10 ms·
Equifax website hacked again, this time to redirect to fake Flash update
- DarronWyke 9y agoI used to work for Experian (I know, not Equifax, but it's an equivalent company). None of this surprises me. These companies will do anything they can to protect and maintain revenue streams. This includes avoiding security.
- rlvesco7 9y agoNoticed this on Monday. After registering for fraud alert, they send an email that has link to http://www.equifax.com/fcra http://www.equifax.com/fcra for free credit report. This was getting hijacked. But not if you used https:// https://
- Matt3o12_ 9y agoWhy would they send you to a http at all if they already have https. This just seems like complete incompetence. It’s not like they have an excuse like their ad networks don’t work with https.
- froindt 9y agoSomeone in marketing probably didn't know that it mattered. Same with the head person who approved the email. But don't worry, they'll have an engineer approve it next time as well!
- RainaRelanah 9y agoBut there are protections against this, such as HSTS. I would expect someone with as much sensitive information as Equifax to have HSTS + HPKP pinned into the major browsers. Their server should never even receive an HTTP request. It's just unrivaled incompetence.
- discreditable 9y agoHSTS doesn't help if it's your first visit to the site. To work around that they'd need to get into a preload list.
- andygambles 9y agoWhich is easy if you set preload header.
- tonyztan 9y agoThis. The technology (HSTS, HPKP, Subresource Integrity, upgrade-insecure-requests) is there; sites that need it just don't seem to use it.
- Matt3o12_ 9y agoNormally, people in marketing don’t write URLs by hand. They copy them and check that they look nice or have a generator make them for them. So, how did they copy an http url instead of https because they website should have redirected them to https before processing the request (and I just hope that their internal network isn’t compromised).
- BearGoesChirp 9y agoI know of companies with typos in their links that they email. These typos lead to scam sites. I've contacted them and they haven't yet fixed it. There needs to be a serious re-evaluation of the costs associated with failing such basic security measures like using https and just making sure you send people the correct link. Right now it isn't even a slap on the wrist.
- reaperducer 9y agoProbably because security is handled by the IT department, and email communication is handled by the much less tech-savvy Communications department.
- tyingq 9y agoThe specific js that was hijacked is here: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js That page pulls it in. Edit: maybe a red herring. Sure looks shady though.
- Sujan 9y ago<!-- Fireclick Web Analytics - COPYRIGHT 1999-2005 ...
- g051051 9y agoSo was it Equifax that was hacked, or Fireclick?
- tyingq 9y agoEquifax. That url is Equifax controlled. It just mentions fireclick in a comment. Click the url for the js and you'll see that it does a document.write to inject a script that's an akamai cached copy from an obscure .cc domain hosted file...this one: https://a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/service/script/www.annualcreditreport.com https://a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/se...
- ryanlol 9y agoThis obscure .cc domain pretty obviously belongs (or used to belong, they let it lapse in 2016 and it was re-registered) to Fireclick.
- tyingq 9y agoHmm. Perhaps not what I thought. Looks hacked and shady, but perhaps this isn't it.
- g051051 9y agoYeah, looks like a compromised ad/stats provider. That would also explain the intermittent nature of the bad download. I'd hope that the article gets updated with the facts...other companies might be vulnerable to this as well.
- jbeales 9y agoIf you don't want to pull out your phone, throw Chrome into Responsive Design mode and you'll get the same results.
- jbeales 9y agoLooks like they just took the page down as I was poking around trying to figure out where the redirect(s) came from. Edit: Of course the error message is truthful: >The Equifax.com website and Equifax Member Center are experiencing unusually high volumes due to responses to the recently announced Cybersecurity Incident. We are working diligently to better serve you, and apologize for any inconvenience this may cause. We appreciate your patience during this time and ask that you check back with us soon. /s
- hacker_9 9y agoI assume this must be because after the initial hack, every kid with a script pointed it at Equifax to see what they could get too. I would not want to be in the IT department at that company right now.
