Equifax Releases Details on Cybersecurity Incident, Announces Personnel Changes

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by rmrfrmrf on Saturday September 16, 2017 @01:08AM (#15263001)

If you look at the CVE, it's literally plain shell commands as strings in the Content-* headers. These commands would appear to be local with whatever user the app is running as.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by kelnos on Saturday September 16, 2017 @02:06AM (#15263163)

And that's the ridiculous thing: this is actually a fairly easy thing to protect against. Why the hell did the webapp servers have direct access to the database? If there was a service in the middle mediating requests, that would have been another line of defense. Sure, maybe _that_ service might have holes, but it'd be another hurdle the attacker would have to clear.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by rmrfrmrf on Saturday September 16, 2017 @11:04AM (#15264932)

As long as JNDI is a best practice in Java land, I'd say that the majority of Java app servers are directly connected to databases.

[ Parent | on HN ]

Re:Equifax Releases Details on Cybersecurity Incident, Annou... by kelnos on Saturday September 23, 2017 @06:09AM (#15319051)

Is it? I've been doing Java on and off for nearly a decade (with a brief foray into it in the early 2000s) and I had to look up what JNDI is.

[ Parent | on HN ]