4 ms·
It's struts, and the CVE fix was pushed to a newer version than the one they were using. That's an intense app rebuild, akin to moving mongo versions.
by freeone3000 9y ago
It's struts, and the CVE fix was pushed to a newer version than the one they were using. That's an intense app rebuild, akin to moving mongo versions.
- krirken 9y ago> That's an intense app rebuild That is not even close to an excuse. A remote code execution vulnerability has the potential to destroy your whole company.
- dannyw 9y agoI hope Equifax will be learning from this, but can you tell your CEO that your core business must be shut down for 3 weeks as you upgrade and rebuild the system?
- krirken 9y agoYes, the risk is much higher than the cost. From the article: > The company's internal review of the incident continued. Upon discovering a vulnerability in the Apache Struts web application framework as the initial attack vector, Equifax patched the affected web application before bringing it back online. That bullet point lies between the "July 30th" and "August 2nd" bullet points. Based on that timeline, the vulnerability took days to patch.
- pestkranker 9y agoEquifax is big enough to contribute and apply the patch to their version. Then, of course, update and deploy.
- speedplane 9y agoThe reason they don't is that they just don't care... and for their business that's the rational decision. Data security isn't as core to their business as it is to a bank. If a bank has a breach, bank accounts get drained. If Equifax has a breach, it's annoying but manageable fines and their CEO gets grilled in a few congressional hearings. Equifax's core business is about giving out credit scores. I'd bet their biggest fear is giving someone a high score when they deserve a low one. Data breaches, moderately inaccurate information... a nuisance, but a sideshow.