14 ms·

First American Financial Corp. Leaked Hundreds of Millions of Insurance Records

418 points by PatrolX 7y ago

wyxuan 7y ago
It seems that the stock price (under the ticker FAF) hasn't suffered very much. This was revealed on 5/19, and the response has been tepid.There isn't likely going to be very much backlash on the stock, unfortunately.
- rconti 7y ago
  Markets are closed, down slightly after hours, but after hours volumes are weird.
- PatrolX 7y ago
  Mainstream media haven't picked up the story yet. It only just broke.
- sp332 7y ago
  I think that's May 2019, not May 19th. From the bottom: This entry was posted on Friday, May 24th, 2019
- raesene9 7y ago
  I don't think there will be, we're well into "breach fatigue" territory now, and here there's not even currently any evidence of malicious use. Unless/until this breach results in a large financial hit to the company (possibly via a class action suit) I doubt it'll have any impact and I'm not even sure a class action suit could show damages without evidence of misuse.
  - PatrolX 7y ago
    Equifax's costs as a result of their breach have exceeded $1 billion now, and Moody's downgraded them a couple of days ago. I suspect this is going to hit First American pretty hard.
    - CyanLite2 7y ago
      Doubt it. There's no evidence yet that FA's leak was used by malicious hackers. The breach was discovered by some random other person who typed in a different parameter to a URL. Very likely that no one else would've known about it. Whereas the Equifax situation was intentionally breached by attackers and it can be assumed that the breach was used to capture information for later sale. I suspect that First American knew about this earlier this week and intentionally did a garbage dump on a Friday evening on Memorial Day Weekend. Maybe trade down a few tenths of a percent on Tuesday and their CISO will probably get axed. Nothing to see here, move along.
- PatrolX 7y ago
  The breach was revealed 6 minutes before I posted this. First on Twitter, then here.
raesene9 7y ago
By the sounds of it, another breach from a well-known, not new web application security vulnerability, "Insecure Direct Object Reference". That vuln has been an explicit part of the OWASP Top 10 since 2007... Unlike other common web app vulns (e.g. XSS SQLi) IDOR usually can't be fixed by a development framework (e.g. ASP.Net or Rails), it needs app. specific coding for proper Authentication/Authorization checks.
LinuxBender 7y ago
That is an incredibly low friction interface to our documents. /s What are the odds they have access logs going back to 2003?
- PatrolX 7y ago
  Pretty good, everything was probably set up and configured with default settings by that unpaid intern they had running their infrastructure back in 2003.
  - 55555 7y ago
    default settings would wipe/rotate logs after some time, no?
    - krferriter 7y ago
      Rotate maybe, not wipe. As far as I'm aware for most webservers you have to tell it to rotate the logs based on some criteria, otherwise it just keeps appending. If debugging is turned off it's entirely possible that they have been appending lines to the same log file for the last 20 years and haven't run out of disk space which would cause them to notice. Say 200 bytes in the log per request, and even averaging 10000 (probably more than they get) requests per day, in 20 years that's only 13GB. It's also entirely possible they turned logging off or redirected to /dev/null in order to "be more efficient".
      - deleted 7y ago
        [deleted]
  - zhte415 7y ago
    The organisation should have a data retention policy.
Nicksil 7y ago
>At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers’ information. is such a meme. Things will continue this way until there are serious repercussions for entities carelessly handling data.
- PatrolX 7y ago
  There was a repercussion a couple of days ago actually for Equifax. But yeah, maybe not serious enough to matter that much, I'm not sure what the outcome will be. https://www.msn.com/en-us/finance/markets/moodys-cuts-equifax-outlook-to-negative-the-first-time-cyber-attack-leads-to-downgrade/ar-AABKKTb https://www.msn.com/en-us/finance/markets/moodys-cuts-equifa...
- saagarjha 7y ago
  The next sentence too: > We are currently evaluating what effect, if any, this had on the security of customer information. It's downright dishonest to even say "if any": they were presented with concrete examples of leaking customer information; they don't get to wonder whether it had an effect on their security anymore.
  - 55555 7y ago
    Yeah, considering that they have sent these URLs to at least tens of thousands of people, it would be hard to believe that nobody ever inappropriately accessed a document that didn't belong to them.
client4 7y ago
I did a penetration test for $NATIONALINSURER and they had an FTP site with weak credentials where all the remote offices uploaded claims. Millions of records and scans of SSNs, home addresses, bank information, etc. Their mitigating controls were: we put it behind a firewall. Then again I didn't expect much, their MSSQL in prod had SA/SA credentials active.
- ownagefool 7y ago
  I've seen Retail stores with revenues in the 10s of billions using Telnet for the POS clients in 2019. They also used FTP glaore and were worried about the security of cloud. :)
  - PatrolX 7y ago
    Ditto. I've seen the same thing going on at an investment bank processing $350 billion / day in transactions.
  - jeromegv 7y ago
    Wonder how many retailers there are that make 10s of billions
    - PatrolX 7y ago
      Around 20-25 I believe.
  - ineedasername 7y ago
