Equifax has managed to come back into the news. Three weeks ago (March 1), Equifax released an update to the hack that happened over 6 months ago (June 2017). For those of you who do not know, Equifax is one of three credit reporting agencies in the United States. All financial information passes through at least one of these agencies. This includes bank accounts, loans, credit cards, etc. Almost everyone in the United States has used one of these companies in their lifetime, if not all of them. I will go further in depth about the several security issues Equifax dealt with back in June as well as in September, but for now I’m going to provide information on the most recent update.
Originally Equifax released the news that 143 million people had their personal information stolen. This information includes names, SSNs, birthdates, addresses, driver’s license numbers, and credit card numbers. The population of the United States is 325.7 million (2017), meaning nearly half of all Americans (44.67%) had their information stolen. If you consider the fact that this hack really only affects adults as children haven’t necessarily needed to use Equifax in the past, the percentage goes up to over 50%. When they released the new update, an additional 2.4 million people have been said to be affected by the breach. While that number is much smaller than the original, this number is also coming 6 months after the initial announcement. Hackers have had the personal information of 2.4 million people for 9 months (6 plus the 3 that it took them to mention it to the public, more on that later) without those people knowing. With this new information, the number rises to ~58% of all adult Americans who have had their information stolen through the Equifax breach. It is one of the largest hacks of personal information in history.
The attack itself happened somewhere between May and July and came from a flaw in the web application back-end Apache Struts. This allowed the hackers initial access to the Equifax computer system. By the time they were finished, the hackers had 30 separate entry points into Equifax’s systems. The only reason they were caught is because they were so deeply embedded in the systems that the company was forced to shut down a consumer complaint portal for 11 days while the security team figured out what was happening.
There are also reports that the company was notified 6 months in advance (December 2016) of the threat of a potential attack due to the security measures in place. An anonymous hacker found a flaw in the website that would allow anyone to pull information from all people in the database in a couple of minutes. This information included SSNs, names, and birthdates of all the individuals. This could be done through forced browsing, a technique that plugs various strings into a browser. Not only that, but the hacker also managed to find ways to get shell access to several Equifax servers, as well as several SQL Injection vulnerabilities. From reading several articles, it seems like Equifax’s main security policy was “Security by Obscurity”.
Now, most people think that the only issue was the breach that happened between mid-May to July. This is only part of Equifax’s downfall. Besides announcing 2.4 million people had been hacked 9 months after the incident happened, Equifax is credited with many mistakes that a student in CSEC 101 could’ve prevented. But first, let’s go over how Equifax handled the situation.
In July 2017, Equifax learned that it had been breached. The company then waited 6 weeks to tell the public that the breach had taken place. This meant that hackers had the personal information of hundreds of millions of people for 3 months and Equifax failed to announce it for over a month. Before announcing the company had been hacked, the top level executives at Equifax sold millions of dollars worth of stocks. Perhaps the one good practice they had was to provide a one year protection plan for anyone affected by the breach. However, this too had its downsides. In most cases, a year of protection isn’t enough. Because of the information that was leaked and how long it can take to decipher it, the attacks on the individual people may not even happen for another 5 to 10 years. What’s more, once the one year free trial runs out, you are automatically enrolled into the paid protection plan regardless of if you asked to be or not. You have to manually cancel your plan after the year of protection expires. Also, by agreeing to this protection plan, you enter an agreement with Equifax stating that you can no longer sue the company. However they did update this, by allowing the people who signed up to send a written letter within 30 days to Equifax to opt out of the agreement.
In order to find out if you have been hacked, they require you to go to their site (https://www.equifaxsecurity2017.com) and sign up to find out if you have been affected by the breach. And I wish I could say that Equifax stopped messing up there, but the story continues. Cyber security experts criticize Equifax for creating this website. They say it would have been more secure for them to have instead used their own website and provide an additional subdomain where people could enroll. And Equifax should have listened… A software engineer decided to show the world the security disasters that could derive from this situation. A new website securityequifax2017.com (it has since been taken down) was created to show how this affects the people trying to use Equifax’s website. The site copied the actual Equifax site, but added the line “Which is Totally Fake, Why Did Equifax Use A Domain That’s So Easily Impersonated By Phishing Sites?” to the title of the page (shown below).
Now this site was so “convincing” that Equifax tweeted to the fake website, not once, no that’s not the Equifax way, but seven times. The official Equifax twitter account tweeted to a fake website made to specifically demonstrate the security risks involved with making a long url with the title “Which is Totally Fake, Why Did Equifax Use A Domain That’s So Easily Impersonated By Phishing Sites?”. 200,000 people had signed up on the fake website before the creator took it down, proving his point about the security concerns involved.
Next on the list, Equifax’s website in Argentina. This is actually a separate hack that just happened to come about at the same time the news was being released about the previous hack. A cybersecurity firm was testing the strength of Equifax’s website and found that the username and login information for the database storing all the South American employee information was admin/admin. With this information, the firm was able to figure out Argentine SSN equivalents, names, and emails of over 100 employees of Equifax.