17 ms·

Equifax IT staff had to rerun hackers' queries to work out what was nicked

247 points by wglb 8y ago

hetspookjee 8y ago
Meanwhile Equifax stock is at ~130 compared to ~145 it had before the news broke of the back. With their lowest dip at ~90 and a long time dragging along at ~110. ¯\_(ツ)_/¯ I'm seriously considering that on the next massive data breach of a public traded company I'm gonna buy some stock in the onset. Even though it feels like betting against my own principles it just seems like a too good of an opportunity to miss out on...
- crunchlibrarian 8y ago
  Several Wells Fargo executives came right out and openly confessed to fraud and theft of consumers' money, and none of them are in jail and the company has not been adversely affected in the slightest. They paid some fines equivalent to what they make in profit every 13 hours. That's it. Nothing else. If you're running a large profitable company why should you care about security at all? Why should you care about the rule of law at all? There is no accountability, there is no culpability, nobody will ever get in trouble.
  - derekp7 8y ago
    The Wells Fargo thing I really don't understand -- even without government action, I can't believe that they still have customers. How does that happen? I know that when a car dealer does the financing, you may not know who the lender is until you get your first bill, but even so I can't see anyone willingly going with them for any accounts (savings/checking, loans, etc).
    - Cyph0n 8y ago
      I've been a customer since before the fiasco and haven't changed because they have a ton of branches in the area and they have been great at quickly solving any issues I run into. I've started using Chase and Cap One online but they have zero branches in my entire city...
      - Consultant32452 8y ago
        I can't recommend e-banking enough. I use Fidelity, but Schwab is also similarly good. Totally free checking, no minimum balances, easy access to high rate CDs, bill pay, and you can use any ATM in the country, they pay all your fees. I keep a few hundred dollars in a savings account locally because I'm paranoid I might want to see a human being, but I've literally never had to use it.
        Cyph0n 8y ago
        The biggest problem with online-only banking is that there is really no way to get a large sum of money out immediately. The only way to withdraw a large sum is to transfer it to another bank account (1-2 days) and then go to that bank's branch. Of course, you can use checks, but sometimes you need hard cash (e.g., buying a used car).
        mmt 8y ago
        > Of course, you can use checks, but sometimes you need hard cash (e.g., buying a used car). I use "cashier's checks" [1] to buy used cars, since that still offers more security and convenience (of not handling physically bulky bundles of currency). A trick I learned from reading sites about how to buy at real estate auctions (where the final price can't be known up front) is to use multiple checks made out to oneself, in varying amounts. The ones needed for payment can be endorsed over to the seller, and the remainder can be re-deposited. My credit union will send me an effecitvely unlimited number of these through the mail, if they're requested through the automated system and each for a at least some (reasonable) minimum amount. Still, your point holds. If you need it in a hurry, a physical branch is required. [1] check drawn on the financial institution, not my personal account
        Consultant32452 8y ago
        I've bought a couple of used cars in private sales. Give them a couple hundred dollars deposit, get a receipt, then make arrangements to do the full payment during business hours when you can meet at the seller's bank and do a bank wire, cashier's check, etc. It would be pretty rare that you can't get this worked out. And worst case scenario, you keep that local bank account open and do an EFT to it when you start shopping.
    - poulsbohemian 8y ago
      Often the effort or cost to get out of a home mortgage or car loan makes you stuck by inertia.
    - dzdt 8y ago
      Wells Fargo wasn't really defrauding their customers, at least not at significant scale. Wells Fargo reps were defrauding their internal evaluation targets. The customer damages were incidental and generally small.
    - tristor 8y ago
      I'm a Well's Fargo "customer" (more like a hostage) because they bought my mortgage from the local lender I originally went through. I have no legal way to stop being a Well's Fargo "customer" that does not result in direct and long-term financial penalties. Considering that they hold one of the largest mortgage portfolios in the US, I'd guess that many other "customers" of Well's Fargo are in the same boat. I hate both Bank of America and Well's Fargo with a passion and the outcome of 2008 didn't dissuade my disgust at them. Unfortunately both hold loans from me that I did not initially originate with them.
- deleted 8y ago
  [deleted]
- Sileni 8y ago
  I'd be a bit worried that was like playing Russian Roulette. At some point, the companies have to actually correct right? I imagine the reason they were able to take the hit was the number of people waiting to buy low already. That number of people has to be consumed to a certain extent each time a cycle happens. I mean, if there's fundamental problems, it eventually has to reflect in the stock price... right? Please?
  - NeedMoreTea 8y ago
    Sometimes, maybe. Perhaps at insolvency. Worldcom looked pretty healthy in 2002, then they were chapter 11.
    - g051051 8y ago
      Just like the previous mention of Enron, Worldcom engaged in systematic large-scale accounting fraud. Very different from the Equifax breach situation.
  - chrischen 8y ago
    The thing about roulette is that you can bet most numbers except a couple, and do pretty well in the short term, albeit with small winnings. But the odds are still against you long term.
  - michaelbuckbee 8y ago
    Well, that's the thing, they don't _have_ to correct. Look at Enron. They were huge and I can clearly remember people buying in post revelations saying: "oh it's going to come back".
  - wongarsu 8y ago
    >I mean, if there's fundamental problems, it eventually has to reflect in the stock price... right? From a business perspective, poor IT security doesn't have to be a fundamental problem. Occasionally beating up your customers may be fine, and being voted as worst company in America isn't nessesarily that bad either. Are there fines high enough to impact business? Are you on the receiving end of new legislation because of the event? Is the market both capable and willing to punish you? Depressingly often the answer to all of those is "no".
- gruez 8y ago
  >it just seems like a too good of an opportunity to miss out on... unless everyone's doing the same thing and it's already priced in the moment the news goes public.
- mtgx 8y ago
