Slashdot Mirror
Equifax Website Hacked Again, this Time To Redirect To Fake Flash Update (arstechnica.com)
For several hours on Wednesday Equifax's website was compromised again, this time to deliver fraudulent Adobe Flash updates, which when clicked, infected visitors' computers with adware that was detected by only three of 65 antivirus providers, reports Dan Goodin at Ars Technica. From the report: Randy Abrams, an independent security analyst by day, happened to visit the site Wednesday evening to contest what he said was false information he had just found on his credit report. Eventually, his browser opened up a page on the domain hxxp:centerbluray.info. He was understandably incredulous. The site that previously gave up personal data for virtually every US person with a credit history was once again under the control of attackers, this time trying to trick Equifax visitors into installing crapware Symantec calls Adware.Eorezo. Knowing a thing or two about drive-by campaigns, Abrams figured the chances were slim he'd see the download on follow-on visits. To fly under the radar, attackers frequently serve the downloads to only a select number of visitors, and then only once. Abrams tried anyway, and to his amazement, he encountered the bogus Flash download links on at least three subsequent visits. Update: Equifax said on Thursday it was taking one of its web pages offline as its security team looks into reports of another potential cyber breach.
It just keeps getting better!
Surely the definition of stupidity is when you keep on doing the same thing and expect different results?
to make it very clear: Equifux are scum. DANGEROUS scum. Don't go there! Not now. Not ever.
THIS MEANS YOU!
Sent from my ASR33 using ASCII
Is this the story that never ends?
I don't read AC
This sounds suspiciously like a DNS poisoning attack, which could have been impacting his ISP, but targeting a domain used by Equifax. Such attacks are completely outside of the control of the target. https://en.wikipedia.org/wiki/DNS_spoofing
Can't wait until Adobe kills Flash in 2020 and everyone moves away from that piece of garbage.
Any private citizen who would commit a tiny, insignificant fraction of this kind of blunder would be behind bars, with his assets seized. What is so special about a company that should have been shut down weeks ago?
And why is that CEO still at large?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If you're a comedian, it's good for more material than even Trump currently.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If corporations are people, it is time to jail Equifax.
What i would suggest is that the entire IT staff and C_O group repeat after me
"Would you like me to tell you the Daily Specials?"
"Would you like fries with that or Maybe upgrade to Our new LOADED FRIES"
At this point you have to wonder if it isn't time to revive the idea of a corporate death penalty.
How long would anyone keep doing business with an armored car company that keeps forgetting to lock the doors? What's Equifax's excuse going to be this time?
CUR ALLOC 20195.....5804M
You people act as though Equifax is made of money that they can lavishly spend it on securing the highly sensitive financial data of consumers who never gave the company authority to collect and share it in the first place. Equifax only made $3.1 billion last year; they have a lot of wealthy shareholders and executives whose lifestyles depend on a high revenue to profit ratio.
Sure, Equifax was the subject of more than 57,000 consumer complaints to the Consumer Financial Protection Bureau from October 2012 to September 17, 2017 with most complaints relating to incomplete, inaccurate, outdated, or misattributed information held by the company, but that could happen to anyone. /s
I'm more shocked to know there's 65 antivirus providers. Is Windows really that bad?
#DeleteFacebook
n/t
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
So... was the CEO's info also included in the breach?
You know what would be an ironic rebalancing of the cosmos?...
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
My opinion? This is what happens when you have BEAN COUNTERS and PAPER SHUFFLERS making engineering decisions, instead of engineers and other educated, qualified personnel!
So, what do we do now? The management at Equifax has now proven beyond any reasonable doubt that they are completely incompetent, totally incapable of being responsible for the data they collect. Who takes over? Can the government come in and take control? Or would that be worse? Who needs to be in charge at Equifax to stop the bleeding and secure their systems?
