4 ms·

> Equifax had _failed_ to implement that remedy, because it was 'difficult', 'complex' (due to its own application / deployment / infrastructure), for several m

• kogepathic 9y ago
  I don't work for Equifax, so I can't give you any inside information which confirms why they didn't patch Struts. However it is common knowledge among security professionals that it was the unpatched Struts vulnerability that lead to the data compromise. [0] [0] https://krebsonsecurity.com/2017/09/equifax-hackers-stole-200k-credit-card-accounts-in-one-fell-swoop/ https://krebsonsecurity.com/2017/09/equifax-hackers-stole-20...
  • g051051 9y ago
    It was also announced by Equifax themselves so of course it's common knowledge. I'm not sure of your point here. https://investor.equifax.com/news-and-events/news/2017/09-15-2017-224018832 https://investor.equifax.com/news-and-events/news/2017/09-15... "Upon discovering a vulnerability in the Apache Struts web application framework as the initial attack vector, Equifax patched the affected web application before bringing it back online."
    • spathi_fwiffo 9y ago
      He already made his point: "Struts had provided a remedy for the fault, months prior." According to your quote, they patched only after they were the victims of a breach; they should have been pro-active and dealt with the issue as soon as the vulnerability was made public.
      • g051051 9y ago
        You're assuming that they took no action, as opposed to not being 100% effective in their detection and coverage. There's no evidence that they simply ignored it. If they're using Struts, all they had to do is miss one instance of the wrong jar somewhere in their software ecosystem.