2 ms·

I didn't claim they lied. As far as the sophistication, it was the critical lapse in maintaining the front-line defenses that is at the root of the problem. Wit

I didn't claim they lied. As far as the sophistication, it was the critical lapse in maintaining the front-line defenses that is at the root of the problem. Without entering through the front door, any attacker would have had a monumentally more difficult time installing any kind of back door access, let alone a series of shells as redundancies. Keeping the logs clean probably kept them nearly invisible for all that time to be able to pass off or sell off the access to a more capable group. Negligence in their case is evidenced in the larger picture. One isolated incident can be just a dramatically terrible mistake. When there are obvious and foolish mistakes being made when the stakes are millions of peoples' personal and irreplaceable identification, then I think negligence is a fair term. Re: not telling users they were affected https://www.marketwatch.com/story/after-huge-data-breach-equifax-not-telling-all-customers-if-they-are-affected-2017-09-07 https://www.marketwatch.com/story/after-huge-data-breach-equ... Re: continued negligence in the response https://www.wired.com/story/equifax-breach-response/ https://www.wired.com/story/equifax-breach-response/ Re: signalling of Equifax's possible intentions through the fallout https://techcrunch.com/2017/09/08/psa-no-matter-what-you-write-equifax-may-tell-you-youve-been-impacted-by-the-hack/ https://techcrunch.com/2017/09/08/psa-no-matter-what-you-wri...

g051051 9y ago
> I didn't claim they lied. Then why did you say you were "hesitant to take their word at face value"? > Without entering through the front door, any attacker would have had a monumentally more difficult time installing any kind of back door access. Again, read the Bloomberg article for more details...your version doesn't match the facts as reported. > When there are obvious and foolish mistakes being made when the stakes are millions of peoples' personal and irreplaceable identification, then I think negligence is a fair term. What "obvious and foolish mistakes"? A single failure to patch a single vulnerability? Equifax receives a vulnerability report. They do their process to apply the fix. They get the messages back from the project teams that it's done. They run the scan to verify, and it comes back green. Where's the negligence? I know the process didn't work, but that's a hindsight thing...how can you tell something like that is broken unless it breaks? > Re: not telling users they were affected Per the article, they weren't "not telling people" as in, withholding information. The messaging was poor, but they weren't intentionally misleading anyone. > Re: continued negligence in the response Incompetent, maybe. But that article doesn't reference any negligent behavior. > Re: signalling of Equifax's possible intentions through the fallout And idiot opinion piece with no basis in fact. It's clear that none of the B.S. predicted there has come true in the 4 months since it was written.

g051051 9y ago

> I didn't claim they lied. Then why did you say you were "hesitant to take their word at face value"? > Without entering through the front door, any attacker would have had a monumentally more difficult time installing any kind of back door access. Again, read the Bloomberg article for more details...your version doesn't match the facts as reported. > When there are obvious and foolish mistakes being made when the stakes are millions of peoples' personal and irreplaceable identification, then I think negligence is a fair term. What "obvious and foolish mistakes"? A single failure to patch a single vulnerability? Equifax receives a vulnerability report. They do their process to apply the fix. They get the messages back from the project teams that it's done. They run the scan to verify, and it comes back green. Where's the negligence? I know the process didn't work, but that's a hindsight thing...how can you tell something like that is broken unless it breaks? > Re: not telling users they were affected Per the article, they weren't "not telling people" as in, withholding information. The messaging was poor, but they weren't intentionally misleading anyone. > Re: continued negligence in the response Incompetent, maybe. But that article doesn't reference any negligent behavior. > Re: signalling of Equifax's possible intentions through the fallout And idiot opinion piece with no basis in fact. It's clear that none of the B.S. predicted there has come true in the 4 months since it was written.