Hacker News Reader

Comment by kelnos | Hacker News Reader

> The vulnerability provided full RCE, and I know of no info-sec magic that inoculates you against that.

If the vulnerability used turns out to be the Struts one that was announced at the beginning of the year, then the "magic" here would have been quite muggle-like: update the damn dependency. Not doing so is negligence, plain and simple.

(I agree with you, though, that EFX will almost certainly come out of this relatively unscathed.)

View on HN

The statement released by Apache said that, if the attack did use the REST plugin vulnerability in Struts, then it would have been a zero-day at the time of use.

You will note that Equifax is not a contributor to Struts - cash or code. They are trying to shift the blame onto something they got for free and work other people did for free.

It's my understanding that Equifax is a multibillion dollar org. (Something in the order of 17 billion USD). Since Struts is a major part of their business infrastructure one would expect a contribution to the Struts project and other software they rely on. They could spin it as "Social Responsibility" too.

In retrospect it seems more cost effective to do so too, even if Equifax manages somehow to pay only a few hundred million dollars.

Yet Equifax continues to evade giving details on the attack. That itself is damning evidence they weren't doing everything they should have been to protect their servers and data.

Reply on news.ycombinator.com