  It's because the U.S. government is so corrupt right now that none of the existing large organizations/corporations will ever be punished the same way Enron was, unless the political landscape and system changes significantly. That's why, regardless of how large a company scandal is, you can make a pretty good bet on the company surviving and recovering easily from the scandal, because the government will protect it/issue a tiny fine to save some face. In this case, Congress literally passed a law to save Equifax from private lawsuits. Absolute insanity. If this isn't a sign of a corrupt government, I don't know what is. It's a very sad state of affairs that will likely get much worse before it starts getting better.
  - g051051 8y ago
    The difference was that in Enron's case it was clear criminal intent to defraud, as opposed to security failures. As far as "Congress literally passed a law to save Equifax from private lawsuits", what they did was part of the larger sweep of allowing companies to force arbitration on consumers. It was unrelated to the breach.
    - munk-a 8y ago
      The allowance of private arbitration is a pretty clear example of corruption though, class action lawsuits exist for the purpose of punishing companies more than delivering assets to the suffering parties and that route has been taking away in a lot of circumstances.
      - g051051 8y ago
        Can't argue there. The rise of arbitration clauses has done a huge amount of damage to consumer rights.
- s_dev 8y ago
  I'm still at a loss as to how Ashely Madison is still going after their data breach. Everyone user on that site (99% male) was exposed as a complete chump -- it's still a functioning business ...
  - dickinson99 8y ago
    Where does this 99% figure come from? And how did they get exposed? Did someone contact everyone's friends and family that got leaked?
    - s_dev 8y ago
      >Where does this 99% figure come from? The data is public now -- AM were blackmailed and didn't pay -- I guess you can take a sample of the email addresses and compare with public profiles that match the emails. There were virtually no women -- in fact they were so paranoid the men would realize there weren't any women to have extra marital affairs with they had -- bots -- that flirted now and again just to keep the men paying. Plenty of reporting was done on it after the breach. I recall saying to people that this would be a good example of a breach that would destroy a company by exposing that it's value proposition was nothing. I guess I was very wrong.
      - cbhl 8y ago
        What if there is a value proposition in paying to have a bot flirt with you now and again? I'm reminded of the entire "robot boyfriend/girlfriend" genre of TV/Movies/Comics from Japan/Korea, plus the "dating simulator" genre of video games. These are more fantasy-fulfillment, though. I honestly think it would be a net good for society to have simulators/bots that teach people how to have real, healthy relationships with other humans. (There are anecdoates about kids with autism who became more verbal once they started talking to Siri or the Google Assistant, for example.) But I feel like working on or using such tools would probably be as stigmatized as sex toys in the near/medium term.
        village-idiot 8y ago
- RegBarclay 8y ago
  I saw a screen full of company logos on the news during the oil well blowout in the Gulf of Mexico and checked into their stock prices. I did OK on Halliburton. Did OK with Merck after the Vioxx news too. Buying on bad news is a pretty safe bet when the news is limited to a small part of a very large, diversified business.
- 3pt14159 8y ago
  I've come to the conclusion that whatever is computerized is going to be leaked. Health records? Might as well open source them for all I care. Red team is tenacious and the steps you have to take to actually keep everything secure make you seem unreasonable. I've moved on. It's more important to focus on election security and physical security at this point. Infosec is dead. Five years ago Bruce Schneier wrote a book called "Carry On" now he has one called "Click Here to Kill Everybody". Just five years. We're in a technological growth feedback function and we're unable to predict it.
  - ergothus 8y ago
    Author David Brin has (relatively) long advocated that we have two options: shoot for privacy resulting in those with power able to access the "private" info, or have it open where everyone can access. He then argues for the latter because it minimizes rather than maximizes abuse. (I'm paraphrasing and summarizing, possibly poorly) I struggle with being _comfortable_ with that idea, but I don't have a problem believing the technical accuracy of it.
    - xevb3k 8y ago
      Interestingly (because the parent is about Schneier). IIRC Schneier argues against this. The argument is that even if everybody has access to all information, only a small group is able to exploit that access effectively. So, you still end up with a small group abusing their access to the information. You should therefore aim for privacy of sensitive information.
      - cortesoft 8y ago
        Yeah, I think a good example of this is thinking about something like license plate scanning. Technically, this is not taking advantage of any public information. It is just capturing images of things happening in public. Anyone could set up a camera and capture license plates as they drive through an intersection. So is it totally fine for a police force to scan license plates at every intersection? The question is complicated, because the effect on people changes when you do something that is not worrisome on a small scale in an automated way at a large scale. When you add in that the people doing it have a large amount of power over people and it changes it even more.
- chair6 8y ago
  Just make sure you time it right. The problem with EFX was they announced on September 7, dipped, then announced additional badness on September 13, so double-dipped (https://s.yimg.com/uc/fin/chart/18/08/39d3a24.png https://s.yimg.com/uc/fin/chart/18/08/39d3a24.png) and you were out ~30% immediately.
- jack6e 8y ago
  This is an old investing strategy summarized by Rothschild in the anecdote, "The time to buy is when there's blood in the streets." I think that maxim captures the crass greed of the strategy.
  - antidesitter 8y ago
    Why is this strategy “crass greed”?
    - ISL 8y ago
      Indeed, it puts a floor on prices in freefall. If someone needs to sell, and nobody is willing to buy, the price goes to zero.
    - tedunangst 8y ago
      You're supposed to say "Be fearful when others are greedy and greedy when others are fearful" and then you sound kind and wise like Warren Buffet.
- mikestew 8y ago
  I'm seriously considering that on the next massive data breach of a public traded company I'm gonna buy some stock in the onset Buy call options, that way if it doesn't go your way you're not out as much (in theory, anyway). Worked for me with Equifax and United Airlines, as two examples. Didn't work so well buying puts on Kodak when they announced crypto-whatever; market stayed irrational longer than the life of my contract. Keeping in mind that the next Equifax might be the one that finally gets put against the wall.
