How Equifax Was Breached in 2017

Re:How Equifax Was Breached in 2017 by tekla on Thursday September 21, 2023 @10:59AM (#37598641)

> an audit should include scanning all files for passwords

Please continue taking the security course. Scanning all files for passwords is madness. How do you differentiate "thisissupersecret" and "123fqfqlfni34235r4" and "[email protected]" as passwords? You can't, they're all valid passwords for a majority of services.

At some point, you need to trust developers to do the right thing, which is impossible.

[ Parent | on HN ]

Re:How Equifax Was Breached in 2017 by blisterpeanuts on Thursday September 21, 2023 @11:18AM (#37598938)

You're right, but I was thinking of searching for known passwords. For example, if an Oracle db accessed by developers is tekla / tekla1234, then scan for the string "tekla1234". It should not exist in any file. If it exists in a file, then obviously that is a potential leak.

[ Parent | on HN ]

Re:How Equifax Was Breached in 2017 by JamesSwift on Friday September 22, 2023 @02:53PM (#37616134)

And where do you intend to store these "bad" passwords in order to scan??

[ Parent | on HN ]

Re:How Equifax Was Breached in 2017 by ponyboy123 on Saturday September 23, 2023 @03:06AM (#37621214)

Don’t be so mean to the guy.

One approach would be to have passwords of a known format, that are rotated frequently, and to verify that you’re not finding any strings matching those patterns save to disk or in log files, etc.

[ Parent | on HN ]