6 ms·

I had a non-technical friend whose fatalistic impression was that "these things happen and there's nothing that can be done given a determined attacker." Well,

I had a non-technical friend whose fatalistic impression was that "these things happen and there's nothing that can be done given a determined attacker." Well, look, I said, these hackers aren't going in like Mission: Impossible. Equifax was incompetent, and there's zero penalty for utter incompetence. There must be. The Equifax hack was the equivalent of data malpractice. It's like a hospital mixing up the labels on saline and hydrogen cyanide and then saying, "Whoops. Sorry about that." The cavalier attitude that companies have about data security infuriates me. Americans will be dealing with the repercussions of this for the rest of their lives. Meanwhile, Equifax keeps making money. Equifax's entire business was trading off of our data, but protecting that data was evidently not a priority for them. They should be fined into oblivion.

RachelF 9y ago
My opinion is that information about you should belong to you. Other entities should not be allowed to keep or trade information about individuals without paying them directly. That way people will realise that their personal info is worth something.
- mjevans 9y ago
  The problem is this is effectively a reputation score; only you have very limited rights to see it* (once a year, per agency; and only if you ask... Oh and BTW, I pulled /all/ of mine just before it came out that the breach happened; :( ) Also a problem; they use simple knowledge of a single magic number as authentication ('identification'). The three current companies in the US could have gotten together and worked around the lack of a national ID and created a private SIN cryptographic... but that would cut in to their profits. Though I hear other countries that have done this also have issues with 'business individuals' being contacted and scam attempts rampantly abusing their data...
- will_hughes 9y ago
  > Other entities should not be allowed to keep or trade information about individuals without paying them directly. To be the devils advocate for a moment, what about the other side of that? Should businesses not be able to keep and share records saying "This person owes us money but refuses to pay"?
  - razakel 9y ago
    >Should businesses not be able to keep and share records saying "This person owes us money but refuses to pay"? No, because you would have practically no recourse if you were wrongly on such a list, and might not be able to prove you even were on it or that it exists. It's called "blacklisting". You have a common name and share a birthday with a felon? Say goodbye to your chances of getting a credit card!
    - Spooky23 9y ago
      The biggest issue there is for screening for guns and some employment screening. If you’re name is John Smith, good luck!
    - astura 9y ago
      That's not how credit reporting laws work the United States. It's true that they could/should be stronger/tightened/held to a higher standard, but there is a process to dispute your credit file. Creditors are legally required to give you certain information when they deny you for credit.
      - CaptSpify 9y ago
        That is not how the credit reporting laws work, but it's how the system works. That process is extremely flawed and unreliable. Have you ever tried disputing your credit? good fucking luck. I've been arguing with Equifax for over a year because they "have it on record" that I lived somewhere that I've never lived. I have no legal recourse unless I want to spend thousands of dollars on lawyer fees.
        bdhess 9y ago
        You shouldn't need a lawyer to pursue them. Assuming you're within the time periods prescribed in the FCRA, you can file your own complaint in your local small claims court. Before that, I'd send them a letter clearly marked "Notice of Intent to Sue" (on the letter and envelope) stating what information is incorrect, and that you plan to file a suit in [insert name of small claims court] on [insert reasonable date] seeking $1,000 in damages for each violation per 15 USC 1681(n), unless the disputed information is removed before that date. And enclose any supporting documentation, and history of previous fruitless correspondence. IANAL, but this has worked for me before with the credit bureaus, and I've never actually had to file the threatened suit. My best guess is that threatening litigation gets the case assigned to a legal team that is actually empowered to correct errors. It's a shame that that's how they've chosen to run their business, but then again, I'm not their customer, I'm their product.
