Re:Equifax’s Maddening Unaccountability
by cloakandswagger on Monday September 11, 2017 @08:23PM
(#15223727)
The statement released by Apache said that, if the attack did use the REST plugin vulnerability in Struts, then it would have been a zero-day at the time of use.
You will note that Equifax is not a contributor to Struts - cash or code. They are trying to shift the blame onto something they got for free and work other people did for free.
Re:Equifax’s Maddening Unaccountability
by elkos on Wednesday September 13, 2017 @01:06AM
(#15235706)
It's my understanding that Equifax is a multibillion dollar org. (Something in the order of 17 billion USD). Since Struts is a major part of their business infrastructure one would expect a contribution to the Struts project and other software they rely on. They could spin it as "Social Responsibility" too.
In retrospect it seems more cost effective to do so too, even if Equifax manages somehow to pay only a few hundred million dollars.
If the vulnerability used turns out to be the Struts one that was announced at the beginning of the year, then the "magic" here would have been quite muggle-like: update the damn dependency. Not doing so is negligence, plain and simple.
(I agree with you, though, that EFX will almost certainly come out of this relatively unscathed.)