12 ms·
Equifax takes down web page after reports of new hack
- ashark 9y agoThe Web has gotten so much worse since we started putting serious stuff on it. It's kind of a population-terrorizing monster, at this point. Could we, like... not do that? I seem to remember the world turning just fine when you couldn't push the right sequence of buttons and steal the personal data of half a country's citizens from the comfort of your home.
- cag_ii 9y agoSomething's doesn't sound quite right over at Equifax, I would have thought that with the scale of the last breach a full and thorough audit of all existing systems would have been a major priority!
- grasshopperpurp 9y agoWhy would you think that? >Hack Will Lead to Little, if Any, Punishment for Equifax https://www.nytimes.com/2017/09/20/business/equifax-hack-penalties.html https://www.nytimes.com/2017/09/20/business/equifax-hack-pen...
- appleiigs 9y agoJust a normal, slow moving, bureaucratic corporation. But even if they were faster, I'm sure an audit of all existing systems is not as simple as making sure all the doors and windows are locked around the house.
- yawz 9y agoYou can hire a good group of independent pen testers or security companies, and let them hammer your public facing sites. They don't lack the necessary financial resources. At least they would have discovered that type of problems. It's not difficult when there's a will.
- ionforce 9y agoKnowing your vulnerabilities, fixing them, and caring about them at all are all different things.
- StanislavPetrov 9y ago>I would have thought that with the scale of the last breach a full and thorough audit of all existing systems would have been a major priority! Why would you think that? Equifax hasn't suffered for its poor security - you have. Indeed, Equifax was rewarded with a massive IRS contract for its malfeasance. Its very much like what we see in the banking sector, where even when the banks get caught stealing, at worse they are fined only a fraction of what they stole, leaving them with a hefty profit. That's what crony-capitalism looks like. Why would Equifax or any other corporation change their very profitable business practices if they don't suffer any downside for their wrongdoing?
- flachsechs 9y agoit's amazing how much the finance industry can get away with. like honest-to-goodness amazing. it's really impressive how these people can have such a death-grip on society. honestly, i'm more curious than mad. how is such a thing even possible? i mean, wow.
- dbmikus 9y agoAvoiding repercussions for bad security is pretty much consistent across all industries.
- kolbe 9y agoIt's not "finance" per se. It's anyone granted a carte blanche privilege of some rent to exploit. This is almost always granted either directly or indirectly by the government. How has finance made it possible? By getting the government to subsidize the industry for all existing entrants at the expense of people who may have better, more progressive ideas about how to manage the financial system. Also at the expense of people in general.
- chaostheory 9y agoThe finance industry as a whole spends a few billion dollars on lobbying. They spend the most on lobbying compared to every other sector. imo this is one of the things the tech industry hasn't fully optimized yet
- aeorgnoieang 9y agoNeither of your first two sentences seem to be true: - [Lobbying Spending Database | OpenSecrets](https://www.opensecrets.org/lobby/top.php?showYear=2017&indexType=i https://www.opensecrets.org/lobby/top.php?showYear=2017&inde...) And note that "Education" isn't spending that much less! > imo this is one of the things the tech industry hasn't fully optimized yet How would the tech industry "optimize" lobbying? Or even just lobbying by finance?
- chaostheory 9y ago
- linarism 9y agoThe incompetence is mindblowing. Could this be a good argument for software engineers to get their professional license?
- Arubis 9y agoIt seems abundantly clear that Equifax's incompetence is _systemic_. Under the presumption that they could have hired better engineers, I fully believe they would have managed them into submission.
- jpk 9y agoOr managed into finding another job, most likely.
- sidlls 9y agoThe kind of licensing here would (or should) provide significant negative consequences for malpractice, possibly including revocation or suspension of the license (and therefore prohibition of working on projects requiring licensed engineers) and even civil or criminal penalties. It also carries credibility and protection: a licensed engineer has a duty to report employers' attempts to circumvent rules like Equifax hypothetically would have done, and legal protection for his livelihood when he does so. It may not prevent truly unscrupulous or spineless engineers from capitulating, but it's better than the current situation.
- nrhk 9y agoOr you know punish the managers for once instead of the footsoldiers... When Wells Fargo had their credit scandal the salesmen shouldn't have been punished, their managers should've. These things start at the top. When deadlines are pushed onto you, you don't have time to write unit tests, refactor, update dependencies.
- sidlls 9y agoLicensing empowers the engineer to refuse to do something that violates sound engineering practice according to the license and have legal recourse against retaliation. It isn't perfect, and the imbalance of power will certainly still be an issue. But that doesn't mean we shouldn't try.
- kumarski 9y agoWhat % of Fortune 500 companies are already paying ransomware fees unbeknownst to their users/customers?
- Posibyte 9y agoI feel like this has to do with Equifax basically not being punished in any major way over the last breach. Their stocks are still priced reasonably well, most of their board is still intact, and US citizens are still required to work with them for credit reasons. And the worst part is, I have no idea how I as a person could say "I don't want to do work with Equifax because I don't trust them." And if anybody has suggestions on that, I'm totally open, because if Equifax was a dripping faucet, they'd be flooding the house by now.
- dsgfhasgjklas 9y ago> And the worst part is, I have no idea how I as a person could say "I don't want to do work with Equifax because I don't trust them." Freeze your account and complain to the service that uses it. Of course, you're not wrong—you have essentially zero leverage.
- astura 9y agoFreezing your account doesn't prevent you from data breaches, your account still exists in their database, they just say "its frozen" when someone requests it.