  - paul_milovanov 8y ago
    That emphatically didn't work out for me with Valiant. Remember, options have expiries. And also it only makes sense if market implied volatility of your options contract is way below the upside move you expect. I.e buying calls at 50% IV when you only expect a 30% move before expiry is... suboptimal. In other words, there's no substitute for truly knowing what you're doing when trading options. (Learned this the hard way, AMA)
    - paul_milovanov 8y ago
      It did work out for me with GEO (doubled my position on the sharp drop) but I bought stock because I had no idea when it might rebound. Options are far less forgiving if you're wrong on timing.
- reaperducer 8y ago
  Perhaps this fits into the cliche about there being "no such thing as bad publicity."
- matchagaucho 8y ago
  Too big to fail. Substantially all loans are backed by credit scores from the big 3.
- liftbigweights 8y ago
  We are in one of the greatest bull markets in history. There are dollars, euros, yens, yuans, pounds, etc overflowing everywhere thanks to lax monetary policy all over the world. Considering equifax is one of 3 monopolistic credit reporting agencies, you can be sure they won't go out of business. So you buy the dips. Same thing with tesla. Same thing any established legit stock of a legit company. In a major bull market you buy the dips as long as the music is playing. But once the music stops, you don't want to be dancing. Same thing with major bear markets. Short the bumps.
- freeone3000 8y ago
  Always bet against your priciples. If you win, you get a better society! If you lose, at least you're richer.
- drewmol 8y ago
  After looking at stock drop and recoveries of other companies involved in major PII breaches in the last 10 years, I came on here recommending people look into options, as an opportunity to profit off the reactionary price tumble fallout from that breach. IIRC EFX, with a market cap of ~$16B, went from ~$140 to ~$90 over a few days. As a primarily B2B data broker that sells information without concern for the data subject's wishes, in an establishe and disruption resistant market with only 2 other competitors and decades of purchasing friendly regulations, a ~36% drop seemed unlikely to persist for very long. It's just betting against a large majority sharing, and sacrafising $, in order to adhere to those principles.
- anonytrary 8y ago
  Speaking of investments against principles -- you might want to check out Facebook stock as of 9/20/18, it's trading at something like 20% under, if you think it will rebound. (I'm not a FB shill, just read my post history).
chris_mc 8y ago
So, someone forgot to input this certificate into their Outlook Calendar, Slack /remind, or whatever, and as a result 150mm people are at risk for identity theft. Awesome. I'm so glad I have no option to prevent my data going to this super-competent company and there's no oversight by anyone external.
c0nsumer 8y ago
Isn't the claim made in the article as sensational -- that the investigators replayed what the attackers did -- just kinda good practice? It'd just make sense to me that, during an investigation, one would replay what the attackers did to get a good understanding of the results. This just seems like responsible investigation. (The flipside would instead be claiming that X was compromised, and not being able to honestly answer questions as to whether one retraced the attacker's steps to provide assurance.)
- toomuchtodo 8y ago
  You would expect a serious firm to have auditing and logging that would provide the necessary forensics without having to rerun an exploit.
  - uhhhhhhh 8y ago
    They were able to identify and re-run the attack, so auditing and logging are likely present enough to capture what they attackers did, which in most breaches needs to be analyzed to see what they were able to accomplish. This doesn't shout amateur hour to me directly, it seems more kicking a dead horse while its down, but that doesn't mean it isn't amateur hour or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I'm not trying to defend them, just stating this sounds somewhat misleading and sensationalized.
    - toomuchtodo 8y ago
      > or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I haven't seen any proof that Equifax operates in any other way. I am not attempting to be rude, only stating fact.
      - g051051 8y ago
        Unless you work for them, you haven't seen any proof of anything, outside of the tiny amount of information revealed since the breach.
SonnyWortzik 8y ago
While your data is being stolen and sold in the dark web, Equifax is happy to sell you Identity protection for your business: https://www.equifax.com/business/credit-monitoring-and-identity-protection/ https://www.equifax.com/business/credit-monitoring-and-ident...
- albertgoeswoof 8y ago
  An extract from an email I recieved from BA after their latest breach: We deeply apologise for any worry and inconvenience this criminal activity has caused. For your reassurance, we’re offering you 12 months of free credit and identity monitoring services, provided by Experian, one of the UK’s leading Credit Reference agencies. Your free ProtectMyID membership...
  - LinuxBender 8y ago
    If you accepted the free membership, you waived your rights to sue them. It was in the agreement.
    - sp332 8y ago
      They tried it, but after backlash they backed off. https://www.forbes.com/sites/dianahembree/2017/09/09/consumer-anger-over-equifaxs-ripoff-clause-in-offer-to-security-hack-victims-spurs-policy-change/ https://www.forbes.com/sites/dianahembree/2017/09/09/consume...
  - mjevans 8y ago
    I always figured that the smarter scammers would just wait 15 months and THEN use the data, or even sell it to (many) others that would.
    - noja 8y ago
      15 months is enough time to change your mother's maiden name and the name of your first pet.
iamleppert 8y ago
Imagine all the companies who Equifax is probably contracted that need bulk query access to their data. It’s easy for the crowd here to poo poo this kind of behavior, and it is bad, and they should be punished for their incompetence. They should not be in business any longer, it’s not like there aren’t other companies operating in this space to fill the void. That said, how do you seriously prevent such a thing from eventually happening? In this case it was their systems that were compromised but it could have easily been a downstream user or similar that had enough direct access. I’m curious to know what, if any technical solutions could be possible? I’d never take a tech job protecting such a thing. The only way I could think would be to have some very trusted people manually reviewing all access to the primary data store, and even that probably wouldn’t be enough. Miss one unauthorized query and you’re toast. The entire system of social security numbers is flawed by design from a security perspective and there in lies the problem.
danschumann 8y ago
Nicked.. British English is fun.. is there a compendium of phrases like this?
- forgotmypw 8y ago
  https://en.wikipedia.org/wiki/British_slang https://en.wikipedia.org/wiki/British_slang
