3 ms·

I have yet to see any credible source pinpointing the CVE used to compromise the Equifax data (we all know it's in Struts, but which one was it?). Has something

I have yet to see any credible source pinpointing the CVE used to compromise the Equifax data (we all know it's in Struts, but which one was it?). Has something changed, or is this title clickbait?

sigmar 9y ago
>The attack vector used in this incident occurred through a vulnerability in Apache Struts (CVE-2017-5638), an open-source application framework that supports the Equifax online dispute portal web application. https://www.equifaxsecurity2017.com https://www.equifaxsecurity2017.com ^ the official site, despite looking like a phish There might be more to it, but this vulnerability was definitely used.
- speps 9y ago
  This isn't the official site by the way. https://news.ycombinator.com/item?id=15295146 https://news.ycombinator.com/item?id=15295146
  - snowwolf 9y ago
    Nope. https://securityequifax2017.com/ https://securityequifax2017.com/ is the site referenced in your linked article https://www.equifaxsecurity2017.com/ https://www.equifaxsecurity2017.com/ is the official site
thephyber 9y ago
Note that the linked article isn't clickbait. It's an InfoSec description of how they dealt with the same vuln that hit Equifax. The article was written ~6 weeks before Equifax's stated timeline of attack. To clarify your comment, Equifax did recently reveal[1] the specific vuln (CVE-2017-5638) in Apache Struts that was used during the ~May-July attack that caused the most headlines. [1] https://investor.equifax.com/news-and-events/news/2017/09-15-2017-224018832 https://investor.equifax.com/news-and-events/news/2017/09-15...
- joatmon-snoo 9y ago
  Oh, yes, I understand that the linked article isn't clickbait - I was calling out the title specifically for that reason, because if Equifax hadn't confirmed the CVE, I think it would qualify as a clickbait title ;) Thanks for the link, though, I somehow managed to miss that announcement.

I have yet to see any credible source pinpointing the CVE used to compromise the Equifax data (we all know it's in Struts, but which one was it?). Has something changed, or is this title clickbait?

sigmar 9y ago

>The attack vector used in this incident occurred through a vulnerability in Apache Struts (CVE-2017-5638), an open-source application framework that supports the Equifax online dispute portal web application. https://www.equifaxsecurity2017.com https://www.equifaxsecurity2017.com ^ the official site, despite looking like a phish There might be more to it, but this vulnerability was definitely used.

speps 9y ago
This isn't the official site by the way. https://news.ycombinator.com/item?id=15295146 https://news.ycombinator.com/item?id=15295146
- snowwolf 9y ago
  Nope. https://securityequifax2017.com/ https://securityequifax2017.com/ is the site referenced in your linked article https://www.equifaxsecurity2017.com/ https://www.equifaxsecurity2017.com/ is the official site

thephyber 9y ago

Note that the linked article isn't clickbait. It's an InfoSec description of how they dealt with the same vuln that hit Equifax. The article was written ~6 weeks before Equifax's stated timeline of attack. To clarify your comment, Equifax did recently reveal[1] the specific vuln (CVE-2017-5638) in Apache Struts that was used during the ~May-July attack that caused the most headlines. [1] https://investor.equifax.com/news-and-events/news/2017/09-15-2017-224018832 https://investor.equifax.com/news-and-events/news/2017/09-15...

joatmon-snoo 9y ago
Oh, yes, I understand that the linked article isn't clickbait - I was calling out the title specifically for that reason, because if Equifax hadn't confirmed the CVE, I think it would qualify as a clickbait title ;) Thanks for the link, though, I somehow managed to miss that announcement.