too. No leaks like this from Google nor Facebook nor Amazon. Maybe you're arguing it's just a matter of time, but I disagreee. Equifax had a trivially easy architecture to break. Minimally, the data should be on a separate set of servers protected by an API with rate limiting, and that API should be implemented on top of a different framework than the front-end servers to minimize the chance that a single flaw would open up the entire set of data. This isn't rocket science. Equifax is a multi-billion dollar company. They could and should have done better. Please stop defending them? Disclosure: I work for Yahoo (er, Verizon) since late 2013. I don't know the details of Yahoo's data leaks, but it was not as trivial as getting RCE on Yahoo's public facing servers.

sillysaurus3 9y ago
When two people are clearly intelligent but disagree, the reason is almost always a different set of experiences. My experience differs from yours; if I could Vulcan my brain to yours, you'd see why I feel this way. You might still disagree, but it would be far less clear cut. Now, I've seen nearly a hundred codebases and they all looked pretty much like Equifax. I don't even need to see Equifax to know the kind of disaster their codebase facilitated. Equifax's codebase is your code, and my code, and Bob's code. The only way to make this situation better is to talk openly about it. And the best way to do that is to actively defend the unpopular side in order to call attention to uncomfortable truths. It's a calculated strategy. Just because you worked at a place with good security hygiene, it makes no difference to the world at large. Everybody else looks like Equifax. We need to (a) acknowledge that and (b) actively seek out solutions. That's what's happening here. Ask yourself: "Why do I disagree when I've seen one or two enterprise codebases?" Those big, plodding institutions you mention are similarly vulnerable. Everyone is. Why aren't data breaches happening almost daily? Because it's illegal. It's no coincidence that companies with public bug bounties are among the hardest targets to hit. When you make it not-illegal to attack you, surprise: you find the vulns. A good question is, "is it illegal for a white hat to attack my business?" If the answer is yes, seek to change that. It's a low effort thing that will increase your security posture. But it's no substitute for $40k pentests.
- js2 9y ago
  > Everybody else looks like Equifax. I don't doubt that there are other Equifaxes out there, nor do I doubt that there will be more leaks. But this wasn't a simple matter of a horrible code base. Heck, the leak wasn't even due to Equifax code, it was due to third party code. Other companies of Equifax's size apparently do better. Equifax should have done better, and I'll bet if the penalties for losing this data were more severe, would have done better.
  - sillysaurus3 9y ago
    You can bet all you want. Your head will roll next, after Equifax and everyone else you decide to demonize. Once the avalanche starts, it won't stop. Know what happens when you demonize something? People stop reporting it. Look at the actual damage to actual people. You are arguing for prison time for the execs, if I remember correctly. Yet it's unclear that a single person has yet been materially damaged by these leaks. If you want to suck away N years of someone's life, you have a higher bar to clear.
    - js2 9y ago
      (Meta: I think we edited our replies past each other.) I haven't commented on the Equifax incident, so you're confusing me for someone else. I don't have an opinion one way or the other on criminal negligence. How do we incentivize (or regulate?) companies to do a better job handling confidential data?
      - sillysaurus3 9y ago
        Ah, gotcha. Isn't it a bit scary seeing people argue for prison time for this? It's pretty easy to imagine webdevs becoming the actual targets / scapegoats rather than the execs. A note of "Well, let's not be too hasty" would seem to be in order. Part of the problem is that security breaches matter, but they don't matter. It's like the negative externality of factory pollution. One day perhaps the effects will become visible, but this disaster is about as bad as you can get and it's still not obvious that a lot of people are going to lose anything significant from the breach. If someone wanted to impersonate you, they can usually find a way already. Of course, if the 140M SSNs become public, that will change the situation completely. Possibly even for the better: then we'd finally stop relying on them to be secret when they were never designed to be. Believe it or not, the situation now is drastically better than it was a decade ago. People care about getting pentests now. You can grudgingly force a company to fork over the money. One of the best ways to get companies to become more secure is to force them. Most of the companies who were being pentested didn't want to be; they were forced to, because some other business refused to do business with them until they produced a document stating they were reasonably secure. This special document is only obtainable from a security firm; hence, pentests happen, and the world is marginally more secure.
CodeWriter23 9y ago
I don't see sillysaurus3 defending Equifax. I see him talking about the elephant in the living room. No system is invulnerable yet the fortune and well being of half (or more) of the population of our planet depends on those systems being safe. We need a new paradigm. The basic principles of security, no matter how skillfully and deeply applied are inadequate to defend against a determined attacker. We need a new paradigm. I'm not sure what that is, and as long time Microsoft detractor, I'm loathe to say maybe Azure's just-announced secure enclave architecture just might be that new paradigm. Of course, I'm sure they'll fuck it up some way or another.
- js2 9y ago
  You're right. I mischaracterized sillysaurus3's position. I would only argue that there are different levels of competence in protecting data and some company has to be the worst. So far, Equifax seems to be that company. Right now, they are deserving of scorn. At the same time, sure, it's good to recognize that we're failing at security as an industry.
  - CodeWriter23 9y ago
    I agree with you 100%. I prefer to characterize our current security landscape as the "Bear Attack" model. If you run slow the bear will eat you first. But even if you run faster than anyone else the bear will still eat you when she catches you.
cookiecaper 9y ago
Like much of the infrastructure in the real world, the sad fact of cybersecurity is that in many cases, attacks aren't known merely because someone semi-informed has not committed much effort to getting in, or more likely, has not yet triggered an event that would publicize their intrusion. sillysaurus may be overgeneralizing a bit but he is correct about the vast majority of companies. To me, the key differentiator between companies with serious security projects v. companies with me-too, mantlepiece-style security projects is active, engaged technical leadership at the very top. This is not to defend Equifax as much as it's to desecrate the widespread dogma of the managerial class that an MBA qualifies a person to lead any project. Time after time after time, most of us who've worked in corporate America have seen security pushed to the bottom of the stack, only becoming a consideration for about 18 months after the last close call or underpublicized breach. There is virtually no appreciation for the problem itself at high levels, or the complexity involved in reasonably subjugating it. CISO is something of a nightmare job because you're essentially the company's designated patsy/lightning rod. Most of the time, CISOs and those in analogous roles get stuck with the blame for the company's security without ever really being given the authority to do anything about it. I knew a CISO who set up camp, including prop tent, outside of the CIO's office until he finally agreed to get his guys to patch a server. The CISO took a picture of himself doing so, because he knows the game; if the intrusion occurred, he would have apparent visual proof that would allow him to deflect blame onto the CIO. Reckless disregard like this is absolutely common and routine, and if you have any doubt about that, a cursory inspection of the sites of companies that are not tech pioneers will easily disabuse you of any contrary notion. Equifax is not alone here, not by a long shot. Not even among large companies dealing with sensitive financial data (don't ask how I know). The only reason we haven't seen (or, more likely, haven't learned about) widespread cyber-intrusion-apocalypse is because semi-competent people just have other things to do, and there is substantial legal risk if caught. I fully believe that 95% of America's biggest companies have systems that are easily penetrable. Again, let me reiterate that this is not making an excuse for Equifax. It's just acknowledging that the problem supersedes this single instance. We need a revolution in system admin and application security before we'll solve these issues, because the plain fact is that companies simply can't be trusted to do it under the current conditions.
stouset 9y ago
Infosec guy here. I don't believe those systems are necessarily any more secure than Equifax's. It may be that Equifax got breached first. But it's also partially because it's actually incredibly difficult to steal funds from traditional financial institutions. Not because of technical security measures. But because of procedure and regulations. As an example, money illegitimately moved from bank A to bank B can (and in most cases must) be reversed. Even if done digitally.