- mrguyorama 9y agoIf the average script kiddie can meaningfully compromise your infrastructure, aren't you already screwed? Pretty much every automated attack possible is launched at every internet addressable server on a daily basis. I ran a web server for a couple years with nothing on it but nearly empty personal sites and files, and over 50% of its hits were automated scans and attacks
- gaius 9y agoI am not generally a fan of heavy handed regulations but the government needs to step in and shut Equifax down right now. Literally pull the plug on everything they own.
- theyregreat 9y agoUpdating James Madison: If everyone were honest, neither greedy nor malicious, did pay attention, were competent, including securing their apps, and didn’t have either fires, floods or roads, no regulation or government would be necessary.
- eradicatethots 9y agoI think we should still strive to move towards being that way. Greed and maliciousness breed greed and maliciousness and it’s be good to root them out wherever we can.
- ngold 9y agoIn the absence of civil institutions regulated by the people, regulation does not disappear. The mantle is picked up by corporations. It's our choice.
- deleted 9y ago[deleted]
- emmab 9y agoIf they have this much trouble with security imagine what else they might be failing at unbeknownst to us.
- bryanrasmussen 9y agodrinking water without it dribbling out the corners of their mouths?
- dcow 9y agoI'm not sure what's worse: the fact that Equifax just got $7.25M for identity services from the IRS or the realization that the IRS just spent $7.25M on data they can get for free...
- unixhero 9y agoHahaha (risking downvotes; I stand tall, bring it on)
- HHalvi 9y agoWhat's their excuse this time ? A single worker brought in a cat that bit our entire server facilities power supply ? Or some random guy who handled credentials was picked up by Aliens.
- eltoozero 9y agoAliens would be about the only acceptable excuse. Russian aliens.
- TeMPOraL 9y agoMars is Red. Coincidence?
- deleted 9y ago[deleted]
- pilsetnieks 9y agoYou know how "admin:admin" aren't very good credentials for a supposedly secure production system dealing with sensitive information? Well, turns out, neither is "admin123"
- jonssons 9y agowhat. again?
- eltoozero 9y agoPart of me says "wow, what blatant incompetence", but the part of me that does IT consulting is not surprised.
- warent 9y agoThis isn't fair and they need to slow down; I want my small claims lawsuit to pay off before they put themselves out of business.
- YPCrumble 9y agoSay more please! What are the damages you claimed? Just having your personal information stored insecurely should be grounds enough for damages but in the world of "identity theft" I didn't think it would have a case in small claims.
- 0xfeba 9y agoYeah, good luck showing damages. You basically have to wait until your identity is used for fraud, and then probably tie it specifically to the breach.
- pbadenski 9y agoMakes me think. Can I ask my bank to stop sharing my data with Equifax. Would they honour the request? Anyone working for a bank, what do you think?
- deleted 9y ago[deleted]
- jon-wood 9y agoAt least in the UK it's a legal requirement for banks to share details with credit rating agencies, so no, they couldn't if they wanted to.
- Silhouette 9y agoCan you give any more information about that, please? Certainly when you apply to use financial services in the UK the terms often include consent to share your data with credit reference agencies, but this is the first time I've ever seen a suggestion that banks were required by law to do so. If that's the case then, given the demonstrable incompetence of Equifax, that law should be changed immediately!
- rahimnathwani 9y agoI don't believe that's true. (If it were, I could set up a credit rating agency, have all the banks share details with it, and then have free credit reports for my own (hypothetical) consumer lending business, rather than paying a pound or two for each pull.) Care to cite the specific law? I'd be very interested in knowing, if such a law exists.
- mattmanser 9y agoOh, you think it's a fair playing field? If you're not old chums with the right person in government, you won't be classified as a credit rating agency.
- noxToken 9y ago
- need2sleep 9y agoSince when is it ok to publish this without a single shred of evidence to support the dude's claims? Laughable to say the least. Dude probably got owned locally.