- petecooper 8y ago
  You may also like this: https://www.amazon.com/Viz-40th-Anniversary-Profanisaurus-Piss/dp/1781066779/ https://www.amazon.com/Viz-40th-Anniversary-Profanisaurus-Pi...
dmfdmf 8y ago
PSA: On Sept 21st freezing or thawing your credit will be free. https://krebsonsecurity.com/2018/09/in-a-few-days-credit-freezes-will-be-fee-free/ https://krebsonsecurity.com/2018/09/in-a-few-days-credit-fre...
- rcpt 8y ago
  I just tried to unfreeze my credit on Equifax and couldn't after several visits to their website and multiple phone calls. They are asking me to mail my SSN, address, birthday, etc..
deleted 8y ago
[deleted]
oglopf 8y ago
I know for a fact that they also had Splunk ES bought, built, and running, then the CISO had them turn off the alerts because they were "too noisy" and sure enough, they could see all this happening when it was retroactively inspected. There are so many things wrong in that sentence but my most glaring question is: why on earth was she even receiving the alerts? That's so far below her level. So, there's more here than just the cert issue. There's also just a complete disregard for a secure mindset from the person that is supposed to be setting that mindset in the culture, along with what sounds like micro-managing to a state of no-managing.
- rkho 8y ago
  The incredibly frightening thing is that I'm no longer surprised about the fact that people like these still remain completely employable.
  - richforrester 8y ago
    Unfortunately, management roles are often inherited, instead of being earned.
- rjzzleep 8y ago
  It's very likely that she comes from corporate and thinks she has to know everything. I worked for a guy like that. He wanted everything on his plate and simple things like a confluence update could take 1.5 years because of it.
- barbecue_sauce 8y ago
  Depends on how big their team is and its structure with regard to alerting responsibility. One would expect one of the big credit rating agencies to have a large IT team, but old school corporations view IT as a cost center and like to run skeleton crews (which can flatten out administration hierarchies).
  - CreatedAccount 8y ago
    I work for one of the big three and we generally are pretty lean when it comes to staffing. Our CEO likes to claim it benefits us because then they don't have to do big layoffs during downturns.
phyller 8y ago
The best, and possibly only way of preventing the theft of personal data is to not have it. The amount of surface area a large organization needs to always protect its just too large, we can just assume at some point all that info will be taken.
ccnafr 8y ago
I actually read the GAO report and it does not say this. Thought I should point out a major error right there in the title.
bogomipz 8y ago
It's worth nothing that such a display of negligence didn't stop the IRS from awarding Equifax a 7 million dollar contract: https://www.politico.com/story/2017/10/03/equifax-irs-fraud-protection-contract-243419 https://www.politico.com/story/2017/10/03/equifax-irs-fraud-... And Equifax is the is same incompetent company providing identification services for healthcare: http://www.specialtycreditreports.com/equifax-contract-healthcaregov-credit-reports/ http://www.specialtycreditreports.com/equifax-contract-healt... Nor did it prevent 18F from awarding a similar multi-million dollar contract to Equifax for login.gov: https://federalnewsradio.com/reporters-notebook-jason-miller/2017/01/ups-downs-continue-gsa-18fs-identity-management-effort/ https://federalnewsradio.com/reporters-notebook-jason-miller... There is no incentive for Equifax to take security seriously.
badrabbit 8y ago
The apache struts vulnerability is easy enough to detect -- java runs programs it shouldn't. If a bigcorp like that doesn't have a nextgen av to detect that,executable logging+SIEM correlation would have done the trick. They detected the traffic after the tls inspection box was fixed, that was the box that deteced it not the point of entry from what I understand. Regardless, TLS inspection has it's place (this is why you can't have end-to-end cryto in a corporate environment). From my experience, most bigcorps do IT like it's still 2009. There is so much architectural bloat,bureaucracy and unseen system complexity,it reduces security controls to mere cosmetic theatrics. It's like having a 200ft tall,50ft thick iron wall around your castle with 100k foot soldiers armed with the best weapons and training. The problem is that your soldiers(IT staff) can't act fast due to bureaucracy and half of the duties are someone else's problem due to over-segregation of duties. Your fancy wall(security solutions and controls) is neat but there are holes wide enough to fit ten people all over it. In the end the enemy is complexity. You can't solve that by adding more security vendors,solutions and staff which is exactly what everyone seems to be doing.
- blunte 8y ago
  Working at companies like this, you come to realize that they are so insulated in their special (monopolistic or almost) positions that they become blind to anything other than quarterly earnings per share. On the rare case that something does blow up badly enough that executives must leave, they are still almost permanently cemented at their tier. So they just migrate to another poorly run large company to focus on their own short term gain. Applying logic to this scenario doesn't work. It's really about balancing cost-benefits. Since the costs to being an idiot are very low once you reach a certain level, the downsides can be completely forgotten in pursuit of the upsides.
- p0rkbelly 8y ago
  "Nextgen"AV would not have caught this. AV is still AV and looking at executables and binaries. Exploiting a vulnerability does not fit that bill. This incident had nothing to do with a 'virus'. Now many tools that include AV, say Crowdstrike, may have caught this...but AV is on the low-end of the hierarchy of needs when it comes securing your assets, especially servers. Much more so for Linux. AV is more of an end-user issue where they want to download files and execute them.
blunte 8y ago
At a certain point (age, level of wisdom, whatever) you realize when a company is focused on short term gain vs everything else. At that point, unless you just don't give a shit, you move on. Not to bring politics into this, but there's a variant of capitalism that runs rampant in developed economies that is based almost exclusively on short term gain. Equifax, like so many other companies, illustrates this story in painful detail - especially for those who work there. There are so many executive poor behaviors that go on, affection not just their employees but their customers and beyond, that you might think by now there would be more attention paid to this. But the people who should be paying attention are quite like the executives who are overly focused on short term gain.
grigjd3 8y ago
The headline is by far the least concerning part of this.
malkia 8y ago
Just wondering, are the queries executed against the state of the databases in that moment?