- astura 9y ago
  HN is all like "speech should be free and unlimited and protected always... Unless someone's talking about me." That sort of hard stance seems extremely unworkable. If I sign up for Hulu they need my email and billing information at the least. So they are supposed to pay me now because I gave them that to get a service? So then ot evens out so my streaming is free now? Goodbye any useful paid service. Goodbye any free service. What you're really advocating here though is abolishing free society as we know it. You think I'm kidding? All court proceeding would have to be in secret and unrecorded as saying "so and so convicted of manslaughter" is now illegal. All public records abolished entirely, no accountability anymore. No journalists could publish a story about anyone ever. Harvey Weinstein sexually assaults hundreds of women? Can't tell anyone or publish that information, Harvey Weinstein owns it. Even telling someone else about your date last night would become illegal.
  - thatcat 9y ago
    I think gp ment commercial data, with the aim to prevent the resale rather than collection.
    - cinquemb 9y ago
      Though, it would seem like data in general is more commercializable now than it was a century ago. I certainly don't want to be the person to have to draw a line in the sand between "non commercial data" and "commercial data". Then again, maybe I want to sell access to brain scans of people using hardware I made to a 3rd Party in the future… :P
      - thatcat 9y ago
        Its not any harder than labeling things for tax purposes. If you sell it, it is commercial and should have restrictions on how it's held and transmitted. It's not unreasonable to require part of that process to involve payment to the data originator, as a royalty for the unique data they created. This would also allow those creating the data an easy way to see how it is ultimately used.
xorcist 9y ago
> It's like a hospital mixing up the labels on saline and hydrogen cyanide I don't even think that's a strong enough comparison. It's more like a hospital not bothering to label their bottles at all, and then go "oh, sorry about that" when the inevitable happens.
otakucode 9y ago
If you think that is bad, you should read about the Toyota "unintended acceleration" case from several years back. It's a preview of exactly what will occur when the first self-driving cars hit the road. Toyotas gross negligence (through following standard business practices still in place and still followed by every company you can think of) surrounding software development resulted in the deaths of multiple people. And the courts tossed up their hands and said "we can't convict them of criminal negligence because there are no standards when it comes to software that they broke." Hire the cheapest 'talent' you can find, refuse them training or the tools or environment or time needed to do a competent job, and give an MBA the reins to ignore their concerns and protests but push something out the door. It's a recipe for disastrously flawed systems and big piles of money for executives.
- Dru89 9y ago
  I thought the unintended acceleration issues had been largely disproven as user error. That is, many other brands of cars had been reported to have the same issues by drivers. And basically a driver was put into a stressful situation, thought they were hitting the brakes, but were actually hitting the gas. Then, panicking that they can't stop the car, hit the "brakes" harder, exacerbating the problem.
  - mediocrejoker 9y ago
    I don't think this is true. If you google for toyota and misra (a C coding standard for safety-critical systems) you can find many reports on an audit that was performed on their code and the _many thousands_ of violations that were found.
    - Dru89 9y ago