    I worked for <business imaging company X> where every network-connected copier automatically setup its own web server where unauthenticated users could peruse all of the jobs printed recently. Sure, a firewall might prevent public access, but it also wasn't hard to use Google's inurl: function to find the (at the time) 5% or so companies using these things that had public ip's assigned. You could also upload documents like PDFs to be printed out. Many of the high end fax machines had the same "feature". HP printers did something like this too, but that's not where I worked. EDIT: Oh, and the network controllers that ran them were uniformly updated and managed with fully open "admin" username no-password telnet and ftp services. IoT insecurity began a looooong time before the term IoT even existed.
snovv_crash 7y ago
At some point people will realise that holding large quantities of sensitive information is a liability, not an asset. Mindsets are slowly changing in this direction already. The chickens will continue to come home to roost until people treat digital security as seriously as physical security.
- astura 7y ago
  One must hold large quantities of sensitive data forever to operate in the title insurance and settlement services business.
- hnaccy 7y ago
  Unless they get punished or lose all their customers how is it a liability?
  - seppin 7y ago
    It's not.
- guitarbill 7y ago
  Only if there are laws making it a liability, since investors don't seem to care much in the long term.
  - rolltack 7y ago
    Laws won’t change this. It will only make it a compliance burden and the same mistakes will continue to happen. Plus standards and practices move way faster than laws. What investors should be concerned about is the reputational risk and loss of business to competitors that are able demonstrate more transparent and secure practices. Maybe laws for monopolies, but not for competitive markets where consumers have choice to shop around. For a competing business these dumps are a powerful marketing tool. It’s a direct client list. They just have to be able to show that their security is better. Laws would make things so much worse for everyone. The key is to keep hacking away at all systems. Break things apart and build them back together. And win customers by showing that you can!
throwawaymath 7y ago
Yet another security vulnerability caused by: 1. Using sequentially incremented integer sequences as object IDs, and 2. Failing to protect sensitive data using some kind of authentication and authorization check. This is becoming a trend with data breaches. Several of Krebs' other reports on behalf of security researchers were originally identified by (trivially) walking across object IDs on public URLs. My cynical take is that Krebs couldn't go public before this afternoon because First American wanted it to hit the news at an opportune time, then get ahead of it with their own messaging. Krebs got in touch with First American on Monday May 19th. The story is only just breaking now on a Friday afternoon at 5 pm; markets are conveniently closed for the weekend. I expect them to issue a hollow PR statement about valuing security despite being unable to act on security reports until an investigative journalist threatens to go public.
- eganist 7y ago
  (It's apparent that my initial reply didn't resonate, so I've made substantial edits to my reply for clarity's sake. If you've read it once, give it another read; it's from the angle of an organization with much in the way of legacy impairment.) > Yet another security vulnerability caused by... I mean, yes, but these are also some of the easiest vulnerabilities to miss even with out-of-the-box static analysis (code scanning and data analysis), automated dynamic analysis (pentests [edit to clarify for tptacek: automated pentests]), and a basic code review process. They're usually identified in live environments during manual penetration tests or, in more security-mature environments, with custom static analysis checks and custom linting rules. As for best-case prevention: accomplished generally architecturally, e.g. language/framework decisions that enforce secure coding practices by design, or implementing certain patterns in development which whisks away some of the more risky coding decisions from engineers who may not be qualified to be making them, such as mandating authn/z and limiting exceptions only to roles and change processes qualified to make them. Checks including linting for specific privacy defects (direct object referencing using sensitive data or iterative identifiers as opposed to hashes/guids/etc) can help with catching them during development, and as you might've guessed, such checks tend to be custom for a given environment rather than out of the box. I distinctly recall a card issuer whose name starts with a C in the United States having an http endpoint which allowed for enumerating account details by iterating full PANs (16 digit card numbers)... around a decade ago. Here we are today, and you're seeing the same bugs continue to arise. Mitigation options in organizations with immature security practices typically rule out remediation simply because their existence might not be known, and practices traditionally reserved for defense-in-depth may need to be relied-upon instead (think monitoring web requests for anomalous behaviors and blocking traffic when detected) rather than trusting that one can fix all the defects, and even then you'll still lose a few records... but that might be the only solution available to you as a CTO, CIO, or CISO simply because of resource constraints and bureaucracy in an entrenched org e.g. in the financial or insurance space. -- tl;dr: these defects are among the harder ones to catch for legacy applications especially in environments with weaker security postures, and they're as old as time. What I'm saying is that as much as we can call companies out for making these mistakes in hindsight, their existence in larger legacy systems is to some extent inevitable and must be managed in other ways.