- dsgfhasgjklas 9y agoThat's true, but that's also true of anywhere that uses social security numbers for identity verification (which is an atrocious pattern considering how poorly ssns are anonymized).
- rgbrenner 9y agofreeze your credit report with Equifax, and then if any company requests it, they'll be denied (because you have to request it be unfrozen for them to receive it). If any company uses Equifax, you'll then be denied credit or they'll ask you to unfreeze it.. either way, you can complain to them, and make it clear you won't work with Equifax. Of course, in practice, this will mean you'll get denied credit from any company that has a contract with Equifax.
- jgladch 9y agoWe're just getting into an era where everything is hackable. We haven't even begun to understand the ramifications...! Privacy has been dead for a long time (did it ever exist?), but we're only just now being confronted with what this means. We have a choice to make: make the world work for everyone, or perish!
- samfriedman 9y agoI agree: I think we have been blessed with a long period of innocence concerning the security of our services and devices. A period that is now coming to an end with increased attacks by increasingly powerful entities. The dot-com-bubble showed us that businesses should not be valued simply because they leverage hot new technology (hold your AI comparisons...). These high-profile hacks and security failures will hopefully show us that businesses should not be considered secure simply because they stack up to other measures of value. I would hope that in the future, a fault in a company's infrastructure security is considered as seriously as a fault in its core business model.
- camus2 9y ago> We're just getting into an era where everything is hackable It's true, however there seems to be a pattern incompetence when it comes to Equifax. When the first hack happened, if my memory serves me well, they started blaming Apache struts for the security breach, which might or might not be true, however the security patch was available for month when the hack occurred.
- Simulacra 9y agoSomeone must not be having a good day over at Equifax. Where is the breaking point for a company like this?
- g051051 9y agoYes, this was discussed earlier today: https://news.ycombinator.com/item?id=15456221 https://news.ycombinator.com/item?id=15456221 And debunked...it wasn't a hack of the Equifax web site, but a malware package delivered by 3rd party analytics company, Fireclick.
- tyingq 9y agoNot exactly. Equifax has hardcoded references to an akamai cache of a domain (hints.netflame.cc) in their own pages[1]. That domain was owned by Fireclick (né Digital River) at one time, but changed ownership on November 15, 2016. The current owner is a Thai national using a personal Gmail address as the registration info. Equifax should be responsible for what 3rd party domains it is referencing in their pages. [1]https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js
- deleted 9y ago[deleted]
- g051051 9y agoThat script was provided by Fireclick, so they're the ones that hardcoded it. It even specifically says "Please do not modify this code".
- tyingq 9y agoI'm not sure that bit matters, it's hosted on an Equifax server and served in their pages. And pulling in a script from a very sketchy domain.
- g051051 9y agoThe script they hosted was legitimate. The Akamai content that it loaded, was legitimate. But Fireclick let the domain lapse, and someone else is now impersonating them and serving malware, and not just to Equifax, either. Why is the story "Equifax hacked again" instead of "Akamai serving content from known spammer site"?
- Apocryphon 9y agoIs Equifax particularly bad for a credit bureau, or are the other guys just as bad? This is cause for worry towards all of these organizations.
- whipoodle 9y agoPretty sure this is just how it is now.
- noddy1 9y agoSolution to the Equifax debacle: 1) If the value of the individual damages related to this breach are in excess of the market cap of the equifax company, all company stock should be seized and distributed equally among those affected by the breach. 2) In the future, if a company controls this amount of sensitive data, they should have mandatory breach insurance. This means that they are covered for a government mandated amount based on the legal liability if all their data was lost. This will mean that the insurers will do in-depth audits of the data security of the company, and they will be incentivized year-to-year to ensure their security practices are top notch. The present system incentivizes each CEO to have a head-in-the-sand approach to data security where a hack is considered a long-tail event unlikely to happen during the ceo's 3-5 year tenure and therefore is not really worth paying attention to. In addition, it would ensure that if the potential damage done if data is leaked exceeds the value of the business storing the data, the insurance will be prohibitively expensive and the company will not be able to continue with this line of business - as it should be.
- mattnewton 9y agoI don’t understand how that would work, do you mean liquidate the company? If you mean actually take the shares from shareholders, wouldn’t the value of the stock go to near zero? Who would buy stock that could do that? But I agree with the general idea: they should go out of buisiness and whatever they have should be sold to reemburse people affected.
- leggomylibro 9y agoI wonder if the Feds could simply seize the company and issue treasury bonds to shareholders to cover the costs of their stake at the market's price. Eminent domain, or whatever legal term is latin for "we have the guns." Then, yeah, liquidate everything and distribute the proceeds amongst the victims. It would be expensive, but...so what? The budget is $2T, and if the fine vastly outweighs the value of the company, then it is clearly a grave situation that demands an unusual response. Maybe they could actually issue a realistic fine, and let the company deal with it. But the company would probably just distribute any remaining assets amongst their executives, fire everyone, and declare bankruptcy or something.
- plandis 9y agoWhere is the action from the federal government? Are any representatives working on legislation for better data protection / handling regulations?
- pnathan 9y agoThe credit services seem like a good candidate for nationalization or high levels of regulation.
- racecar789 9y agoAfter recently freezing credit at all three bureaus...Transunion does it right. Free acct can toggle a freeze anytime. They show a little ad when logging in, but that is fine. Experian has no free acct login. Equifax will next year.