Equifax blames breach on a server flaw it should’ve patched
Equifax’s latest update on its unprecedented security breach notifies the public that its investigation has found the cause of the theft. Along with an unnamed security firm (ZDNet and others have reported it’s Mandiant) the company confirmed rumors that attackers exploited a flaw in the Apache Struts Web Framework. That bug, CVE-2017-5638, was revealed in March, but the criminals were still able to use it against Equifax to steal personally identifiable information (PII – including names, birth dates, social security numbers and more) for 143 million people in the US in mid-May.
A failure to patch a known security hole becomes more believable after hearing about an egregious security hole discovered just this week. Brian Krebs reports on a situation discovered by Hold Security, where Equifax’s Argentinian website left administrator access (including databases of consumer’s personal information) guarded by the ultra-difficult user/password login combo of admin/admin. It allowed anyone to add or remove employee accounts for the system, as well as see their passwords by simply viewing the source of a webpage, or access the personal data of anyone (including DNI — their equivalent to a social security number) who had ever disputed a report.
The site was taken offline after Krebs notified Equifax, but the existence of such an easily-accessed security hole is troubling. According to Reuters, over 40 US states have joined a probe against the company, and its CEO is expected to testify before a House of Representatives panel on October 3rd.
Equifax – September 13, 2017
1) Updated information on U.S. website application vulnerability.
Equifax has been intensely investigating the scope of the intrusion with the assistance of a leading, independent cybersecurity firm to determine what information was accessed and who has been impacted. We know that criminals exploited a U.S. website application vulnerability. The vulnerability was Apache Struts CVE-2017-5638. We continue to work with law enforcement as part of our criminal investigation, and have shared indicators of compromise with law enforcement.2) Temporary interruption to credit freeze sign-up link.
Due to the high volume of security freeze requests, we experienced temporary technical difficulties and our system was offline for approximately an hour at 5PM ET on September 13, 2017 to address this issue. We apologize for any inconvenience.3) More details on consumer exemption from arbitration clause.
Questions continue to be raised about the arbitration clause and class action waiver language that was originally in the terms of use for the free credit file monitoring and identity theft protection products that we are offering called TrustedID Premier. We have removed that language from the TrustedID Premier Terms of Use and it will not apply to the free products offered in response to the cybersecurity incident or for claims related to the cybersecurity incident itself. The arbitration language will not apply to any consumer who signed up before the language was removed.
(28)