zeroDivisible 7y ago
I like how this news was posted on Friday afternoon before the Memorial Day weekend.
- awad 7y ago
  Taking out the trash, as it were
angry_octet 7y ago
Whenever you are compelled to upload/send a photocopy of an ID document it is sensible to write the date and purpose / file reference on it. If it appears in a document dump at some later date you know the path and date of the leak.
- OrgNet 7y ago
  that is a good idea but most of the time I need to hand over my actual ID, and not just a scan of it
  - ineedasername 7y ago
    Yeah, like most doctors offices will take my license with my insurance card, and they scan them into their own systems to associate with my record. No opportunity to insert my own add on content. Just hope whatever SaaS based patient management system they have is iron-clad secure. (But it isn't)
    - OrgNet 7y ago
      I guess you could stick a very small sticker on it
  - angry_octet 7y ago
    I'm usually an uncooperative bastard at times like this. I ask them what their purpose is in retaining a copy of my identity document, and I ask for their privacy policy. When I'm travelling for work and a hotel asks I simply say no, and remind them I can lodge a complaint with our corporate travel provider that will have them delisted for future business; usually they come to their senses. For overseas travel (where they often have to fax your passport to the police) I ask for the photocopy back when I check out; since these documents are lost/misfiled regularly the desk clerk usually complies. Always try for point-in-time ID verification rather than retention.
    - nerdponx 7y ago
      Where do they ask you for a copy of your ID? I've never had that happen to me at a hotel.
dmix 7y ago
> He said anyone who knew the URL for a valid document at the Web site could view other documents just by modifying a single digit in the link. Good thing he didn't post this bug online after getting no response. I remember reading about someone who did that on an AT&T website a while back and was sent to jail for simply incrementing an id number in the URL and talked about it on Twitter.
- luckylion 7y ago
  That was probably about weev, and they were after him long before that case, so it's not likely that it would get some random person (that the FBI doesn't have a file on and an interest in picking up) in the same trouble.
gesman 7y ago
"First American has learned of a design defect in an application that made possible unauthorized access to customer data. At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers’ information..." Who is coming up with these statements? If you kept royally screwing something for years that you claimed to be your "highest priority" - then what can one expect from your normal lines of business?
jammygit 7y ago
Where does one go to learn how to not cause this one day?
- krferriter 7y ago
  OWASP Top 10 list. OWASP's website is kind of a mess in my opinion, but there are numerous external write-ups about the top vulnerability types. https://www.cloudflare.com/learning/security/threats/owasp-top-10/ https://www.cloudflare.com/learning/security/threats/owasp-t... Also this github repo maintained by OWASP seems pretty exhaustive. The cheatsheets directory has a lot of different vulnerability classes. https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.md https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... This "Insecure Direct Object Reference" was recently combined into the "Broken Access Control" category with a few others.
  - jammygit 7y ago
    Thanks!
zhte415 7y ago
A lot of discussion on technical side, but not from organisational. How could audit, both internal and external, not find this? 2003 to today is 16 years. Audit is a last line of defence and certainly not to be relied on upon as a buddy to catch your errors. But... how? This is a major financial institution in the most developed country in the world (the clue's in the name). It should subscribe to the the highest integrity and tightest scrutiny. This seems an opportunity for both internal and external auditors to tighten their game. Outside of audit, surely an employee might have noticed? Was there no formal method to speak up without fear of recrimination? According to Wikipedia [1] there are eighteen thousand employees. Someone never noticed? This seems an organsiational failing, not a technical one. [1] https://en.wikipedia.org/wiki/First_American_Corporation https://en.wikipedia.org/wiki/First_American_Corporation
- TomVDB 7y ago
  You can access documents all the way back to 2003. That doesn’t necessarily mean that this hole has existed that long.
  - zhte415 7y ago
    Very good point.
- toong 7y ago
  And this is from a huge organisation. There are many more medium-large organisations that still operate under the Chinese-walls model: perimeter defense, but once you are inside the VPN/intranet the security is a lot more relaxed (if any). That is the security culture and very hard to change. The market forces those orgs to start offer services online. They run those (relaxed security) services inside their intranet, so they start poking holes in their firewall. The next decade is not going to be pretty in that regard.
  - zhte415 7y ago
    I think you're correct, that these will become more common. A couple of years ago I was chatting with friends who were doing APIs, because of market/regulatory pressure EU's PSD2, exporting JSON of transactions using COBOL for use in online. Because that bank - almost an order of magnitude larger than First American in terms of employees - will do everything in order to not move off COBOL / it's legacy system. Interesting skill set: COBOL, DB2, JS, Angular.
reilly3000 7y ago
I just closed on my first house this week, and First American was of course my title company. I'll be interested to see if my data is included in this breach settlement or not. I did notice when I was reviewing my docs that they emailed links to unauthenticated copies of docs, but they were mostly public records so I didn't think twice about it. So they have my Name, address, email, SSN, copy of ID, copy of check from my bank with account/routing on it and much more, all in the open apparently. I just went through an SSO implementation with a small team for a large user base. It was a bigger project than we had anticipated, but nonetheless manageable. I can't fathom that a financial institution of that scale could be that lax with basic security. Wouldn't their systems be subject to some regulation and require some kind of audit on a regular basis? Is this a failure of auditing systems, as well as internal security or even basic IT?
JimmyDugan 7y ago
Programmers fault? Audits fault? Securities fault? Pentesters fault? It fault? Listen until C-level funds these programs properly and security is taken seriously by all issues like this will forever be in the news. I would be willing to bet their security like most have a long list of security gaps they cant get fixed because resource issues just hope they documented or it could fall on them. Most coding classes just teach how to make things work in Mister Roger's world. Secure coding is an elective! Most run the DevOps model instead SecDevOps and only involve security after it is ready to go into production no matter what flaws security finds. Why are black box pentests still taking place? Because company required to have pentest but really do not want testers to find things. Their goal is not to improve security rather check that box ... we had a pentest. C-level, this keep the lights on budget you give Security/IT is costing you more than properly funding us! Oh yeah you put that $ into cyber insurance! Lol let's see how well that works.
- mjparrott 7y ago
  If the financial penalty was high enough they would increase budgets. There is no accountability for losing customers personal information. If you can make a strong business case behind the average risk a company takes on it would help this discussion more. For each example of "company X had a major financial impact" you need to average it out against "company Y lost hundreds of millions of SSNs and had zero penalty".
JimmyDugan 7y ago
Lol everyone fights security and it is way under funded so can only get like 1 out of 100 risks fixed but must be securities fault.
JimmyDugan 7y ago
I see a lot of comments on sequential as the issue. Really is that the issue? Not the fact that John Doe can get to John Doe2 stuff without authenticating? WTF Sequential or not if no auth I can run a scanner and get it all so what the hell does that have to do with the price of tea in China?
deleted 7y ago
[deleted]
stephanietos 7y ago
Confront your cheating spouse with a clear and reliable evidence by meeting a legit hacker and private investigator, i was able to spy and monitor my cheating Husband day to day activities with my phone without having a direct access to his target phone and without him knowing.I never believe such could happen when I was looking for help during my divorce a lady talked about how this great man helped her out of infidelity on Discuss and contacted Wayne; it was like a magic under 30mins he sent me a code to dial in order to have access to spy my husband Instagram, Snapchat,whatsapp messages, what'sapp voice call and video calls,Delete Messages, Text messages, Email, Facebook, phone Gallery and other social media. I promise him to share this great opportunity and privileged to people out there especially to those people who might be facing a lot of tremendous challenges on infidelity and needed same help... Contact Wayne via the following....EMAIL: waynecyberghost@gmail.com , Tell him I referred you. He’s the only Ethical hacker with guarantee that will provide result and won’t expose your confidential data to anyone and will never Rip you off or disappoint you. He told me there is a refund policy if I found any of their services unsatisfactory but the joy is that I was satisfied with all the levels of services fast delivered and no Trace. Thanks so much to wayne Derick for helping me hack into my husband phone so i could see what is up to and i was able to caught him red handed, now i am out and a lot happier. credit goes to the earlier mentioned hacker for a good job. if you are also interested in any sort of hack job you can contact him via his mail- waynecyberghost@gmail.com
stephanietos 7y ago
I really loved him until he proved himself not worthy, i had to contact an hacker to help me get access to his whatsApp messages and track his phone. I didn't get what was expected as i got a lot worse for loving a man,i was depressed but it is okay now. Am really glad i listened to my sister and spied on him before it becomes too late. If you need help in your relationship, you can contact my hacker waynecyberghost @gmail.com tell him lilian referred you.....
PatrolX 7y ago
Class Action Lawsuit Filed: https://finance.yahoo.com/news/first-class-action-lawsuit-filed-110000081.html https://finance.yahoo.com/news/first-class-action-lawsuit-fi...

