Equifax: An Admin/Admin Password, a Lapsed Certificate and 76 Days Inside

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

The 2017 Equifax breach exposed names, birth dates, Social Security numbers, addresses and driver's license numbers of 147.9 million Americans, 15.2 million Britons and tens of thousands of Canadians. A 2015 internal audit had already found security backlogs, missing patches, no IT asset tracking and a patching system run on the honor system. On March 7, 2017, a fix was released for a flaw in the Apache Struts web framework; by March 10 attackers were scanning for unpatched systems. Equifax never patched its online credit dispute portal, and on May 12 intruders got in, found plaintext credentials, logged in with the username admin and password admin, and moved freely through a flat network without two-factor authentication.

Over 76 days they ran more than 9,000 database queries and smuggled data out in small temporary files. A traffic-inspection tool could not see it because its SSL certificate had been expired for nine months; when staff renewed it on July 29, alarms went off, and the connection was cut on July 30. Equifax disclosed the breach on September 7. On August 2, three executives including the chief financial officer sold nearly $1.8 million in stock, prompting a Justice Department insider trading inquiry, though the executives said they did not know of the hack. In 2020 the Justice Department indicted four members of China's People's Liberation Army, and the data has never surfaced for sale.

• Equifax hired Mandiant on August 2 to investigate before going public.
• Its breach checker sat on a new domain, equifaxsecurity2017.com, built on WordPress with TLS flaws, and OpenDNS blocked it as a phishing site.
• Equifax's official Twitter account sent people to a fake clone built by engineer Nick Sweeting eight times.
• A 2019 settlement with the FTC, the CFPB, 48 states, Washington, D.C., and Puerto Rico ran up to $700 million, and the UK Financial Conduct Authority fined it over £11 million.
• Security experts suggest the unsold data could help a state spy service find indebted targets or spot cover identities with no credit history.