Equifax Releases Details on Cybersecurity Incident, Announces Personnel Changes

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by sillysaurus3 on Friday September 15, 2017 @09:07PM (#15262164)

Yep. You can do all that. At the end of it, a box somewhere needs to be able to access the data. That box has access. You handwave it as single-person-at-a-time queries. But on any given day, they have to run tens or hundreds of thousands of those queries. Even if people aren't accessing their credit info, there is plenty of automation that does. Meaning if you pop that single person query box, you can scale up the queries by a factor of ten without raising any flags directly.

It's much better, certainly. Companies should do that. But it's not obviously a panacea.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by lowbloodsugar on Friday September 15, 2017 @09:14PM (#15262197)

Conceivably, the attackers spent the 75 days downloading the 143,000,000 records, 2,000,000 records per day, and managed to trigger no scaling alarms as a result. Or perhaps there were no alarms. I wonder if we'll ever know.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by AlexCoventry on Friday September 15, 2017 @10:33PM (#15262503)

Given the vagueness of their statements about the 143M records which "may" have been affected, it seems likely that they weren't logging the relevant queries in any useful way, and that is definitely an architectural failure.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by closeparen on Friday September 15, 2017 @10:30PM (#15262489)

TFA says Equifax learned of the breach by detecting anomalous traffic. I'd say there was an alarm, but it didn't do anything to actually stop the attack.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by sova on Friday September 15, 2017 @10:29PM (#15262488)

75 days? The report by Equifacks makes it sound like a one day delay from attack to taking the machine offline. Sneaky language.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by mdpopescu on Saturday September 16, 2017 @09:48AM (#15264624)

I worked for a company that was doing at least 100k credit checks each day. A lot of it was batched - we would get a file with 25k records and had to process it and send back the results (usually HTML reports and/or decisions based on them).

What I want to say is, it wouldn't surprise me to hear that the three main bureaus process millions of requests per day.

Oh, and also - all bureaus were replying to a request in less than a second. Quite impressive.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by sillysaurus3 on Saturday September 16, 2017 @12:40PM (#15265374)

Thank you for backing up my claim with data. I was admittedly making an educated guess, but there was a nagging "hundreds of thousands? Are you sure?" feeling.

This underscores the importance of figuring out a better architecture. And not just for credit bureaus.

It is remarkable how resistant people are to the idea that you need to be patient while the world changes. Everyone is out for blood and gives not a fleeting thought about what would come after such a purge.

[ Parent | on HN ]