- deleted 9y ago[deleted]
- eradicatethots 9y agoMaybe I’m not aware but I’m pretty used to just trusting large news outlets with good credibility on things like this
- RainaRelanah 9y agoNot at all, the site is definitely compromised. Someone posted a link[0] that when I opened on mobile is redirecting to a malware site. Confirmed on two separate Android devices running 7.1 + Chrome. [0] https://news.ycombinator.com/item?id=15456533 https://news.ycombinator.com/item?id=15456533
- tyingq 9y agoJust tried http://www.equifax.com/fcra http://www.equifax.com/fcra myself...it redirects to obviously shady sites, right now. Edit: Currently it's doing it only for specific client user agents. Try an android one. This javascript is driving part of it: https://a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/service/script/www.annualcreditreport.com https://a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/se... Edit: Found the bad bits. They are here: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js See the part that starts with document.write() Edit: maybe a red herring. Sure looks shady though.
- ballenf 9y agoWhat's the stack used for the real https version? I got redirected there (I guess malware doesn't like Safari desktop or uBlock origin saved me) and felt like I fell through a time warp to 2007 (update: 2004, in actuality) with the form Equifax presents. So much low-res skeuomorphism I almost got nostalgic. Not necessarily related to the security issues, just curious. Edited to add: The site has a Copyright of 2004. None of the JS tools are later than that. Is this really the current site in use? Unchanged for 13 years... wow. Would be sorta cool, you know, if it wasn't completely hacked.
- davidcollantes 9y agoDoes Randy Abrams has a website? Does anyone knows anything else about the source? EDIT: Found it: http://randy-abrams.blogspot.com http://randy-abrams.blogspot.com
- noinput 9y agoMaybe now they'll add the Hacker Safe badge to their site so this never happens again.
- poorman 9y agoNothing surprises me these days. http://www.snopes.com/2017/10/05/equifax-contract-irs/ http://www.snopes.com/2017/10/05/equifax-contract-irs/
- sdshx 9y agoIt seems to be a random occurrence, I was able to trigger a pull of the infected page with the full request records: https://tools.pingdom.com/#!/dWEfQI/http://www.equifax.com/fcra https://tools.pingdom.com/#!/dWEfQI/http://www.equifax.com/f... Interestingly, I ran into a similar issue with Yahoo earlier this week serving almost identical advertisements so this may be more widespread.
- g051051 9y agoEquifax was loading this script: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js This script, from Fireclick Web Analytics, then loaded a script via Akami CDN that was hosted for a Fireclick domain, netflame.cc: a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/service/script/www.annualcreditreport.com So this package was not coming from Equifax, but was being injected by a compromised analytics provider.
- FilterSweep 9y agoThat's Internet 2.0 in it's purest form, no?
- easytiger 9y agoJust got this same thing on some other site.
- ceejayoz 9y agoWe were just talking about the potential dangers of these third-party analytics scripts the other day. https://news.ycombinator.com/item?id=15442636 https://news.ycombinator.com/item?id=15442636
- Bartweiss 9y agoThis is only reinforcing my conviction that blocking scripts and advertising isn't a consumer decision but a security one. I'm not unwilling to be advertised to (or analyzed), but I'm completely unwilling to expand my vulnerability from "the site I opened" to "every external service they can think to load".
- notyourwork 9y agoAnd the problem is the general population doesn't understand this.
- deleted 9y ago[deleted]
- yellowapple 9y agoSo which IT employee is going to be thrown under the bus this time?
- MrGhrelin 9y agoThese people need to spend some money and get some good IT staff. The people at the top are getting all the cream, while the people that actually keep things going need an upgrade.
- tonyztan 9y agoEquifax (and other sites that should care about security) should use Subresource Integrity, which prevents resources from being hijacked. https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- LP550 9y ago,
- erlendr 9y agoCSP.