Attacks/Breaches

9/10/2018
03:30 PM
50%
50%

GAO Says Equifax Missed Flaws, Intrusion in Massive Breach

A report from the Government Accountability Office details the issues found and opportunities missed in the huge 2017 Equifax data breach.

The 2017 Equifax breach involved at least 9,000 queries to 51 databases over a period of 76 days, according to a report on the attack issued by the Government Accountability Office (GAO). The report details the mechanisms used by the attackers to gain access and exfiltrate personal information of approximately 145 million individuals in the US, Canada, and the UK.

Attackers began scanning Equifax's systems for a vulnerability in Apache Struts within two days of the vulnerability's public disclosure. While they quickly found the flaw, Equifax's own systems not only failed to find the vulnerability, they failed to spot the intrusion for weeks following its initial success.

The attackers were careful to take data out of the databases in small chunks to avoid detection, using an outdated certificate in a dispute-resolution server to encrypt the exfiltrated data and avoid tripping packet-inspecting security components.

According to the report, there were a number of different issues at Equifax, each contributing to the possibility and severity of the breach. The security issues ranged from bad network architecture to a failure to establish limits on the number of database queries possible from a single address.

The report notes that Equifax has publicly reported that it has remediated all the issues associated with the breach. The company has not detailed those remediation steps, and the GAO has not independently verified or assessed the remediation.

For more, read here.

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
jimmy04
50%
50%
jimmy04,
User Rank: Apprentice
9/13/2018 | 4:13:38 AM
Good one
You are doing an amazing job. 
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Empathy: The Next Killer App for Cybersecurity?
Shay Colson, CISSP, Senior Manager, CyberClarity360,  11/13/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18955
PUBLISHED: 2018-11-16
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resour...
CVE-2018-19311
PUBLISHED: 2018-11-16
Centreon 3.4.x allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
CVE-2018-19312
PUBLISHED: 2018-11-16
Centreon 3.4.x allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
CVE-2018-19318
PUBLISHED: 2018-11-16
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account.
CVE-2018-19319
PUBLISHED: 2018-11-16
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges.