4 ms·

Am I reading correctly that Krebs gave the vendor three full days (of which at least three are not working days), over the Christmas holiday to patch this befor

by lol768 4y ago

Am I reading correctly that Krebs gave the vendor three full days (of which at least three are not working days), over the Christmas holiday to patch this before disclosure on Mastodon? I can understand (but not necessarily agree) with arguments for full disclosure when the consumer has a choice to avoid using the vendor .. but, in this case?

lapcat 4y ago
No, what Krebs said was "So it's Dec. 27, and I still haven't heard anything from Experian." In other words, they haven't even responded to his report.
0ct4via 4y ago
Given the gravity of the issue and the supposed standing of the vendor, 3 days should be plenty time to at least respond -- working days or not. Additionally, Krebs has stated that Experian has yet another glaring security issue. He's not saying exactly how to do it, or dropping POC in the post. Given the size and importance of Experian, there's nothing wrong with pointing out this issue, especially when after 4 days they can't even acknowledge an issue this serious. Krebs stating a vulnerability exists, is more responsible than not disclosing it -- given their importance, and history of security screw-ups, the people have a right to know.
- jameshart 4y ago
  But it’s not three arbitrary days, is it? It’s December 24th, 25th and 26th, none of which are working days in the US, and which encompass one of the biggest global holidays of the year.
  - eli 4y ago
    Surely they should be staffed to mount at least a minimal response to security incidents even over holidays? A malicious actor wouldn’t wait until business hours.
    - jameshart 4y ago
      Do you just love the idea of ruining someone's Christmas?
      - friesandties 4y ago
        Experian is here to ruin everyone’s Christmas, that is kind of their gig to be Scrooge. Not a big Krebs fan, but I do enjoy watching him go against some of these big guys with a “Too bad, so sad” mentality. I can’t imagine having to tell someone that what I do for work is track an indebted populous, eck.
      - deleted 4y ago
        [deleted]
      - eli 4y ago
        You’re aware that most people in the world don’t even celebrate Christmas?
        jameshart 4y ago
        So? Christmas is a public holiday in 80% of countries. It is by some distance the most widely shared global business holiday. And Experian is an American company.
        eli 4y ago
        It's a global company and yes some people have to work on holidays. Info Sec for a business like Experian absolutely necessitates 24/7 coverage. I can't believe this is even a debate.
        jameshart 4y ago
        There’s a big difference between getting paged over the holidays for a real incident vs getting paged because Brian Krebs wants to make some internet drama.
    - deleted 4y ago
- darkhelmet 4y ago
  Unfortunately, this issue lowers the bar for exploiting a months-old vulnerability. The older ongoing problem is that any person can create a new Experian account with a new email address, and answer a few credit-related quiz to take over somebody's credit file. When doing this Experian will helpfully even offer to unlock the credit file and you can reset security questions etc. All without the consent of the victim. All the "security" systems are bypassed. This new vulnerability means you need even less information to take over somebody's credit/identity. You can get the answers to their quiz directly from Experian's own systems. That makes it a bigger deal.
aaomidi 4y ago
To give you an idea, when you’re operating a CA, you only get 24 hours to respond to this type of stuff. Experian had 72.
jameshart 4y ago
It doesn’t look like an actual disclosure, in that he isn’t explaining how the exploit works, just sharing that it exists.
matheusmoreira 4y ago
I thought he was extremely nice to wait that long. That's 72 hours more than these abusive corporations deserve. I actually wish these people would just publish these vulnerabilities out of nowhere to force them to deal with it or go bankrupt from liability. Any damage caused by such "reckless" disclosures isn't severe enough punishment for their surveillance capitalism business even existing in the first place. There should have been no data to be compromised in the first place.

by lol768 4y ago

lapcat 4y ago

No, what Krebs said was "So it's Dec. 27, and I still haven't heard anything from Experian." In other words, they haven't even responded to his report.

0ct4via 4y ago

Given the gravity of the issue and the supposed standing of the vendor, 3 days should be plenty time to at least respond -- working days or not. Additionally, Krebs has stated that Experian has yet another glaring security issue. He's not saying exactly how to do it, or dropping POC in the post. Given the size and importance of Experian, there's nothing wrong with pointing out this issue, especially when after 4 days they can't even acknowledge an issue this serious. Krebs stating a vulnerability exists, is more responsible than not disclosing it -- given their importance, and history of security screw-ups, the people have a right to know.

jameshart 4y ago
But it’s not three arbitrary days, is it? It’s December 24th, 25th and 26th, none of which are working days in the US, and which encompass one of the biggest global holidays of the year.
- eli 4y ago
  Surely they should be staffed to mount at least a minimal response to security incidents even over holidays? A malicious actor wouldn’t wait until business hours.
  - jameshart 4y ago
    Do you just love the idea of ruining someone's Christmas?
    - friesandties 4y ago
      Experian is here to ruin everyone’s Christmas, that is kind of their gig to be Scrooge. Not a big Krebs fan, but I do enjoy watching him go against some of these big guys with a “Too bad, so sad” mentality. I can’t imagine having to tell someone that what I do for work is track an indebted populous, eck.
    - deleted 4y ago
      [deleted]
    - eli 4y ago
      You’re aware that most people in the world don’t even celebrate Christmas?
      - jameshart 4y ago
        So? Christmas is a public holiday in 80% of countries. It is by some distance the most widely shared global business holiday. And Experian is an American company.
        eli 4y ago
        It's a global company and yes some people have to work on holidays. Info Sec for a business like Experian absolutely necessitates 24/7 coverage. I can't believe this is even a debate.
        jameshart 4y ago
        There’s a big difference between getting paged over the holidays for a real incident vs getting paged because Brian Krebs wants to make some internet drama.
  - deleted 4y ago
darkhelmet 4y ago
Unfortunately, this issue lowers the bar for exploiting a months-old vulnerability. The older ongoing problem is that any person can create a new Experian account with a new email address, and answer a few credit-related quiz to take over somebody's credit file. When doing this Experian will helpfully even offer to unlock the credit file and you can reset security questions etc. All without the consent of the victim. All the "security" systems are bypassed. This new vulnerability means you need even less information to take over somebody's credit/identity. You can get the answers to their quiz directly from Experian's own systems. That makes it a bigger deal.

aaomidi 4y ago

To give you an idea, when you’re operating a CA, you only get 24 hours to respond to this type of stuff. Experian had 72.

jameshart 4y ago

It doesn’t look like an actual disclosure, in that he isn’t explaining how the exploit works, just sharing that it exists.

matheusmoreira 4y ago

I thought he was extremely nice to wait that long. That's 72 hours more than these abusive corporations deserve. I actually wish these people would just publish these vulnerabilities out of nowhere to force them to deal with it or go bankrupt from liability. Any damage caused by such "reckless" disclosures isn't severe enough punishment for their surveillance capitalism business even existing in the first place. There should have been no data to be compromised in the first place.