247 points by wglb 8y ago

Meanwhile Equifax stock is at ~130 compared to ~145 it had before the news broke of the back. With their lowest dip at ~90 and a long time dragging along at ~110. ¯\_(ツ)_/¯ I'm seriously considering that on the next massive data breach of a public traded company I'm gonna buy some stock in the onset. Even though it feels like betting against my own principles it just seems like a too good of an opportunity to miss out on...

crunchlibrarian 8y ago
Several Wells Fargo executives came right out and openly confessed to fraud and theft of consumers' money, and none of them are in jail and the company has not been adversely affected in the slightest. They paid some fines equivalent to what they make in profit every 13 hours. That's it. Nothing else. If you're running a large profitable company why should you care about security at all? Why should you care about the rule of law at all? There is no accountability, there is no culpability, nobody will ever get in trouble.
- derekp7 8y ago
  The Wells Fargo thing I really don't understand -- even without government action, I can't believe that they still have customers. How does that happen? I know that when a car dealer does the financing, you may not know who the lender is until you get your first bill, but even so I can't see anyone willingly going with them for any accounts (savings/checking, loans, etc).
  - Cyph0n 8y ago
    I've been a customer since before the fiasco and haven't changed because they have a ton of branches in the area and they have been great at quickly solving any issues I run into. I've started using Chase and Cap One online but they have zero branches in my entire city...
    - Consultant32452 8y ago
      I can't recommend e-banking enough. I use Fidelity, but Schwab is also similarly good. Totally free checking, no minimum balances, easy access to high rate CDs, bill pay, and you can use any ATM in the country, they pay all your fees. I keep a few hundred dollars in a savings account locally because I'm paranoid I might want to see a human being, but I've literally never had to use it.
      - Cyph0n 8y ago
        The biggest problem with online-only banking is that there is really no way to get a large sum of money out immediately. The only way to withdraw a large sum is to transfer it to another bank account (1-2 days) and then go to that bank's branch. Of course, you can use checks, but sometimes you need hard cash (e.g., buying a used car).
        mmt 8y ago
        > Of course, you can use checks, but sometimes you need hard cash (e.g., buying a used car). I use "cashier's checks" [1] to buy used cars, since that still offers more security and convenience (of not handling physically bulky bundles of currency). A trick I learned from reading sites about how to buy at real estate auctions (where the final price can't be known up front) is to use multiple checks made out to oneself, in varying amounts. The ones needed for payment can be endorsed over to the seller, and the remainder can be re-deposited. My credit union will send me an effecitvely unlimited number of these through the mail, if they're requested through the automated system and each for a at least some (reasonable) minimum amount. Still, your point holds. If you need it in a hurry, a physical branch is required. [1] check drawn on the financial institution, not my personal account
        Consultant32452 8y ago
        I've bought a couple of used cars in private sales. Give them a couple hundred dollars deposit, get a receipt, then make arrangements to do the full payment during business hours when you can meet at the seller's bank and do a bank wire, cashier's check, etc. It would be pretty rare that you can't get this worked out. And worst case scenario, you keep that local bank account open and do an EFT to it when you start shopping.
  - poulsbohemian 8y ago
    Often the effort or cost to get out of a home mortgage or car loan makes you stuck by inertia.
  - dzdt 8y ago
    Wells Fargo wasn't really defrauding their customers, at least not at significant scale. Wells Fargo reps were defrauding their internal evaluation targets. The customer damages were incidental and generally small.
  - tristor 8y ago
    I'm a Well's Fargo "customer" (more like a hostage) because they bought my mortgage from the local lender I originally went through. I have no legal way to stop being a Well's Fargo "customer" that does not result in direct and long-term financial penalties. Considering that they hold one of the largest mortgage portfolios in the US, I'd guess that many other "customers" of Well's Fargo are in the same boat. I hate both Bank of America and Well's Fargo with a passion and the outcome of 2008 didn't dissuade my disgust at them. Unfortunately both hold loans from me that I did not initially originate with them.
deleted 8y ago
[deleted]
Sileni 8y ago
I'd be a bit worried that was like playing Russian Roulette. At some point, the companies have to actually correct right? I imagine the reason they were able to take the hit was the number of people waiting to buy low already. That number of people has to be consumed to a certain extent each time a cycle happens. I mean, if there's fundamental problems, it eventually has to reflect in the stock price... right? Please?
- NeedMoreTea 8y ago
  Sometimes, maybe. Perhaps at insolvency. Worldcom looked pretty healthy in 2002, then they were chapter 11.
  - g051051 8y ago
    Just like the previous mention of Enron, Worldcom engaged in systematic large-scale accounting fraud. Very different from the Equifax breach situation.
- chrischen 8y ago
  The thing about roulette is that you can bet most numbers except a couple, and do pretty well in the short term, albeit with small winnings. But the odds are still against you long term.
- michaelbuckbee 8y ago
  Well, that's the thing, they don't _have_ to correct. Look at Enron. They were huge and I can clearly remember people buying in post revelations saying: "oh it's going to come back".
- wongarsu 8y ago
  >I mean, if there's fundamental problems, it eventually has to reflect in the stock price... right? From a business perspective, poor IT security doesn't have to be a fundamental problem. Occasionally beating up your customers may be fine, and being voted as worst company in America isn't nessesarily that bad either. Are there fines high enough to impact business? Are you on the receiving end of new legislation because of the event? Is the market both capable and willing to punish you? Depressingly often the answer to all of those is "no".
gruez 8y ago
>it just seems like a too good of an opportunity to miss out on... unless everyone's doing the same thing and it's already priced in the moment the news goes public.
mtgx 8y ago
It's because the U.S. government is so corrupt right now that none of the existing large organizations/corporations will ever be punished the same way Enron was, unless the political landscape and system changes significantly. That's why, regardless of how large a company scandal is, you can make a pretty good bet on the company surviving and recovering easily from the scandal, because the government will protect it/issue a tiny fine to save some face. In this case, Congress literally passed a law to save Equifax from private lawsuits. Absolute insanity. If this isn't a sign of a corrupt government, I don't know what is. It's a very sad state of affairs that will likely get much worse before it starts getting better.
- g051051 8y ago
  The difference was that in Enron's case it was clear criminal intent to defraud, as opposed to security failures. As far as "Congress literally passed a law to save Equifax from private lawsuits", what they did was part of the larger sweep of allowing companies to force arbitration on consumers. It was unrelated to the breach.
  - munk-a 8y ago
    The allowance of private arbitration is a pretty clear example of corruption though, class action lawsuits exist for the purpose of punishing companies more than delivering assets to the suffering parties and that route has been taking away in a lot of circumstances.
    - g051051 8y ago
      Can't argue there. The rise of arbitration clauses has done a huge amount of damage to consumer rights.
s_dev 8y ago
