(No Ratings Yet)

Loading...

• Facebook
• Twitter
• LinkedIn
• Mail

September 15, 2017 Comments closed

Cyber Security News Roundup: It Keeps Getting Worse for Equifax

in Industry Lowdown

Trouble keeps brewing for Equifax after its breach, including increasing reports of negligence and calls for jail time.

As per usual, we’re going to wrap up this week with a cyber security news roundup, but consider this the Equifax edition. Equifax, as you’re probably well aware, is one of the three major credit monitoring bureaus. It was recently revealed that over 140-million records were compromised after Equifax failed to secure its systems properly.

In the days since the initial news broke, things have only gotten worse.

Equifax Went Months Without Patching its Server

The vulnerability that was used to exploit Equifax was Apache Struts CVE-2017-5638. Apache Struts is an open-source framework for developing Java web applications. This particularly vulnerability was discovered on March 6 of 2017 and patched within a week. Equifax failed to follow up and patch its systems accordingly. Equifax learned of the breach on July 29, over four months after the issue had been patched. As a result of Equifax’s gross negligence, 143 million records – including full names, addresses, social security numbers and other personal identifying information – were exposed. If ever you needed a real life example of why keeping up with security updates and patches is important: this is it.

[Source: CBS]

Equifax Uses “Admin” as Login and Password for Database

Now that everyone’s scrutinizing Equifax’s lax security practices, other disheartening reports are starting to surface about other potential vulnerabilities affecting other areas of Equifax’s digital infrastructure. Case in point, the security firm Hold Security was able to retrieve employee information from one of Equifax’s Argentinian websites after a little guesswork unveiled that Equifax was using the word “admin” as both a login and password to the database. I can hear someone, somewhere, defending the mistake by pointing out that millions of people fail to update passwords and usernames from their default settings all the time. But the rules are a little different when you’re a major credit monitoring service storing information on millions of people. Once again, this is a pretty egregious mistake.

[Source: CNBC]

US Senator: Someone Needs to Go to Jail

A group of 36 US Senators is requesting that federal authorities investigate the sale of around $2-million in Equifax stock after the data breach had occurred. To many, including the Senators, that would be tantamount to insider trading. “If that happened, somebody needs to go to jail,” Senator Heidi Heitkamp, a Democrat on the Senate Banking Committee said. It may all be completely coincidental, but if it’s not then add another black eye to Equifax.

[Source: Reuters]

Your Credit Card Info Isn’t Worth Much

Though it may be a bit deflating to our collective egos, the one good bit of news about the Equifax breach is that our data really isn’t worth all that much. The price for a verified credit card – meaning it has been tested and is still working – is only about 10-20 dollars. Unverified cards sell for even cheaper, sometimes for just cents. For those interested (and that’s entirely a figure of speech, hopefully you’re not interested in anything more than an academic level), you can also purchase full identities – dossiers of personal, financial and geographical information that can facilitate identity theft – for just around ten dollars a pop.

Here’s What We Hashed Out This Week:

• TLS Interception Warnings Coming in Google Chrome 63
• Official: Google’s Final Plan to Distrust Symantec SSL Certificates
• Lenovo Settles with FTC for “SecurityFish” Incident

• #Breach
• #Equifax
• #News Roundup