      There may be a bit of both at work here, because I remember seeing a lot of issues with hacking the Prius at Defcon[0], but I vaguely recall the SUA incidents being mostly related to as pedal misapplication. I know Wikipedia isn't exactly a great primary source here, but: > From 2002 to 2009 there were many defect petitions made to the NHTSA regarding unintended acceleration in Toyota and Lexus vehicles, but many of them were determined to be caused by pedal misapplication, and the NHTSA noted that there was no statistical significance showing that Toyota vehicles had more SUA incidents than other manufacturers. — https://en.wikipedia.org/wiki/Sudden_unintended_acceleration#Sudden_Acceleration_in_Toyota_Vehicles https://en.wikipedia.org/wiki/Sudden_unintended_acceleration... In any case, I believe companies can definitely be guilty of criminal negligence (and Toyota did a lot of bad things during their SUA crisis). But I think the use of SUA in the comment I originally responded to sort of misrepresents the situation and mostly spreads a lot of FUD around self-driving cars. [0]: https://www.engadget.com/2013/07/28/auto-hacked-ford-toyota-defcon-conference/ https://www.engadget.com/2013/07/28/auto-hacked-ford-toyota-...
utefan001 9y ago
Posting my long comment here because the Disqus bot and I don't get along for some reason. Troy, I think you have done a lot of good for infosec. Thank you. Here are my thoughts: You will be in a room full of lawyers. Examples that they understand are important. For example, (Full credit to @strandjs 2017 DerbyCon keynote) in the Crowdstrike v. NSS labs case, they sued to prevent "third parties to access or use the products" and prohibited "any competitive analysis on the product". Sorry to get into the weeds here, but the TL/DR is the following. - Delaware District court Judge Gregory Sleet's ruling supporting product performance assessments. - Government funding to support projects like ModSecurity that contribute to US economic security. - Whitelisting (that works) is the future. Today's security vendor marketing seems to have a free pass to lie. Thankfully, on 2017-02-13, Judge Gregory Sleet of the Delaware District court ruled against Crowdstrike writing "The consumer review fairness act of 2016 underscores the public's interest in performance assessments. The new law voids provisions of form contracts that restrict a party to that contract from conducting a performance assessment of or other similar analysis of..." "The court finds the public has a very real interest in the dissemination of information regarding products in the marketplace." It goes on to say if NSS's data is inaccurate, Crowdstrike could publicly rebut that data with evidence and the public would benefit from the exchange helping inform the public if they should trust future NSS reports. He concludes "the public interest weighs strongly in favor of denying Crowdstrike's motion." https://www.csoonline.com/a.. https://www.csoonline.com/a... Security is hard. I have been researching the Apache Struts2 exploits that Equifax was hit by. Assume another vulnerability like this exists right now. It could be Struts or some other web framework. Webshells used in the Struts hack are really hard to stop for many reasons. As far as I understand, if ModSecurity's open source web application firewall was installed and properly configured (not a simple task), the CRS (core rule set) would have prevented the Apache Struts2 exploit from working. Open source projects that make major contributions to protect United States national and economic security should receive more support and funding. As a recognition for the contribution of all open source, Richard Stallman and Linus Torvalds should be recommended to receive the Presidential Medal of Freedom. ModSecurity works by looking for known malicious patterns and blocks them. I hope one day we can get web application firewalls to work well using a whitelist setup. Instead of trusting everything and blocking things that look bad, on highly sensitive systems like Equifax, I hope to see a way to trust nothing and allow traffic that is known good. For example.. import re def findWords(string1): return re.findall(r"\b[^\d\W]+\b",string1) f = open("apache2-access.log", "r") data = f.read() data = data.upper() answer = findWords(data) for a in answer: print(a) Now use bash to sort and get count.. $ python3 words.py | sort | uniq -c | sort -n The next step is to create a modSecurity rule that uses the same regex "\b[^\d\W]+\b" to only allow REQUESTS that contain words that are on an approved list using the @pmf parameter file as in this following example. Note I just started looking into this, so I will leave the rest as an exercise for the reader :) SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmf windows-powershell-commands.dat See github owasp-modsecurity-crs/rules/REQUEST-932-Application-ATTACK-RCE