by js2 9y ago

sillysaurus3 9y ago

When two people are clearly intelligent but disagree, the reason is almost always a different set of experiences. My experience differs from yours; if I could Vulcan my brain to yours, you'd see why I feel this way. You might still disagree, but it would be far less clear cut. Now, I've seen nearly a hundred codebases and they all looked pretty much like Equifax. I don't even need to see Equifax to know the kind of disaster their codebase facilitated. Equifax's codebase is your code, and my code, and Bob's code. The only way to make this situation better is to talk openly about it. And the best way to do that is to actively defend the unpopular side in order to call attention to uncomfortable truths. It's a calculated strategy. Just because you worked at a place with good security hygiene, it makes no difference to the world at large. Everybody else looks like Equifax. We need to (a) acknowledge that and (b) actively seek out solutions. That's what's happening here. Ask yourself: "Why do I disagree when I've seen one or two enterprise codebases?" Those big, plodding institutions you mention are similarly vulnerable. Everyone is. Why aren't data breaches happening almost daily? Because it's illegal. It's no coincidence that companies with public bug bounties are among the hardest targets to hit. When you make it not-illegal to attack you, surprise: you find the vulns. A good question is, "is it illegal for a white hat to attack my business?" If the answer is yes, seek to change that. It's a low effort thing that will increase your security posture. But it's no substitute for $40k pentests.