Furthermore: The incompetence now evident should, in my opinion, be considered criminal negligence, considering how many people are affected, and by 'affected' I mean 'potentially or in fact having their lives RUINED'. Round up the management at Equifax, everyone who was responsible for the decisions that led us to this point, put them under arrest, and bring criminal indictments against them. I'd much rather prefer severed heads on poles lining Wall Street, but we don't do that sort of thing in this country so I'll settle for mandatory jail time, megafines, seizing of assets, and court orders prohibiting these idiots from ever working in the finance industry ever again -- or anywhere else that can affect the lives of hundreds of millions of people. I'm sure Walmart would just love to have them as greeters, or maybe the Jiffy Lube down the street will hire them.
It doesn't sound like it mattered what the OS was - there wasn't an OS-level compromise (and there didn't need to be, because they did no compartmentalisation of their entire system, so once you'd compromised the web server you had have complete control over all of the data).
I am TheRaven on Soylent News
Why would we keep using C and C++ when there's a better language out there in the form of Rust?
Because there exist many non-PC platforms to which a C compiler or a C++ compiler has been ported but a Rust compiler has not. How would you even bootstrap stage 0 of a Rust compiler on a new ABI if it's written in Rust and there are no other independent implementations of Rust? My best guess, which I haven't tried, is to go back to some OCaml compiler, build old Rust, and then build new Rust from that.
Equifax has been controversial since it was started in 1899 to serve retailers who wanted to extend credit to customers. Their existence and business practices spawned a few laws.
It's an inherently unethical business.
But here is some bad karma coming there way: Years ago, I was at a talk that had an Equifax exec on its panel. They have to put up with the same shit as we do (there is also Experian and Transunion that also fucks everything up). But she is able to clean stuff up internally fast for herself and family.
We have to write in, call into their Indian call center and hand over all of our personal information and get the run around for months.
So, what I'm doing is to make Equifax' existence as miserable as possible. Letters to congressmen. Support of Elizabeth Warren. and other things - all legal.
I want to see them running in the red for as long as I can.
And, if I am damaged in any way, I'm gonna try to sue them AND the people who used their services because they should know better.
Credit doesn't go through? I'm suing Equifax and the lender.
Insurance? Same as well as a complaint with the insurance commissioner.
Background check? employer, their background check company and Equifax.
Make doing business with Equifax a liability.
Everybody says that about every new language, every new technology, every new half-baked fart out of Silicon Valley. But Rust wouldn't of stopped the LinkedIn breech. That was the doing of idiots that stored plain text passwords in the database. Rust won't stop the noobs.
Sig. Sig. Sputnik
Trump did nothing wrong. When he gets us to the moon for real you'll eat your words.
Microsoft's market share is vast, diverse, and spread out geographically.
No single Antivirus meets the needs of every user or business. You've got home users who need simplicity, you've got business users who need manageability, you've got gamers who need performance, and developers who need control. You've got different countries with different language needs. You've got your for cost, and your freeware. Finally you've got up starts and Open Source options. Etc. Etc.
What is more surprising is when there are not 65 competitors in a particular market, such as Media Player / Store / Streaming client, or Office Suite, or Credit Bureau, etc.
I suppose the biggest reason why an Antivirus can have 65 competitors is that there is no need to move data from one installation of another, so no need for any uniform standards or compatibility.
A "corporate" death penalty just means the company is dissolved, and the shareholders lose money (capital). But the individuals responsible for causing the problems in the first place just dust off their resumes and go to work for other companies. It may may you feel better, but it doesn't accomplish anything. And in fact it may makes things worse because (assuming this corporation was egregiously worse than its competitors) the bad guys who caused the problem are now scattered throughout hundreds of different companies instead of all concentrated in one place that you can avoid or be extremely cautious around.
You have to understand that a corporation is just a paper entity. It doesn't really exist. A bunch of people decide to work together instead of as individuals, and "the corporation" is just a dotted line drawn around that group of individuals. It exists because although Bob and Frank want to work together, Bob doesn't want to be personally liable for Frank's screwups and vice versa. To really effect change, you need to allow gross negligence like this to pierce the corporate veil, and punish the individuals responsible for the bad decisions with fines and jail time.
