Hacker News Reader

I just read about how the hack was done. Shockingly stupidly easy!

1. They realized that Equifax uses Struts. 2. They modified struts!

and 3. Equifax used the updated code on their servers.

DUUUUUHHHHHH!

It is more: - Critical remote execution bug was discovered in Struts2. - The vulnerability goes public too quickly. - Hackers start scanning the Internet - Equifax is found vulnerable. - Vulnerability is exploited.

$14 billion company cannot convert what the servlet API gives into a method call on a certain object + a bit of reflection to update methods & print them into form elements. Super complicate!

If the $14 billion can't do that then they certainly cannot protect data.

Do you have a source for 2? I'd like to read more about it.

a $ 14 billion company gives away the only secret data that they exist to protect. Why? Because they used Struts. How difficult is it to write a slimmed down, secure version of Struts?

Reply on news.ycombinator.com