418 points by PatrolX 7y ago

It seems that the stock price (under the ticker FAF) hasn't suffered very much. This was revealed on 5/19, and the response has been tepid.There isn't likely going to be very much backlash on the stock, unfortunately.

rconti 7y ago
Markets are closed, down slightly after hours, but after hours volumes are weird.
PatrolX 7y ago
Mainstream media haven't picked up the story yet. It only just broke.
sp332 7y ago
I think that's May 2019, not May 19th. From the bottom: This entry was posted on Friday, May 24th, 2019
raesene9 7y ago
I don't think there will be, we're well into "breach fatigue" territory now, and here there's not even currently any evidence of malicious use. Unless/until this breach results in a large financial hit to the company (possibly via a class action suit) I doubt it'll have any impact and I'm not even sure a class action suit could show damages without evidence of misuse.
- PatrolX 7y ago
  Equifax's costs as a result of their breach have exceeded $1 billion now, and Moody's downgraded them a couple of days ago. I suspect this is going to hit First American pretty hard.
  - CyanLite2 7y ago
    Doubt it. There's no evidence yet that FA's leak was used by malicious hackers. The breach was discovered by some random other person who typed in a different parameter to a URL. Very likely that no one else would've known about it. Whereas the Equifax situation was intentionally breached by attackers and it can be assumed that the breach was used to capture information for later sale. I suspect that First American knew about this earlier this week and intentionally did a garbage dump on a Friday evening on Memorial Day Weekend. Maybe trade down a few tenths of a percent on Tuesday and their CISO will probably get axed. Nothing to see here, move along.
PatrolX 7y ago
The breach was revealed 6 minutes before I posted this. First on Twitter, then here.

raesene9 7y ago

By the sounds of it, another breach from a well-known, not new web application security vulnerability, "Insecure Direct Object Reference". That vuln has been an explicit part of the OWASP Top 10 since 2007... Unlike other common web app vulns (e.g. XSS SQLi) IDOR usually can't be fixed by a development framework (e.g. ASP.Net or Rails), it needs app. specific coding for proper Authentication/Authorization checks.

LinuxBender 7y ago

That is an incredibly low friction interface to our documents. /s What are the odds they have access logs going back to 2003?

PatrolX 7y ago
Pretty good, everything was probably set up and configured with default settings by that unpaid intern they had running their infrastructure back in 2003.
- 55555 7y ago
  default settings would wipe/rotate logs after some time, no?
  - krferriter 7y ago
    Rotate maybe, not wipe. As far as I'm aware for most webservers you have to tell it to rotate the logs based on some criteria, otherwise it just keeps appending. If debugging is turned off it's entirely possible that they have been appending lines to the same log file for the last 20 years and haven't run out of disk space which would cause them to notice. Say 200 bytes in the log per request, and even averaging 10000 (probably more than they get) requests per day, in 20 years that's only 13GB. It's also entirely possible they turned logging off or redirected to /dev/null in order to "be more efficient".
    - deleted 7y ago
      [deleted]
- zhte415 7y ago
  The organisation should have a data retention policy.

Nicksil 7y ago

>At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers’ information. is such a meme. Things will continue this way until there are serious repercussions for entities carelessly handling data.

PatrolX 7y ago
There was a repercussion a couple of days ago actually for Equifax. But yeah, maybe not serious enough to matter that much, I'm not sure what the outcome will be. https://www.msn.com/en-us/finance/markets/moodys-cuts-equifax-outlook-to-negative-the-first-time-cyber-attack-leads-to-downgrade/ar-AABKKTb https://www.msn.com/en-us/finance/markets/moodys-cuts-equifa...
saagarjha 7y ago
The next sentence too: > We are currently evaluating what effect, if any, this had on the security of customer information. It's downright dishonest to even say "if any": they were presented with concrete examples of leaking customer information; they don't get to wonder whether it had an effect on their security anymore.
- 55555 7y ago
  Yeah, considering that they have sent these URLs to at least tens of thousands of people, it would be hard to believe that nobody ever inappropriately accessed a document that didn't belong to them.

client4 7y ago

I did a penetration test for $NATIONALINSURER and they had an FTP site with weak credentials where all the remote offices uploaded claims. Millions of records and scans of SSNs, home addresses, bank information, etc. Their mitigating controls were: we put it behind a firewall. Then again I didn't expect much, their MSSQL in prod had SA/SA credentials active.