I'm still at a loss as to how Ashely Madison is still going after their data breach. Everyone user on that site (99% male) was exposed as a complete chump -- it's still a functioning business ...
- dickinson99 8y ago
  Where does this 99% figure come from? And how did they get exposed? Did someone contact everyone's friends and family that got leaked?
  - s_dev 8y ago
    >Where does this 99% figure come from? The data is public now -- AM were blackmailed and didn't pay -- I guess you can take a sample of the email addresses and compare with public profiles that match the emails. There were virtually no women -- in fact they were so paranoid the men would realize there weren't any women to have extra marital affairs with they had -- bots -- that flirted now and again just to keep the men paying. Plenty of reporting was done on it after the breach. I recall saying to people that this would be a good example of a breach that would destroy a company by exposing that it's value proposition was nothing. I guess I was very wrong.
    - cbhl 8y ago
      What if there is a value proposition in paying to have a bot flirt with you now and again? I'm reminded of the entire "robot boyfriend/girlfriend" genre of TV/Movies/Comics from Japan/Korea, plus the "dating simulator" genre of video games. These are more fantasy-fulfillment, though. I honestly think it would be a net good for society to have simulators/bots that teach people how to have real, healthy relationships with other humans. (There are anecdoates about kids with autism who became more verbal once they started talking to Siri or the Google Assistant, for example.) But I feel like working on or using such tools would probably be as stigmatized as sex toys in the near/medium term.
      - village-idiot 8y ago
RegBarclay 8y ago
I saw a screen full of company logos on the news during the oil well blowout in the Gulf of Mexico and checked into their stock prices. I did OK on Halliburton. Did OK with Merck after the Vioxx news too. Buying on bad news is a pretty safe bet when the news is limited to a small part of a very large, diversified business.
3pt14159 8y ago
I've come to the conclusion that whatever is computerized is going to be leaked. Health records? Might as well open source them for all I care. Red team is tenacious and the steps you have to take to actually keep everything secure make you seem unreasonable. I've moved on. It's more important to focus on election security and physical security at this point. Infosec is dead. Five years ago Bruce Schneier wrote a book called "Carry On" now he has one called "Click Here to Kill Everybody". Just five years. We're in a technological growth feedback function and we're unable to predict it.
- ergothus 8y ago
  Author David Brin has (relatively) long advocated that we have two options: shoot for privacy resulting in those with power able to access the "private" info, or have it open where everyone can access. He then argues for the latter because it minimizes rather than maximizes abuse. (I'm paraphrasing and summarizing, possibly poorly) I struggle with being _comfortable_ with that idea, but I don't have a problem believing the technical accuracy of it.
  - xevb3k 8y ago
    Interestingly (because the parent is about Schneier). IIRC Schneier argues against this. The argument is that even if everybody has access to all information, only a small group is able to exploit that access effectively. So, you still end up with a small group abusing their access to the information. You should therefore aim for privacy of sensitive information.
    - cortesoft 8y ago
      Yeah, I think a good example of this is thinking about something like license plate scanning. Technically, this is not taking advantage of any public information. It is just capturing images of things happening in public. Anyone could set up a camera and capture license plates as they drive through an intersection. So is it totally fine for a police force to scan license plates at every intersection? The question is complicated, because the effect on people changes when you do something that is not worrisome on a small scale in an automated way at a large scale. When you add in that the people doing it have a large amount of power over people and it changes it even more.
chair6 8y ago
Just make sure you time it right. The problem with EFX was they announced on September 7, dipped, then announced additional badness on September 13, so double-dipped (https://s.yimg.com/uc/fin/chart/18/08/39d3a24.png https://s.yimg.com/uc/fin/chart/18/08/39d3a24.png) and you were out ~30% immediately.
jack6e 8y ago
This is an old investing strategy summarized by Rothschild in the anecdote, "The time to buy is when there's blood in the streets." I think that maxim captures the crass greed of the strategy.
- antidesitter 8y ago
  Why is this strategy “crass greed”?
  - ISL 8y ago
    Indeed, it puts a floor on prices in freefall. If someone needs to sell, and nobody is willing to buy, the price goes to zero.
  - tedunangst 8y ago
    You're supposed to say "Be fearful when others are greedy and greedy when others are fearful" and then you sound kind and wise like Warren Buffet.
mikestew 8y ago
I'm seriously considering that on the next massive data breach of a public traded company I'm gonna buy some stock in the onset Buy call options, that way if it doesn't go your way you're not out as much (in theory, anyway). Worked for me with Equifax and United Airlines, as two examples. Didn't work so well buying puts on Kodak when they announced crypto-whatever; market stayed irrational longer than the life of my contract. Keeping in mind that the next Equifax might be the one that finally gets put against the wall.
- paul_milovanov 8y ago
  That emphatically didn't work out for me with Valiant. Remember, options have expiries. And also it only makes sense if market implied volatility of your options contract is way below the upside move you expect. I.e buying calls at 50% IV when you only expect a 30% move before expiry is... suboptimal. In other words, there's no substitute for truly knowing what you're doing when trading options. (Learned this the hard way, AMA)
  - paul_milovanov 8y ago
    It did work out for me with GEO (doubled my position on the sharp drop) but I bought stock because I had no idea when it might rebound. Options are far less forgiving if you're wrong on timing.
reaperducer 8y ago
Perhaps this fits into the cliche about there being "no such thing as bad publicity."
matchagaucho 8y ago
Too big to fail. Substantially all loans are backed by credit scores from the big 3.
liftbigweights 8y ago
We are in one of the greatest bull markets in history. There are dollars, euros, yens, yuans, pounds, etc overflowing everywhere thanks to lax monetary policy all over the world. Considering equifax is one of 3 monopolistic credit reporting agencies, you can be sure they won't go out of business. So you buy the dips. Same thing with tesla. Same thing any established legit stock of a legit company. In a major bull market you buy the dips as long as the music is playing. But once the music stops, you don't want to be dancing. Same thing with major bear markets. Short the bumps.
freeone3000 8y ago
Always bet against your priciples. If you win, you get a better society! If you lose, at least you're richer.
drewmol 8y ago
After looking at stock drop and recoveries of other companies involved in major PII breaches in the last 10 years, I came on here recommending people look into options, as an opportunity to profit off the reactionary price tumble fallout from that breach. IIRC EFX, with a market cap of ~$16B, went from ~$140 to ~$90 over a few days. As a primarily B2B data broker that sells information without concern for the data subject's wishes, in an establishe and disruption resistant market with only 2 other competitors and decades of purchasing friendly regulations, a ~36% drop seemed unlikely to persist for very long. It's just betting against a large majority sharing, and sacrafising $, in order to adhere to those principles.
anonytrary 8y ago
Speaking of investments against principles -- you might want to check out Facebook stock as of 9/20/18, it's trading at something like 20% under, if you think it will rebound. (I'm not a FB shill, just read my post history).

