5

In September 2017 a large data breach at the US consumer credit reporting company, Equifax, was announced.

How did the criminals access this data? What was the exploit?

  • 4
    There's nothing official yet but I've seen people saying it might of been due to Apache Struts bug in a web application. But again this could be completely wrong, just what some people have been saying nakedsecurity.sophos.com/2017/09/06/… – nd510 Sep 8 '17 at 16:20
  • 2
    I also heard it was due to the structs bug, detail on it can be found here: isc.sans.edu/forums/diary/… – Trickycm Sep 12 '17 at 13:06
  • My interpretation of wording of official press releases has been that they have no confirmed logs of data actually being transferred/stolen. Particularly use of the phrase "May have". It seems they simply know that they got far enough that they could have had access to it. But I'm reading alot into wording that perhaps simply wasn't chosen well. So until we see data actually appearing for sell or in data dumps, we can't be sure. – AaronLS Sep 29 '17 at 13:11
4

The story below maintains a link to the testimony given by Equifax CEO Richard F Smith. In his testimony he admits that it was indeed the Apache Struts vulnerability that was used.

However, what is not revealed is how the instigators pivoted to escalate their privileges.

https://www.theregister.co.uk/2017/10/02/equifax_ceo_richard_smith_congressional_testimony/

This flaw has been exploited before, so there are some examples.

https://www.bleepingcomputer.com/news/security/equifax-confirms-hackers-used-apache-struts-vulnerability-to-breach-its-servers/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.