ownagefool 7y ago
I've seen Retail stores with revenues in the 10s of billions using Telnet for the POS clients in 2019. They also used FTP glaore and were worried about the security of cloud. :)
- PatrolX 7y ago
  Ditto. I've seen the same thing going on at an investment bank processing $350 billion / day in transactions.
- jeromegv 7y ago
  Wonder how many retailers there are that make 10s of billions
  - PatrolX 7y ago
    Around 20-25 I believe.
- ineedasername 7y ago
  I worked for <business imaging company X> where every network-connected copier automatically setup its own web server where unauthenticated users could peruse all of the jobs printed recently. Sure, a firewall might prevent public access, but it also wasn't hard to use Google's inurl: function to find the (at the time) 5% or so companies using these things that had public ip's assigned. You could also upload documents like PDFs to be printed out. Many of the high end fax machines had the same "feature". HP printers did something like this too, but that's not where I worked. EDIT: Oh, and the network controllers that ran them were uniformly updated and managed with fully open "admin" username no-password telnet and ftp services. IoT insecurity began a looooong time before the term IoT even existed.

snovv_crash 7y ago

At some point people will realise that holding large quantities of sensitive information is a liability, not an asset. Mindsets are slowly changing in this direction already. The chickens will continue to come home to roost until people treat digital security as seriously as physical security.

astura 7y ago
One must hold large quantities of sensitive data forever to operate in the title insurance and settlement services business.
hnaccy 7y ago
Unless they get punished or lose all their customers how is it a liability?
- seppin 7y ago
  It's not.
guitarbill 7y ago
Only if there are laws making it a liability, since investors don't seem to care much in the long term.
- rolltack 7y ago
  Laws won’t change this. It will only make it a compliance burden and the same mistakes will continue to happen. Plus standards and practices move way faster than laws. What investors should be concerned about is the reputational risk and loss of business to competitors that are able demonstrate more transparent and secure practices. Maybe laws for monopolies, but not for competitive markets where consumers have choice to shop around. For a competing business these dumps are a powerful marketing tool. It’s a direct client list. They just have to be able to show that their security is better. Laws would make things so much worse for everyone. The key is to keep hacking away at all systems. Break things apart and build them back together. And win customers by showing that you can!

throwawaymath 7y ago

Yet another security vulnerability caused by: 1. Using sequentially incremented integer sequences as object IDs, and 2. Failing to protect sensitive data using some kind of authentication and authorization check. This is becoming a trend with data breaches. Several of Krebs' other reports on behalf of security researchers were originally identified by (trivially) walking across object IDs on public URLs. My cynical take is that Krebs couldn't go public before this afternoon because First American wanted it to hit the news at an opportune time, then get ahead of it with their own messaging. Krebs got in touch with First American on Monday May 19th. The story is only just breaking now on a Friday afternoon at 5 pm; markets are conveniently closed for the weekend. I expect them to issue a hollow PR statement about valuing security despite being unable to act on security reports until an investigative journalist threatens to go public.

eganist 7y ago
(It's apparent that my initial reply didn't resonate, so I've made substantial edits to my reply for clarity's sake. If you've read it once, give it another read; it's from the angle of an organization with much in the way of legacy impairment.) > Yet another security vulnerability caused by... I mean, yes, but these are also some of the easiest vulnerabilities to miss even with out-of-the-box static analysis (code scanning and data analysis), automated dynamic analysis (pentests [edit to clarify for tptacek: automated pentests]), and a basic code review process. They're usually identified in live environments during manual penetration tests or, in more security-mature environments, with custom static analysis checks and custom linting rules. As for best-case prevention: accomplished generally architecturally, e.g. language/framework decisions that enforce secure coding practices by design, or implementing certain patterns in development which whisks away some of the more risky coding decisions from engineers who may not be qualified to be making them, such as mandating authn/z and limiting exceptions only to roles and change processes qualified to make them. Checks including linting for specific privacy defects (direct object referencing using sensitive data or iterative identifiers as opposed to hashes/guids/etc) can help with catching them during development, and as you might've guessed, such checks tend to be custom for a given environment rather than out of the box. I distinctly recall a card issuer whose name starts with a C in the United States having an http endpoint which allowed for enumerating account details by iterating full PANs (16 digit card numbers)... around a decade ago. Here we are today, and you're seeing the same bugs continue to arise. Mitigation options in organizations with immature security practices typically rule out remediation simply because their existence might not be known, and practices traditionally reserved for defense-in-depth may need to be relied-upon instead (think monitoring web requests for anomalous behaviors and blocking traffic when detected) rather than trusting that one can fix all the defects, and even then you'll still lose a few records... but that might be the only solution available to you as a CTO, CIO, or CISO simply because of resource constraints and bureaucracy in an entrenched org e.g. in the financial or insurance space. -- tl;dr: these defects are among the harder ones to catch for legacy applications especially in environments with weaker security postures, and they're as old as time. What I'm saying is that as much as we can call companies out for making these mistakes in hindsight, their existence in larger legacy systems is to some extent inevitable and must be managed in other ways.

zeroDivisible 7y ago

I like how this news was posted on Friday afternoon before the Memorial Day weekend.

awad 7y ago
Taking out the trash, as it were

angry_octet 7y ago

Whenever you are compelled to upload/send a photocopy of an ID document it is sensible to write the date and purpose / file reference on it. If it appears in a document dump at some later date you know the path and date of the leak.

