Minimize your digital risk by detecting data loss, securing your online brand, and reducing your attack surface.
A powerful, easy-to-use search engine that combines structured technical data with content from the open, deep, and dark web.
Digital Risk Protection
Research Team Finds 50% Increase in Exposed Data in One Year
New report recognizes Digital Shadows for strongest current offering, strategy, and market presence of 14 vendors profiled
Read Full Report
It’s common for the exciting and novel issues that confront security professionals on a daily basis to be hyped up. Very often the reporting and discussion focuses on 0day exploits, nation state actors, sophisticated intrusions and theoretical attack classes. The reality, however, is much more mundane. This point is driven home by the GAO (General Accounting Office) post-mortem report of the 2017 Equifax breach. The GAO was asked to prepare a report detailing how the breach had occurred and what federal agencies could do to respond. There are lessons in the report for all types of organizations.
The intrusion is described in Figure 1:
Figure 1 – How the Equifax breach occurred
The reporting to date has focused on the Apache Struts vulnerability, which was known for two months before the intrusion happened. However, that wasn’t the only security issue that affected Equifax. The breach was undetected for four months, during which time the attackers were able to exfiltrate data from 51 databases. While the attackers did exhibit some tradecraft prowess by blending in with existing traffic flows to make detection harder, many mistakes were made, including the presence of unencrypted usernames and passwords in the environment, which greatly assisted the attackers.
According to the report, the attackers were searching for Personally Identifiable Information (PII). Specifically, the attackers made off with dates of birth, social security numbers (SSN), addresses, phone numbers, email addresses, driver’s license numbers, tax identification numbers, credit card data, as well as passport scans and other government issued IDs. Once found, the attackers exfiltrated the data in small chunks to better evade detection.
The GAO report details two fascinating findings that give real insight into the security challenges that all organizations face.
Equifax had installed an SSL inspection device for monitoring encrypted communications in its networks. The attackers used encryption, presumably SSL/TLS, to conceal their activities. The SSL inspection appliance was intended to prevent such countermeasures. However, the certificate for the appliance had expired 10 months before the breach occurred. The consequence of the expiration was that the SSL inspection appliance “failed open”. That is, it continued to pass traffic uninspected. This greatly assisted the attackers in achieving their goals by not alerting the defenders to their presence in the network.
The Apache Struts vulnerability that was used to gain initial access to the environment received much attention in the coverage of the breach. However, the GAO report adds some important nuance. According to the report, Equifax knew of the vulnerability in March 2017 when they were notified by the US-CERT (United States Computer Emergency Readiness Team) and circulated the notice to their systems administrators. Unfortunately, the distribution list for the notices was out-of-date, which resulted in the persons responsible for patching the affected systems not being notified.
Equifax also scanned their own network one week after the notice had been received. Yet, the scan failed to detect the presence of Apache Struts on their online dispute portal. Apache Struts is not as straightforward to detect on a web server as some other software where there is a clear banner or other information available to accurately fingerprint which software is running.
The following processes would have helped to mitigate the impact of the breach:
The GAO rightly reports on the lack of network segmentation between the Internet-facing systems and the internal systems holding PII as a factor that enabled the attack. Inhibiting lateral movement with segmentation via firewall rules or private virtual LANs (VLANs) is a powerful defensive technique for obstructing adversary movement.
The GAO report details several findings that contributed to the severity of the attack on Equifax. The remediation advice, while sensible and appropriate, is not surprising. Implementing the advice successfully requires the mindset of the “Cyber Janitor”. Rather than infosec rockstars, janitors are required to maintain and clear up our environments. Paying attention to the small but important details such as members of a distribution list and expired certificates pays dividends!
To stay up to date with the latest Digital Shadows threat intelligence and news, subscribe to our threat intelligence emails here.