js2 9y ago
> Everybody else looks like Equifax. I don't doubt that there are other Equifaxes out there, nor do I doubt that there will be more leaks. But this wasn't a simple matter of a horrible code base. Heck, the leak wasn't even due to Equifax code, it was due to third party code. Other companies of Equifax's size apparently do better. Equifax should have done better, and I'll bet if the penalties for losing this data were more severe, would have done better.
- sillysaurus3 9y ago
  You can bet all you want. Your head will roll next, after Equifax and everyone else you decide to demonize. Once the avalanche starts, it won't stop. Know what happens when you demonize something? People stop reporting it. Look at the actual damage to actual people. You are arguing for prison time for the execs, if I remember correctly. Yet it's unclear that a single person has yet been materially damaged by these leaks. If you want to suck away N years of someone's life, you have a higher bar to clear.
  - js2 9y ago
    (Meta: I think we edited our replies past each other.) I haven't commented on the Equifax incident, so you're confusing me for someone else. I don't have an opinion one way or the other on criminal negligence. How do we incentivize (or regulate?) companies to do a better job handling confidential data?
    - sillysaurus3 9y ago
      Ah, gotcha. Isn't it a bit scary seeing people argue for prison time for this? It's pretty easy to imagine webdevs becoming the actual targets / scapegoats rather than the execs. A note of "Well, let's not be too hasty" would seem to be in order. Part of the problem is that security breaches matter, but they don't matter. It's like the negative externality of factory pollution. One day perhaps the effects will become visible, but this disaster is about as bad as you can get and it's still not obvious that a lot of people are going to lose anything significant from the breach. If someone wanted to impersonate you, they can usually find a way already. Of course, if the 140M SSNs become public, that will change the situation completely. Possibly even for the better: then we'd finally stop relying on them to be secret when they were never designed to be. Believe it or not, the situation now is drastically better than it was a decade ago. People care about getting pentests now. You can grudgingly force a company to fork over the money. One of the best ways to get companies to become more secure is to force them. Most of the companies who were being pentested didn't want to be; they were forced to, because some other business refused to do business with them until they produced a document stating they were reasonably secure. This special document is only obtainable from a security firm; hence, pentests happen, and the world is marginally more secure.

CodeWriter23 9y ago

I don't see sillysaurus3 defending Equifax. I see him talking about the elephant in the living room. No system is invulnerable yet the fortune and well being of half (or more) of the population of our planet depends on those systems being safe. We need a new paradigm. The basic principles of security, no matter how skillfully and deeply applied are inadequate to defend against a determined attacker. We need a new paradigm. I'm not sure what that is, and as long time Microsoft detractor, I'm loathe to say maybe Azure's just-announced secure enclave architecture just might be that new paradigm. Of course, I'm sure they'll fuck it up some way or another.

js2 9y ago
You're right. I mischaracterized sillysaurus3's position. I would only argue that there are different levels of competence in protecting data and some company has to be the worst. So far, Equifax seems to be that company. Right now, they are deserving of scorn. At the same time, sure, it's good to recognize that we're failing at security as an industry.
- CodeWriter23 9y ago
  I agree with you 100%. I prefer to characterize our current security landscape as the "Bear Attack" model. If you run slow the bear will eat you first. But even if you run faster than anyone else the bear will still eat you when she catches you.

cookiecaper 9y ago

Like much of the infrastructure in the real world, the sad fact of cybersecurity is that in many cases, attacks aren't known merely because someone semi-informed has not committed much effort to getting in, or more likely, has not yet triggered an event that would publicize their intrusion. sillysaurus may be overgeneralizing a bit but he is correct about the vast majority of companies. To me, the key differentiator between companies with serious security projects v. companies with me-too, mantlepiece-style security projects is active, engaged technical leadership at the very top. This is not to defend Equifax as much as it's to desecrate the widespread dogma of the managerial class that an MBA qualifies a person to lead any project. Time after time after time, most of us who've worked in corporate America have seen security pushed to the bottom of the stack, only becoming a consideration for about 18 months after the last close call or underpublicized breach. There is virtually no appreciation for the problem itself at high levels, or the complexity involved in reasonably subjugating it. CISO is something of a nightmare job because you're essentially the company's designated patsy/lightning rod. Most of the time, CISOs and those in analogous roles get stuck with the blame for the company's security without ever really being given the authority to do anything about it. I knew a CISO who set up camp, including prop tent, outside of the CIO's office until he finally agreed to get his guys to patch a server. The CISO took a picture of himself doing so, because he knows the game; if the intrusion occurred, he would have apparent visual proof that would allow him to deflect blame onto the CIO. Reckless disregard like this is absolutely common and routine, and if you have any doubt about that, a cursory inspection of the sites of companies that are not tech pioneers will easily disabuse you of any contrary notion. Equifax is not alone here, not by a long shot. Not even among large companies dealing with sensitive financial data (don't ask how I know). The only reason we haven't seen (or, more likely, haven't learned about) widespread cyber-intrusion-apocalypse is because semi-competent people just have other things to do, and there is substantial legal risk if caught. I fully believe that 95% of America's biggest companies have systems that are easily penetrable. Again, let me reiterate that this is not making an excuse for Equifax. It's just acknowledging that the problem supersedes this single instance. We need a revolution in system admin and application security before we'll solve these issues, because the plain fact is that companies simply can't be trusted to do it under the current conditions.

stouset 9y ago

Infosec guy here. I don't believe those systems are necessarily any more secure than Equifax's. It may be that Equifax got breached first. But it's also partially because it's actually incredibly difficult to steal funds from traditional financial institutions. Not because of technical security measures. But because of procedure and regulations. As an example, money illegitimately moved from bank A to bank B can (and in most cases must) be reversed. Even if done digitally.