OrgNet 7y ago
that is a good idea but most of the time I need to hand over my actual ID, and not just a scan of it
- ineedasername 7y ago
  Yeah, like most doctors offices will take my license with my insurance card, and they scan them into their own systems to associate with my record. No opportunity to insert my own add on content. Just hope whatever SaaS based patient management system they have is iron-clad secure. (But it isn't)
  - OrgNet 7y ago
    I guess you could stick a very small sticker on it
- angry_octet 7y ago
  I'm usually an uncooperative bastard at times like this. I ask them what their purpose is in retaining a copy of my identity document, and I ask for their privacy policy. When I'm travelling for work and a hotel asks I simply say no, and remind them I can lodge a complaint with our corporate travel provider that will have them delisted for future business; usually they come to their senses. For overseas travel (where they often have to fax your passport to the police) I ask for the photocopy back when I check out; since these documents are lost/misfiled regularly the desk clerk usually complies. Always try for point-in-time ID verification rather than retention.
  - nerdponx 7y ago
    Where do they ask you for a copy of your ID? I've never had that happen to me at a hotel.

dmix 7y ago

> He said anyone who knew the URL for a valid document at the Web site could view other documents just by modifying a single digit in the link. Good thing he didn't post this bug online after getting no response. I remember reading about someone who did that on an AT&T website a while back and was sent to jail for simply incrementing an id number in the URL and talked about it on Twitter.

luckylion 7y ago
That was probably about weev, and they were after him long before that case, so it's not likely that it would get some random person (that the FBI doesn't have a file on and an interest in picking up) in the same trouble.

gesman 7y ago

"First American has learned of a design defect in an application that made possible unauthorized access to customer data. At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers’ information..." Who is coming up with these statements? If you kept royally screwing something for years that you claimed to be your "highest priority" - then what can one expect from your normal lines of business?

jammygit 7y ago

Where does one go to learn how to not cause this one day?

krferriter 7y ago
OWASP Top 10 list. OWASP's website is kind of a mess in my opinion, but there are numerous external write-ups about the top vulnerability types. https://www.cloudflare.com/learning/security/threats/owasp-top-10/ https://www.cloudflare.com/learning/security/threats/owasp-t... Also this github repo maintained by OWASP seems pretty exhaustive. The cheatsheets directory has a lot of different vulnerability classes. https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.md https://github.com/OWASP/CheatSheetSeries/blob/master/cheats... This "Insecure Direct Object Reference" was recently combined into the "Broken Access Control" category with a few others.
- jammygit 7y ago
  Thanks!

zhte415 7y ago

A lot of discussion on technical side, but not from organisational. How could audit, both internal and external, not find this? 2003 to today is 16 years. Audit is a last line of defence and certainly not to be relied on upon as a buddy to catch your errors. But... how? This is a major financial institution in the most developed country in the world (the clue's in the name). It should subscribe to the the highest integrity and tightest scrutiny. This seems an opportunity for both internal and external auditors to tighten their game. Outside of audit, surely an employee might have noticed? Was there no formal method to speak up without fear of recrimination? According to Wikipedia [1] there are eighteen thousand employees. Someone never noticed? This seems an organsiational failing, not a technical one. [1] https://en.wikipedia.org/wiki/First_American_Corporation https://en.wikipedia.org/wiki/First_American_Corporation

TomVDB 7y ago
You can access documents all the way back to 2003. That doesn’t necessarily mean that this hole has existed that long.
- zhte415 7y ago
  Very good point.
toong 7y ago
And this is from a huge organisation. There are many more medium-large organisations that still operate under the Chinese-walls model: perimeter defense, but once you are inside the VPN/intranet the security is a lot more relaxed (if any). That is the security culture and very hard to change. The market forces those orgs to start offer services online. They run those (relaxed security) services inside their intranet, so they start poking holes in their firewall. The next decade is not going to be pretty in that regard.
- zhte415 7y ago
  I think you're correct, that these will become more common. A couple of years ago I was chatting with friends who were doing APIs, because of market/regulatory pressure EU's PSD2, exporting JSON of transactions using COBOL for use in online. Because that bank - almost an order of magnitude larger than First American in terms of employees - will do everything in order to not move off COBOL / it's legacy system. Interesting skill set: COBOL, DB2, JS, Angular.

