Scourge · September 7 2017

The Scourge of Equifax

Chronicle

On 7 September 2017 credit bureau Equifax revealed that attackers had stolen personal data, including Social Security numbers, of about 147 million people. They had been inside since mid-May, exploiting an Apache Struts flaw whose fix had been available for two months, and left undisturbed until late July. In 2020 the US Department of Justice indicted four members of China's People's Liberation Army for the theft.

Lesson learned

It proved that a component inventory is security: you cannot patch what you don't know you have. It also showed the cost of an expired certificate on a monitoring device, which left encrypted traffic uninspected for months.

Prayer of reparation

O Struts, scaffolding of half the web, let our patches arrive before the thieves and keep our sensors' certificates from expiring in silence. Amen.

How it is remembered

Remembered by keeping an up-to-date library inventory, patching critical flaws on exposed systems within days and tracking the expiry dates of security tools' certificates.