chris_mc 8y ago

So, someone forgot to input this certificate into their Outlook Calendar, Slack /remind, or whatever, and as a result 150mm people are at risk for identity theft. Awesome. I'm so glad I have no option to prevent my data going to this super-competent company and there's no oversight by anyone external.

c0nsumer 8y ago

Isn't the claim made in the article as sensational -- that the investigators replayed what the attackers did -- just kinda good practice? It'd just make sense to me that, during an investigation, one would replay what the attackers did to get a good understanding of the results. This just seems like responsible investigation. (The flipside would instead be claiming that X was compromised, and not being able to honestly answer questions as to whether one retraced the attacker's steps to provide assurance.)

toomuchtodo 8y ago
You would expect a serious firm to have auditing and logging that would provide the necessary forensics without having to rerun an exploit.
- uhhhhhhh 8y ago
  They were able to identify and re-run the attack, so auditing and logging are likely present enough to capture what they attackers did, which in most breaches needs to be analyzed to see what they were able to accomplish. This doesn't shout amateur hour to me directly, it seems more kicking a dead horse while its down, but that doesn't mean it isn't amateur hour or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I'm not trying to defend them, just stating this sounds somewhat misleading and sensationalized.
  - toomuchtodo 8y ago
    > or a complete company wide failure to prioritize security and secrecy of customer data at Equifax. I haven't seen any proof that Equifax operates in any other way. I am not attempting to be rude, only stating fact.
    - g051051 8y ago
      Unless you work for them, you haven't seen any proof of anything, outside of the tiny amount of information revealed since the breach.

SonnyWortzik 8y ago

While your data is being stolen and sold in the dark web, Equifax is happy to sell you Identity protection for your business: https://www.equifax.com/business/credit-monitoring-and-identity-protection/ https://www.equifax.com/business/credit-monitoring-and-ident...

albertgoeswoof 8y ago
An extract from an email I recieved from BA after their latest breach: We deeply apologise for any worry and inconvenience this criminal activity has caused. For your reassurance, we’re offering you 12 months of free credit and identity monitoring services, provided by Experian, one of the UK’s leading Credit Reference agencies. Your free ProtectMyID membership...
- LinuxBender 8y ago
  If you accepted the free membership, you waived your rights to sue them. It was in the agreement.
  - sp332 8y ago
    They tried it, but after backlash they backed off. https://www.forbes.com/sites/dianahembree/2017/09/09/consumer-anger-over-equifaxs-ripoff-clause-in-offer-to-security-hack-victims-spurs-policy-change/ https://www.forbes.com/sites/dianahembree/2017/09/09/consume...
- mjevans 8y ago
  I always figured that the smarter scammers would just wait 15 months and THEN use the data, or even sell it to (many) others that would.
  - noja 8y ago
    15 months is enough time to change your mother's maiden name and the name of your first pet.

iamleppert 8y ago

Imagine all the companies who Equifax is probably contracted that need bulk query access to their data. It’s easy for the crowd here to poo poo this kind of behavior, and it is bad, and they should be punished for their incompetence. They should not be in business any longer, it’s not like there aren’t other companies operating in this space to fill the void. That said, how do you seriously prevent such a thing from eventually happening? In this case it was their systems that were compromised but it could have easily been a downstream user or similar that had enough direct access. I’m curious to know what, if any technical solutions could be possible? I’d never take a tech job protecting such a thing. The only way I could think would be to have some very trusted people manually reviewing all access to the primary data store, and even that probably wouldn’t be enough. Miss one unauthorized query and you’re toast. The entire system of social security numbers is flawed by design from a security perspective and there in lies the problem.

danschumann 8y ago

Nicked.. British English is fun.. is there a compendium of phrases like this?

forgotmypw 8y ago
https://en.wikipedia.org/wiki/British_slang https://en.wikipedia.org/wiki/British_slang
petecooper 8y ago
You may also like this: https://www.amazon.com/Viz-40th-Anniversary-Profanisaurus-Piss/dp/1781066779/ https://www.amazon.com/Viz-40th-Anniversary-Profanisaurus-Pi...