reilly3000 7y ago

I just closed on my first house this week, and First American was of course my title company. I'll be interested to see if my data is included in this breach settlement or not. I did notice when I was reviewing my docs that they emailed links to unauthenticated copies of docs, but they were mostly public records so I didn't think twice about it. So they have my Name, address, email, SSN, copy of ID, copy of check from my bank with account/routing on it and much more, all in the open apparently. I just went through an SSO implementation with a small team for a large user base. It was a bigger project than we had anticipated, but nonetheless manageable. I can't fathom that a financial institution of that scale could be that lax with basic security. Wouldn't their systems be subject to some regulation and require some kind of audit on a regular basis? Is this a failure of auditing systems, as well as internal security or even basic IT?

JimmyDugan 7y ago

Programmers fault? Audits fault? Securities fault? Pentesters fault? It fault? Listen until C-level funds these programs properly and security is taken seriously by all issues like this will forever be in the news. I would be willing to bet their security like most have a long list of security gaps they cant get fixed because resource issues just hope they documented or it could fall on them. Most coding classes just teach how to make things work in Mister Roger's world. Secure coding is an elective! Most run the DevOps model instead SecDevOps and only involve security after it is ready to go into production no matter what flaws security finds. Why are black box pentests still taking place? Because company required to have pentest but really do not want testers to find things. Their goal is not to improve security rather check that box ... we had a pentest. C-level, this keep the lights on budget you give Security/IT is costing you more than properly funding us! Oh yeah you put that $ into cyber insurance! Lol let's see how well that works.

mjparrott 7y ago
If the financial penalty was high enough they would increase budgets. There is no accountability for losing customers personal information. If you can make a strong business case behind the average risk a company takes on it would help this discussion more. For each example of "company X had a major financial impact" you need to average it out against "company Y lost hundreds of millions of SSNs and had zero penalty".

JimmyDugan 7y ago

Lol everyone fights security and it is way under funded so can only get like 1 out of 100 risks fixed but must be securities fault.

JimmyDugan 7y ago

I see a lot of comments on sequential as the issue. Really is that the issue? Not the fact that John Doe can get to John Doe2 stuff without authenticating? WTF Sequential or not if no auth I can run a scanner and get it all so what the hell does that have to do with the price of tea in China?

deleted 7y ago

[deleted]

stephanietos 7y ago

Confront your cheating spouse with a clear and reliable evidence by meeting a legit hacker and private investigator, i was able to spy and monitor my cheating Husband day to day activities with my phone without having a direct access to his target phone and without him knowing.I never believe such could happen when I was looking for help during my divorce a lady talked about how this great man helped her out of infidelity on Discuss and contacted Wayne; it was like a magic under 30mins he sent me a code to dial in order to have access to spy my husband Instagram, Snapchat,whatsapp messages, what'sapp voice call and video calls,Delete Messages, Text messages, Email, Facebook, phone Gallery and other social media. I promise him to share this great opportunity and privileged to people out there especially to those people who might be facing a lot of tremendous challenges on infidelity and needed same help... Contact Wayne via the following....EMAIL: waynecyberghost@gmail.com , Tell him I referred you. He’s the only Ethical hacker with guarantee that will provide result and won’t expose your confidential data to anyone and will never Rip you off or disappoint you. He told me there is a refund policy if I found any of their services unsatisfactory but the joy is that I was satisfied with all the levels of services fast delivered and no Trace. Thanks so much to wayne Derick for helping me hack into my husband phone so i could see what is up to and i was able to caught him red handed, now i am out and a lot happier. credit goes to the earlier mentioned hacker for a good job. if you are also interested in any sort of hack job you can contact him via his mail- waynecyberghost@gmail.com

stephanietos 7y ago

I really loved him until he proved himself not worthy, i had to contact an hacker to help me get access to his whatsApp messages and track his phone. I didn't get what was expected as i got a lot worse for loving a man,i was depressed but it is okay now. Am really glad i listened to my sister and spied on him before it becomes too late. If you need help in your relationship, you can contact my hacker waynecyberghost @gmail.com tell him lilian referred you.....

PatrolX 7y ago

Class Action Lawsuit Filed: https://finance.yahoo.com/news/first-class-action-lawsuit-filed-110000081.html https://finance.yahoo.com/news/first-class-action-lawsuit-fi...