Slashdot Mirror
Equifax Had 'Admin' as Login and Password in Argentina (bbc.com)
Reader wired_parrot writes: The credit report provider Equifax has been accused of a fresh data security breach, this time affecting its Argentine operations. The breach was revealed after security researchers discovered that an online employee tool used by Equifax Argentina was accessible using the "admin/admin" password combination.
Make Admin Great Again
At this point, Equifux is circling the drain. Time for those insiders to cash out.
What kind of moron working at a credit reporting agency fails to change the DEFAULT login and password. ? I hope that clown got fired
Another day closer to redwood heaven
This needs to be treated and punished the same as intent.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
That's the combination I have on my luggage!
Yep, oops.
There is no XUL, only WebExtensions...
If this turns out to be true, everyone from the CTO to the entire board of directors needs to go prison for a very long time and their entire net worth distributed to the people affected by this. I'm not talking country club prison here either, I'm talking real prison where poor criminals go. And no class action where the lawyers get it all, but an outright equal distribution to everyone affected. Then the class action can come in and take the rest of the companies assets and pass out the $5 gift cards and the millions to the lawyers.
--- Keep the choice with the user..
That's the same combination I have on my luggage!
Proud neuron in the Slashdot hivemind since 2002.
If this is the kind of internal stuff they have, they have no fucking business holding other people's data.
This is about as incompetent as you can get. Like epic incompetence. You're fired kind of incompetence. You should never have another fucking job in the industry kind of incompetence.
It will be hard to shield themselves from liability with that level of stupid.
I don't think you can single out one person, it seems as if there would be plenty of people to blame for not changing it.
My beliefs do not require that you agree with them.
Well it's at least better than a/a and b/b...
Those in the know will get a giggle about that one. :p
I mean we all know there is no such thing as 100% safe in information security but this is not even trying..
Second try, I guess Admin/password didn't work.
admin/password!
oooooowwwww
...... On the original hack being caused by something as stupid as this?
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
When will industry learn!
Equifax's head of security was an obvious diversity hire. Thank SJWs for your identity being stolen.
They keep oozing out L/Ps
I just laughed out loud! Let me guess, all of their routers are admin G3t0ut.
There's no money in Argentina anyways.
to some shitty Indian company or not?
Steve Gibson will have a field day with this one... I wonder how many more eggredious displays of a total lack of security practices it'll take to entirely close the thing down.
Really, I do want to work there!
I'll be a bloody genius there -- hell, even I know enough to change the login combo to "admin/equfax" -- and they'll pay me well for such brilliant security insights.
Oh, but wait.
Now that people -- and even chat-bots -- are suing them blind over this mindless security breach, I'm thinking that maybe there won't be a company left when they're through.
...but stupid goes right to the bone.
E Proelio Veritas.
At first I thought, man that is TOO secure, keeping the admin password only in Argentina.
Then I understood what the headline was trying to say...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
surprise
How else are they supposed to remember the password?
as your chief security officer, what else do you expect? My old program manager at Microsoft had a psychology degree, so he was just terrible. He also fought for years against using email. Of course when you have people that either don't understand or don't like technology in charge, you're just going to get what you expect.
this dumbfuckery? Get on it people!
It's simple really. The reason is that nobody in the organization is actually responsible for it. You can't really point the finger at any one person and say, "You didn't make this thing happen" because there is nobody in that office whose job description (if they even really have one) actually says they are responsible.
I've worked for places like this. When the managers are all clueless and the employees all underpaid, things that should obviously get done, just don't. If the bosses don't know, and the workers don't care, it's a recipe for disaster.
Unfortunately, I'd say that mismanagement is pretty much the standard in most businesses, but the degree to which they are mismanaged varies.
And they are entrusted with your financial information. Fucking Idiots!
A review of those accounts shows all employee passwords were the same as each user’s username.
So the most important question is: what shitty software did Equifax implement that does not have rudimentary password control features?
Cause there's bound to be plenty more of whatever it is around, and we should shut that shit down FAST !!!!
SEI an investment company in the US had computers under the security department control using sysadmin as the password for its security monitoring computers when the head of security was confronted about this the person who found it was fired! Companies don't care about security they make the users change passwords every 60 days and then install software that requires root communication between servers that do not use passwords.
You can only fire them.
*Ahem* I pretty much said as much previously. It's exciting to imagine a cabal of hackers doing things like this, however reality more often than not is just incompetence.
https://slashdot.org/comments....
Once again this proves that there is no technological solution to stupid human problems.
OTOH, a simple rule in the username/password database that prohibits admin/admin and other similar things like root/root could help. But then you'd just have people using their birthday or somesuch.
The truth is, I never left you
All through my wild days, my mad existence
I kept my promise
Don't keep your distance
And as for fortune, and as for fame
I never invited them in