RachelF 9y ago

My opinion is that information about you should belong to you. Other entities should not be allowed to keep or trade information about individuals without paying them directly. That way people will realise that their personal info is worth something.

mjevans 9y ago
The problem is this is effectively a reputation score; only you have very limited rights to see it* (once a year, per agency; and only if you ask... Oh and BTW, I pulled /all/ of mine just before it came out that the breach happened; :( ) Also a problem; they use simple knowledge of a single magic number as authentication ('identification'). The three current companies in the US could have gotten together and worked around the lack of a national ID and created a private SIN cryptographic... but that would cut in to their profits. Though I hear other countries that have done this also have issues with 'business individuals' being contacted and scam attempts rampantly abusing their data...
will_hughes 9y ago
> Other entities should not be allowed to keep or trade information about individuals without paying them directly. To be the devils advocate for a moment, what about the other side of that? Should businesses not be able to keep and share records saying "This person owes us money but refuses to pay"?
- razakel 9y ago
  >Should businesses not be able to keep and share records saying "This person owes us money but refuses to pay"? No, because you would have practically no recourse if you were wrongly on such a list, and might not be able to prove you even were on it or that it exists. It's called "blacklisting". You have a common name and share a birthday with a felon? Say goodbye to your chances of getting a credit card!
  - Spooky23 9y ago
    The biggest issue there is for screening for guns and some employment screening. If you’re name is John Smith, good luck!
  - astura 9y ago
    That's not how credit reporting laws work the United States. It's true that they could/should be stronger/tightened/held to a higher standard, but there is a process to dispute your credit file. Creditors are legally required to give you certain information when they deny you for credit.
    - CaptSpify 9y ago
      That is not how the credit reporting laws work, but it's how the system works. That process is extremely flawed and unreliable. Have you ever tried disputing your credit? good fucking luck. I've been arguing with Equifax for over a year because they "have it on record" that I lived somewhere that I've never lived. I have no legal recourse unless I want to spend thousands of dollars on lawyer fees.
      - bdhess 9y ago
        You shouldn't need a lawyer to pursue them. Assuming you're within the time periods prescribed in the FCRA, you can file your own complaint in your local small claims court. Before that, I'd send them a letter clearly marked "Notice of Intent to Sue" (on the letter and envelope) stating what information is incorrect, and that you plan to file a suit in [insert name of small claims court] on [insert reasonable date] seeking $1,000 in damages for each violation per 15 USC 1681(n), unless the disputed information is removed before that date. And enclose any supporting documentation, and history of previous fruitless correspondence. IANAL, but this has worked for me before with the credit bureaus, and I've never actually had to file the threatened suit. My best guess is that threatening litigation gets the case assigned to a legal team that is actually empowered to correct errors. It's a shame that that's how they've chosen to run their business, but then again, I'm not their customer, I'm their product.
astura 9y ago
HN is all like "speech should be free and unlimited and protected always... Unless someone's talking about me." That sort of hard stance seems extremely unworkable. If I sign up for Hulu they need my email and billing information at the least. So they are supposed to pay me now because I gave them that to get a service? So then ot evens out so my streaming is free now? Goodbye any useful paid service. Goodbye any free service. What you're really advocating here though is abolishing free society as we know it. You think I'm kidding? All court proceeding would have to be in secret and unrecorded as saying "so and so convicted of manslaughter" is now illegal. All public records abolished entirely, no accountability anymore. No journalists could publish a story about anyone ever. Harvey Weinstein sexually assaults hundreds of women? Can't tell anyone or publish that information, Harvey Weinstein owns it. Even telling someone else about your date last night would become illegal.
- thatcat 9y ago
  I think gp ment commercial data, with the aim to prevent the resale rather than collection.
  - cinquemb 9y ago
    Though, it would seem like data in general is more commercializable now than it was a century ago. I certainly don't want to be the person to have to draw a line in the sand between "non commercial data" and "commercial data". Then again, maybe I want to sell access to brain scans of people using hardware I made to a 3rd Party in the future… :P
    - thatcat 9y ago
      Its not any harder than labeling things for tax purposes. If you sell it, it is commercial and should have restrictions on how it's held and transmitted. It's not unreasonable to require part of that process to involve payment to the data originator, as a royalty for the unique data they created. This would also allow those creating the data an easy way to see how it is ultimately used.

xorcist 9y ago

> It's like a hospital mixing up the labels on saline and hydrogen cyanide I don't even think that's a strong enough comparison. It's more like a hospital not bothering to label their bottles at all, and then go "oh, sorry about that" when the inevitable happens.

otakucode 9y ago

If you think that is bad, you should read about the Toyota "unintended acceleration" case from several years back. It's a preview of exactly what will occur when the first self-driving cars hit the road. Toyotas gross negligence (through following standard business practices still in place and still followed by every company you can think of) surrounding software development resulted in the deaths of multiple people. And the courts tossed up their hands and said "we can't convict them of criminal negligence because there are no standards when it comes to software that they broke." Hire the cheapest 'talent' you can find, refuse them training or the tools or environment or time needed to do a competent job, and give an MBA the reins to ignore their concerns and protests but push something out the door. It's a recipe for disastrously flawed systems and big piles of money for executives.

