Equifax’s Maddening Unaccountability

Re:Equifax’s Maddening Unaccountability by codecamper on Monday September 11, 2017 @07:35PM (#15223426)

I just read about how the hack was done. Shockingly stupidly easy!

1. They realized that Equifax uses Struts. 2. They modified struts!

and 3. Equifax used the updated code on their servers.

DUUUUUHHHHHH!

[ Parent | on HN ]

Re:Equifax’s Maddening Unaccountability by Iknowsecurity on Monday September 11, 2017 @08:10PM (#15223649)

It is more: - Critical remote execution bug was discovered in Struts2. - The vulnerability goes public too quickly. - Hackers start scanning the Internet - Equifax is found vulnerable. - Vulnerability is exploited.

[ Parent | on HN ]

Re:Equifax’s Maddening Unaccountability by codecamper on Tuesday September 12, 2017 @03:57AM (#15225570)

$14 billion company cannot convert what the servlet API gives into a method call on a certain object + a bit of reflection to update methods & print them into form elements. Super complicate!

If the $14 billion can't do that then they certainly cannot protect data.

[ Parent | on HN ]

Re:Equifax’s Maddening Unaccountability by joefkelley on Monday September 11, 2017 @07:58PM (#15223598)

Do you have a source for 2? I'd like to read more about it.

[ Parent | on HN ]

Re:Equifax’s Maddening Unaccountability by codecamper on Sunday September 17, 2017 @02:33PM (#15270985)

a $ 14 billion company gives away the only secret data that they exist to protect. Why? Because they used Struts. How difficult is it to write a slimmed down, secure version of Struts?

[ Parent | on HN ]