3 ms·

> I'm hesitant to take their word at face value Can you document a lie they've told? > as they've tried to mitigate the entire situation via PR already Of co

> I'm hesitant to take their word at face value Can you document a lie they've told? > as they've tried to mitigate the entire situation via PR already Of course, any company would do the same. But did they lie? > claim many users [who were affected] were not affected. Can you back up this claim? They claim 147 million potentially affected...and you think that was under representing it? > I also wanted to add that the software in question that was compromised was a free and open source solution[0], not some top-dollar security program. The code in question is heavily used in the industry, from the highly respected Apache Foundation. I.E. it wasn't some college project they found on github. Many other companies were affected by this vulnerability...they just either did a better job of patching it or weren't sufficiently interesting targets to make it worth going after. Or didn't report it... As far as the sophistication, you should read this: https://www.bloomberg.com/news/features/2017-09-29/the-equifax-hack-has-all-the-hallmarks-of-state-sponsored-pros https://www.bloomberg.com/news/features/2017-09-29/the-equif... Assuming you trust Bloomberg, they report that there was an initial intrusion that didn't get anywhere, but appeared to get handed off to a much more sophisticated team that did the real breach. Re: Frank Abagnale...he's exactly right on one point. The breach was tracked back to an employee who failed to follow the procedures and left a system vulnerable. In my view, the real problem is that their procedures were brittle enough that one person failing to do their part was enough to leave them vulnerable. Not enough redundancy. Even that isn't enough for perfect security, but having multiple people required to certify something like this would greatly reduce the odds of a breach. However, his claim of negligence is complete bunk and supposition on his part. Equifax followed their procedures...they received the vulnerability report, processed it, applied patches, and ran scans to verify. However, one employee failed to do as required, and the scans were faulty and they didn't know. How is that negligence? It's a broken process, for sure, and they didn't have the ability to detect that it had failed. But negligence would be if they knew about the vulnerability and ignored it, and it's simply not true.

52-6F-62 9y ago
I didn't claim they lied. As far as the sophistication, it was the critical lapse in maintaining the front-line defenses that is at the root of the problem. Without entering through the front door, any attacker would have had a monumentally more difficult time installing any kind of back door access, let alone a series of shells as redundancies. Keeping the logs clean probably kept them nearly invisible for all that time to be able to pass off or sell off the access to a more capable group. Negligence in their case is evidenced in the larger picture. One isolated incident can be just a dramatically terrible mistake. When there are obvious and foolish mistakes being made when the stakes are millions of peoples' personal and irreplaceable identification, then I think negligence is a fair term. Re: not telling users they were affected https://www.marketwatch.com/story/after-huge-data-breach-equifax-not-telling-all-customers-if-they-are-affected-2017-09-07 https://www.marketwatch.com/story/after-huge-data-breach-equ... Re: continued negligence in the response https://www.wired.com/story/equifax-breach-response/ https://www.wired.com/story/equifax-breach-response/ Re: signalling of Equifax's possible intentions through the fallout https://techcrunch.com/2017/09/08/psa-no-matter-what-you-write-equifax-may-tell-you-youve-been-impacted-by-the-hack/ https://techcrunch.com/2017/09/08/psa-no-matter-what-you-wri...
- g051051 9y ago
  > I didn't claim they lied. Then why did you say you were "hesitant to take their word at face value"? > Without entering through the front door, any attacker would have had a monumentally more difficult time installing any kind of back door access. Again, read the Bloomberg article for more details...your version doesn't match the facts as reported. > When there are obvious and foolish mistakes being made when the stakes are millions of peoples' personal and irreplaceable identification, then I think negligence is a fair term. What "obvious and foolish mistakes"? A single failure to patch a single vulnerability? Equifax receives a vulnerability report. They do their process to apply the fix. They get the messages back from the project teams that it's done. They run the scan to verify, and it comes back green. Where's the negligence? I know the process didn't work, but that's a hindsight thing...how can you tell something like that is broken unless it breaks? > Re: not telling users they were affected Per the article, they weren't "not telling people" as in, withholding information. The messaging was poor, but they weren't intentionally misleading anyone. > Re: continued negligence in the response Incompetent, maybe. But that article doesn't reference any negligent behavior. > Re: signalling of Equifax's possible intentions through the fallout And idiot opinion piece with no basis in fact. It's clear that none of the B.S. predicted there has come true in the 4 months since it was written.

52-6F-62 9y ago

I didn't claim they lied. As far as the sophistication, it was the critical lapse in maintaining the front-line defenses that is at the root of the problem. Without entering through the front door, any attacker would have had a monumentally more difficult time installing any kind of back door access, let alone a series of shells as redundancies. Keeping the logs clean probably kept them nearly invisible for all that time to be able to pass off or sell off the access to a more capable group. Negligence in their case is evidenced in the larger picture. One isolated incident can be just a dramatically terrible mistake. When there are obvious and foolish mistakes being made when the stakes are millions of peoples' personal and irreplaceable identification, then I think negligence is a fair term. Re: not telling users they were affected https://www.marketwatch.com/story/after-huge-data-breach-equifax-not-telling-all-customers-if-they-are-affected-2017-09-07 https://www.marketwatch.com/story/after-huge-data-breach-equ... Re: continued negligence in the response https://www.wired.com/story/equifax-breach-response/ https://www.wired.com/story/equifax-breach-response/ Re: signalling of Equifax's possible intentions through the fallout https://techcrunch.com/2017/09/08/psa-no-matter-what-you-write-equifax-may-tell-you-youve-been-impacted-by-the-hack/ https://techcrunch.com/2017/09/08/psa-no-matter-what-you-wri...

g051051 9y ago
> I didn't claim they lied. Then why did you say you were "hesitant to take their word at face value"? > Without entering through the front door, any attacker would have had a monumentally more difficult time installing any kind of back door access. Again, read the Bloomberg article for more details...your version doesn't match the facts as reported. > When there are obvious and foolish mistakes being made when the stakes are millions of peoples' personal and irreplaceable identification, then I think negligence is a fair term. What "obvious and foolish mistakes"? A single failure to patch a single vulnerability? Equifax receives a vulnerability report. They do their process to apply the fix. They get the messages back from the project teams that it's done. They run the scan to verify, and it comes back green. Where's the negligence? I know the process didn't work, but that's a hindsight thing...how can you tell something like that is broken unless it breaks? > Re: not telling users they were affected Per the article, they weren't "not telling people" as in, withholding information. The messaging was poor, but they weren't intentionally misleading anyone. > Re: continued negligence in the response Incompetent, maybe. But that article doesn't reference any negligent behavior. > Re: signalling of Equifax's possible intentions through the fallout And idiot opinion piece with no basis in fact. It's clear that none of the B.S. predicted there has come true in the 4 months since it was written.