Dru89 9y ago
I thought the unintended acceleration issues had been largely disproven as user error. That is, many other brands of cars had been reported to have the same issues by drivers. And basically a driver was put into a stressful situation, thought they were hitting the brakes, but were actually hitting the gas. Then, panicking that they can't stop the car, hit the "brakes" harder, exacerbating the problem.
- mediocrejoker 9y ago
  I don't think this is true. If you google for toyota and misra (a C coding standard for safety-critical systems) you can find many reports on an audit that was performed on their code and the _many thousands_ of violations that were found.
  - Dru89 9y ago
    There may be a bit of both at work here, because I remember seeing a lot of issues with hacking the Prius at Defcon[0], but I vaguely recall the SUA incidents being mostly related to as pedal misapplication. I know Wikipedia isn't exactly a great primary source here, but: > From 2002 to 2009 there were many defect petitions made to the NHTSA regarding unintended acceleration in Toyota and Lexus vehicles, but many of them were determined to be caused by pedal misapplication, and the NHTSA noted that there was no statistical significance showing that Toyota vehicles had more SUA incidents than other manufacturers. — https://en.wikipedia.org/wiki/Sudden_unintended_acceleration#Sudden_Acceleration_in_Toyota_Vehicles https://en.wikipedia.org/wiki/Sudden_unintended_acceleration... In any case, I believe companies can definitely be guilty of criminal negligence (and Toyota did a lot of bad things during their SUA crisis). But I think the use of SUA in the comment I originally responded to sort of misrepresents the situation and mostly spreads a lot of FUD around self-driving cars. [0]: https://www.engadget.com/2013/07/28/auto-hacked-ford-toyota-defcon-conference/ https://www.engadget.com/2013/07/28/auto-hacked-ford-toyota-...

utefan001 9y ago

Posting my long comment here because the Disqus bot and I don't get along for some reason. Troy, I think you have done a lot of good for infosec. Thank you. Here are my thoughts: You will be in a room full of lawyers. Examples that they understand are important. For example, (Full credit to @strandjs 2017 DerbyCon keynote) in the Crowdstrike v. NSS labs case, they sued to prevent "third parties to access or use the products" and prohibited "any competitive analysis on the product". Sorry to get into the weeds here, but the TL/DR is the following. - Delaware District court Judge Gregory Sleet's ruling supporting product performance assessments. - Government funding to support projects like ModSecurity that contribute to US economic security. - Whitelisting (that works) is the future. Today's security vendor marketing seems to have a free pass to lie. Thankfully, on 2017-02-13, Judge Gregory Sleet of the Delaware District court ruled against Crowdstrike writing "The consumer review fairness act of 2016 underscores the public's interest in performance assessments. The new law voids provisions of form contracts that restrict a party to that contract from conducting a performance assessment of or other similar analysis of..." "The court finds the public has a very real interest in the dissemination of information regarding products in the marketplace." It goes on to say if NSS's data is inaccurate, Crowdstrike could publicly rebut that data with evidence and the public would benefit from the exchange helping inform the public if they should trust future NSS reports. He concludes "the public interest weighs strongly in favor of denying Crowdstrike's motion." https://www.csoonline.com/a.. https://www.csoonline.com/a... Security is hard. I have been researching the Apache Struts2 exploits that Equifax was hit by. Assume another vulnerability like this exists right now. It could be Struts or some other web framework. Webshells used in the Struts hack are really hard to stop for many reasons. As far as I understand, if ModSecurity's open source web application firewall was installed and properly configured (not a simple task), the CRS (core rule set) would have prevented the Apache Struts2 exploit from working. Open source projects that make major contributions to protect United States national and economic security should receive more support and funding. As a recognition for the contribution of all open source, Richard Stallman and Linus Torvalds should be recommended to receive the Presidential Medal of Freedom. ModSecurity works by looking for known malicious patterns and blocks them. I hope one day we can get web application firewalls to work well using a whitelist setup. Instead of trusting everything and blocking things that look bad, on highly sensitive systems like Equifax, I hope to see a way to trust nothing and allow traffic that is known good. For example.. import re def findWords(string1): return re.findall(r"\b[^\d\W]+\b",string1) f = open("apache2-access.log", "r") data = f.read() data = data.upper() answer = findWords(data) for a in answer: print(a) Now use bash to sort and get count.. $ python3 words.py | sort | uniq -c | sort -n The next step is to create a modSecurity rule that uses the same regex "\b[^\d\W]+\b" to only allow REQUESTS that contain words that are on an approved list using the @pmf parameter file as in this following example. Note I just started looking into this, so I will leave the rest as an exercise for the reader :) SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmf windows-powershell-commands.dat See github owasp-modsecurity-crs/rules/REQUEST-932-Application-ATTACK-RCE