Huh, I thought we had already been there a couple of times last century. Or was that fake news too?
I understand the purpose of credit reporting agencies, and I don't have a blanket hatred or dislike of them like some people. (Hey, sorry if you're irresponsible with your money all the time and don't pay your bills when due. That doesn't make the "messenger" evil when they perform the function of warning others about your financial behavior.)
But Equifax? They've long been frustrating because of a lack of care in verifying the data they collect, and a general unwillingness to correct mistakes on credit reports. Inability to secure all of this sensitive information they've collected is icing on that cake.
Look at some of the nonsense they partake in, such as giving you "ONE free look at your credit report per year". That's YOUR info they've collected and make money off of, and they don't even want to show YOU what they've got unless you pay like everybody else? As far as I'm concerned, I should be able to create an account with these people where I can log in and see my credit report ANY time, as well as submit online requests for changes whenever I see something wrong or questionable. I know Equifax and one of their competitors had wrong information about the history of addresses I lived at previously, and neglected to fix it, even after multiple requests. (It seems they don't consider that part of the content of a credit report that could potentially hurt your credit score, so it's not a priority to correct.) If it's worth keeping track of though, it's worth keeping track of correctly, IMO. Don't lie to everyone pulling my report, giving a bogus street address I supposedly resided at (which was obviously due to a typo somebody made at some point, since the street is fairly similar to the name of one I actually DID live at previously).
Practically speaking this is years away from happening even if everyone stopped working on every line of legacy code in non-Rust projects. Meanwhile, no computer language can prevent programmers from misunderstanding requirements or goofing up an implementation, so there are bound to be bugs in all new software in Rust that might not be obvious security issues, but could cause more subtle issues, both in usability and security. Does Rust, by default, somehow prevent a programmer from making a web browser vulnerable to XSS? Does it prevent web developers from building flawed APIs that spill data all over the place? Does it force anyone implementing a database to NOT store actual passwords, but to properly salt and hash them before storing?
I do not have a signature
The OS only matters if you can't do the work at the application level. Java could have been involved, but only because jvms are so common. Otherwise it would have needed to be some non-virtual machine language, like C or some such.
The thing is, if you can compromise a web application sufficiently to allow you to download and execute a binary, and you have your data available at the account that's contacting the web, no further security breaches are needed to have EVERYTHING copied over. Or erased. Or selectively altered. The bastards who encrypt all your data aren't doing the worst thing that they could, merely the one they find most profitable. (I wonder how often they send an actual decryption key after payment...and how often the acceptance of payment is the last you hear of them.)
I think we've pushed this "anyone can grow up to be president" thing too far.
The problem is IT security is so complex, that most regulations would either be ineffective: because the nature on how the hacks happen will change, overly punitive: where hacks could be used to kill a company, or a company would be afraid to use computers to expand their business.
Claiming that a problem is complex is not a valid excuse for doing the job incompetently such that it results in harm to others. If you cannot manage sensitive data safely then you either need to exit the business or step your game up. They do not get a free pass just because it's a hard problem. If the security problem is that hard that they need government indemnification then they DEFINITELY need to be regulated. Medicine is easily as if not more complex than IT security and yet doctors are held liable for malpractice and are highly regulated. I see no reason why ITprofessionals should be held to a lesser standard of care if they want to manage sensitive data like credit histories or medical records.
Regulations don't have to specify specific technology or tactics. They just have to specify that they have to keep the data secure, what secure means, and outline punishments for failure to do so. If they cannot handle the risk then don't get into the business.
My opinion? This is what happens when you have BEAN COUNTERS and PAPER SHUFFLERS making engineering decisions, instead of engineers and other educated, qualified personnel!