dmfdmf 8y ago

PSA: On Sept 21st freezing or thawing your credit will be free. https://krebsonsecurity.com/2018/09/in-a-few-days-credit-freezes-will-be-fee-free/ https://krebsonsecurity.com/2018/09/in-a-few-days-credit-fre...

rcpt 8y ago
I just tried to unfreeze my credit on Equifax and couldn't after several visits to their website and multiple phone calls. They are asking me to mail my SSN, address, birthday, etc..

deleted 8y ago

[deleted]

oglopf 8y ago

I know for a fact that they also had Splunk ES bought, built, and running, then the CISO had them turn off the alerts because they were "too noisy" and sure enough, they could see all this happening when it was retroactively inspected. There are so many things wrong in that sentence but my most glaring question is: why on earth was she even receiving the alerts? That's so far below her level. So, there's more here than just the cert issue. There's also just a complete disregard for a secure mindset from the person that is supposed to be setting that mindset in the culture, along with what sounds like micro-managing to a state of no-managing.

rkho 8y ago
The incredibly frightening thing is that I'm no longer surprised about the fact that people like these still remain completely employable.
- richforrester 8y ago
  Unfortunately, management roles are often inherited, instead of being earned.
rjzzleep 8y ago
It's very likely that she comes from corporate and thinks she has to know everything. I worked for a guy like that. He wanted everything on his plate and simple things like a confluence update could take 1.5 years because of it.
barbecue_sauce 8y ago
Depends on how big their team is and its structure with regard to alerting responsibility. One would expect one of the big credit rating agencies to have a large IT team, but old school corporations view IT as a cost center and like to run skeleton crews (which can flatten out administration hierarchies).
- CreatedAccount 8y ago
  I work for one of the big three and we generally are pretty lean when it comes to staffing. Our CEO likes to claim it benefits us because then they don't have to do big layoffs during downturns.

phyller 8y ago

The best, and possibly only way of preventing the theft of personal data is to not have it. The amount of surface area a large organization needs to always protect its just too large, we can just assume at some point all that info will be taken.

ccnafr 8y ago

I actually read the GAO report and it does not say this. Thought I should point out a major error right there in the title.

bogomipz 8y ago

It's worth nothing that such a display of negligence didn't stop the IRS from awarding Equifax a 7 million dollar contract: https://www.politico.com/story/2017/10/03/equifax-irs-fraud-protection-contract-243419 https://www.politico.com/story/2017/10/03/equifax-irs-fraud-... And Equifax is the is same incompetent company providing identification services for healthcare: http://www.specialtycreditreports.com/equifax-contract-healthcaregov-credit-reports/ http://www.specialtycreditreports.com/equifax-contract-healt... Nor did it prevent 18F from awarding a similar multi-million dollar contract to Equifax for login.gov: https://federalnewsradio.com/reporters-notebook-jason-miller/2017/01/ups-downs-continue-gsa-18fs-identity-management-effort/ https://federalnewsradio.com/reporters-notebook-jason-miller... There is no incentive for Equifax to take security seriously.

badrabbit 8y ago

The apache struts vulnerability is easy enough to detect -- java runs programs it shouldn't. If a bigcorp like that doesn't have a nextgen av to detect that,executable logging+SIEM correlation would have done the trick. They detected the traffic after the tls inspection box was fixed, that was the box that deteced it not the point of entry from what I understand. Regardless, TLS inspection has it's place (this is why you can't have end-to-end cryto in a corporate environment). From my experience, most bigcorps do IT like it's still 2009. There is so much architectural bloat,bureaucracy and unseen system complexity,it reduces security controls to mere cosmetic theatrics. It's like having a 200ft tall,50ft thick iron wall around your castle with 100k foot soldiers armed with the best weapons and training. The problem is that your soldiers(IT staff) can't act fast due to bureaucracy and half of the duties are someone else's problem due to over-segregation of duties. Your fancy wall(security solutions and controls) is neat but there are holes wide enough to fit ten people all over it. In the end the enemy is complexity. You can't solve that by adding more security vendors,solutions and staff which is exactly what everyone seems to be doing.

blunte 8y ago
Working at companies like this, you come to realize that they are so insulated in their special (monopolistic or almost) positions that they become blind to anything other than quarterly earnings per share. On the rare case that something does blow up badly enough that executives must leave, they are still almost permanently cemented at their tier. So they just migrate to another poorly run large company to focus on their own short term gain. Applying logic to this scenario doesn't work. It's really about balancing cost-benefits. Since the costs to being an idiot are very low once you reach a certain level, the downsides can be completely forgotten in pursuit of the upsides.
p0rkbelly 8y ago
"Nextgen"AV would not have caught this. AV is still AV and looking at executables and binaries. Exploiting a vulnerability does not fit that bill. This incident had nothing to do with a 'virus'. Now many tools that include AV, say Crowdstrike, may have caught this...but AV is on the low-end of the hierarchy of needs when it comes securing your assets, especially servers. Much more so for Linux. AV is more of an end-user issue where they want to download files and execute them.

blunte 8y ago

At a certain point (age, level of wisdom, whatever) you realize when a company is focused on short term gain vs everything else. At that point, unless you just don't give a shit, you move on. Not to bring politics into this, but there's a variant of capitalism that runs rampant in developed economies that is based almost exclusively on short term gain. Equifax, like so many other companies, illustrates this story in painful detail - especially for those who work there. There are so many executive poor behaviors that go on, affection not just their employees but their customers and beyond, that you might think by now there would be more attention paid to this. But the people who should be paying attention are quite like the executives who are overly focused on short term gain.

grigjd3 8y ago

The headline is by far the least concerning part of this.

malkia 8y ago

Just wondering, are the queries executed against the state of the databases in that moment?