Slashdot Mirror
After Equifax Breach, Major Firms Still Rely on Same Flawed Software (zdnet.com)
Last year's massive data breach at Equifax should have been a wake-up call for the entire industry. But a year after the patches were released, some of the world's wealthiest companies are still using, or have since introduced the same flawed software. From a report: Thousands of companies have downloaded vulnerable versions of Apache Struts, a popular web server software used across the Fortune 100 to provide web applications in Java. It's often used to power both front- and back-end applications -- including Equifax's public website. The bug used in the Equifax hack was fixed in March 2017, but Equifax never installed the patches. Since those patches were made available, data seen by ZDNet shows that least 10,800 companies downloaded vulnerable versions of the software. The data, provided by Sonatype, an open-source automation firm, shows that over half of the Fortune Global 100 are using vulnerable versions of the software. Although the firm wouldn't name the affected companies, a quarter of them are based in North America. The data showed that seven are tech giants, and 15 are financial services or insurance firms.
A data breach may cost money later, but changing would cost money now, which is all stock holders care about.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
This behavior is very logical. Equifax got away with gross negligence in the area of data security. It follows that expenditures on data security can be minimized. Updates and technical expertise costs money, market-driven approach would be to keep already paid-for systems in place and outsource maintenance of these old systems to the lowest bidder.
How many Equifax executives have gone to prison?
Put them in chains, and other executives might notice.
One problem is that companies continue to run software that was built as a one-off by some consulting company, offshore vendor or similar. They either don't exist anymore, or want millions to even look at the code again.Those packages need these out-of-date frameworks and other software as dependencies, and the company doesn't have the expertise in-house to know whether a patch will break something. In my line of work, the main offender is awful Java thick client applications, and these often require a _specific_ point release of some horribly outdated JRE/JDK. But JEE web apps are even worse in this regard...and despite the hype around app-of-the-month, there are TONS of these systems from the 2000s floating around in big companies.
Consulting companies should be required to at least hand over the source code for software they produce if they're not interested in maintaining it long-term as an actual product. And if a company is relying on some system as a dependency, they shouldn't allow their vendors to walk away without fully understanding what they've left running on their systems.
Funny how the completely open source Apache Struts framework never got any of the blame in the Equifax hack.
And don't give me the usual "but the vulnerabilities were fixed before the hack happened!" Because if that was true then only zero-day hacks of any system could count and despite the propaganda those attacks are quite rare.
AntiFA: An abbreviation for Anti First Amendment.
(or some other ill-conceived and bloated atrocity that will never receive security updates because they cost too much money)
Was this flawed software deemed "non-complaint" by a government regulatory body of some sort after the Equifax breach?
No?
Well, then, why the hell would you expect things to change? The financial sector isn't going to do anything that costs money or time that doesn't personally benefit them unless you force them to.
Maybe you read before you crappost. It was STRUTS. Insecure versions unpatched for months.
"..10,800 companies downloaded vulnerable versions of the software."
10,799 of them were security companies trying to male a name for themselves.
All jokes aside, I'm sire most of these companies are downloading the vulnerable versions of the software for specific comparability needs and only patching security issues. If done before production this process is entirely industry standard and acceptable for larger slower moving companies. Sure makes for a scary sounding title for an article though.
I am American and the witch hunt against equifax is ridiculus. Never before has any company been under so much scrutiney. All companys use sometimes flawed softwares but only equifax has libtards and leftist agitators on sites like Slashdot.Org calling for violence against them. Shameful.
faa level code audits cost way to much to do. and also why should the 1099 or H1B risk being fired / kicked out by not signing off.
All they showed was how many downloads, not how many implementations. I'm sure my company has downloaded a copy of the software too, we use local copies of various repos. We don't use Struts anywhere, we just prefer to maintain local repos.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
> C level people rarely understand technology enough to properly communicate the risk and benefit of security. It just isn't typically in their wheel house.
I just left a meeting with the CEO of our security company in which we discussed how to solve this. Heck, even the technical C people, like a CIO of a major company, are busy with many different things - desktops, network, on-premise servers, cloud .... They don't have time to really understand each of the vulnerabilities that comes out every day.
They need the security experts to tell them the bottom line "how secure are we?", "What are the top five things we need to do to reduce our risk?" and "what is the value proposition, the financials?"
What it lost was money, right? And who lost it? The shareholders.
All bonuses and pay all these executives wee gorging themselves in, was not clawed back. They did not go to jail. They paid the fines and compensation using shareholder's money.
Why would they change?
Why would you expect them to change?
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Public, trusted artifact repositories need to start taking down broken, risky builds. This would force the migration to newer, presumably more secure versions of these libraries.
AOL pushed Internet access onto people long before they could be trained on using it securely. Sure, no respectable slashdotter would be caught dead deploying vulnerable software, but IT security is universally flawed as a result. It may simply not be possible to fix this mess, which means AOL owes the world an apology (and trillions of dollars in reparations).
Maybe you should read up on WebSphere and figure out why these huge enterprises may be all mysteriously holding onto an ancient and buggy fork of an open source project.
If Equifax got a non-slap on the non-wrist, and people STILL use their services.... ....why pay to fix it?
---Why pay to maintain patches on-going?
There's more than one way to block an exploit. You don't always need to patch the software which risks breaking something else.
If you can't get the reference, you're not qualified to reply and know far less about security than you think. That's one of the many problems with the computing industry. Too many people think they know far more than they do.
There was always a bit too much of "but FOSS cures all! Thousands of eyeballs! Problems get fixed automagically!" for me.
This article shows how implementation can be an issue. The patch was available and Equifax never implemented it.