I am an engineer and I also happen to be a certified accountant. I can assure you that engineers do not as a general proposition make better (or worse) business decisions than any other category of worker. The problem at equifax was NOT an engineering failure, nor did it happen because engineers weren't making engineering decisions. It was a failure of company culture and a lack of risk controls. The engineering flaws that were exposed were simply predictable knock-on effects of the poor business controls.
Don't get me wrong, I think that upper management at Equifax should find themselves in front of a judge as soon as possible. This was a failure that went FAR beyond mere incompetence. I think that Equifax should be buried under an avalanche of lawsuits and probably cease to exist because they clearly cannot be trusted to handle sensitive data with appropriate levels of care.
... into installing crapware Symantec calls Adware.Eorezo
This sentence doesn't parse. Why "calls ..." after the crapware's name?
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Even if you can cross-compile, you can't ensure that the cross-compiler binary is free of Ken Thompson's self-propagating "trusting trust" attack unless you bootstrapped it from an independently developed compiler.
every time you apply for credit or a bank account you've signed something that gave Equifax the right to collect your data. Read your agreements and if you don't like it don't sign it.
This is the philosophy of "You always have a choice". It's popular with the right wing, libertarians, corporations and the Republican party. You can try pointing out that it's not possible to find a bank or credit card that doesn't do business with Equifax and also impossible to live without either but I've found those arguments fall on deaf ears. If pressed I've had some of the "You always have a choice" crowd come out in favor of slavery. I really don't have an answer to that.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
they're a vastly powerful company. For a lot of people if you want to do business you have to do it with Equifax. Tell them to do otherwise and you you might as well tell somebody living in the 12th century not to bother with their local guild system. We live in the world we live in and not the one we want to.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
(I wonder how often they send an actual decryption key after payment...and how often the acceptance of payment is the last you hear of them.)
If you're referring to ransomware, the vast vast vast majority is just a scripted turn-key system. Set it and forget it. If word got out you didn't decrypt, nobody would pay, and nobody is looking at the data that got encrypted, that would leave a trail back to the culprit. So it's almost 100% of the time you pay, you get the key, and so long as you don't do whatever got you automatically infected in the first place again, you won't be re-infected. Just business.
No way, didn't you read the GPL? There's no express or implied warranty of any kind, and the code is not certified as fit for any purpose!
Eventually, his browser opened up a page on the domain hxxp//:centerbluray.info
a) That's (almost) a URL, not a domain
b) What's with the "hxxp"?
c) The : is in the wrong place
systemd is Roko's Basilisk.
One might argue that a "malware researcher" might already be at increased risk of having already contracted some sort of exploit that might manifest as a malicious redirect.
Then again, where Equifax and their recent security fumbles are concerned, it's certainly within the realm of possibility that such an exploit found its way into their services. Unless there's an independent and unbiased analysis of the Equifax systems and protocols, it's unlikely we'll ever be certain.
So you're giving credit entirely? Good for you! But, ah, have "fun" getting a rental car next time you travel...
Oh, and you'll also need to give up use of the entire banking system. And maybe move to North Korea and renounce your citizenship. THEN you'll no longer be in the Credit Slander Bureau's databases. Maybe...
Hey, I bet a lot of people would not mind shooing him on the moon.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
There aren't dozens of damning new plagues daily that everyone has to take medicine for or they die.
Not sure what planet you live on but there literally are new diseases every day (ever hear of mutations?) and people do literally die from them. Every day, all around the world. Diseases like influenza and malaria are constantly mutating and overcoming even our best attempts to shield against them. And unlike you I'm not talking about a figurative death either. Literally millions of people die - literally die - every year because of new versions of diseases that our immune systems and medical technology cannot cope with.
IT security is a tough problem and I'm not diminishing it in the least. But spare me the dick measuring contest where you try to arrogantly assume that what you think you understand about IT security makes it more difficult than what other fields do or that the consequences are greater. If you seriously believe that medicine isn't as difficult as IT security then frankly I think you are an imbecile who doesn't really understand either field.