GAO Report on Equifax
I still have questions...I have regularly asked why we don't know more about the Equifax breach, including in comments in "That Was Close! Reward Reporting of Cybersecurity 'Near Misses'." These questions are not intended to attack Equifax. Rather, we can use their breach as a mirror to reflect, and ask questions about how defenses work, and learn things we can bring to our own systems.
Ian Melvin was kind enough to point out a GAO report, "Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach." As you'd expect of a GAO report, it is level headed and provides a set of facts.
However, I still have lots of questions. Some very interesting details start on page 11:
Equifax officials added that, after gaining the ability to issue system-level commands on the online dispute portal that was originally compromised, the attackers issued queries to other databases to search for sensitive data. This search led to a data repository containing PII, as well as unencrypted usernames and passwords that could provide the attackers access to several other Equifax databases. According to Equifax’s interim Chief Security Officer, the attackers were able to leverage these credentials to expand their access beyond the 3 databases associated with the online dispute portal, to include an additional 48 unrelated databases.
The use of encryption allowed the attackers to blend in their malicious actions with regular activity on the Equifax network and, thus, secretly maintain a presence on that network as they launched further attacks without being detected by Equifax’s scanning software. (Editor's note: I've inverted the order of the paragraphs from the source.)
So my questions include:
- How did the attackers get root?
- Why wasn't the root shell noticed? Would our organization notice an extra root sell in production?
- How did they get access to the other 48 databases?
- Why didn't the pattern of connections raise a flag? "As before, Equifax officials stated that the attackers were able to disguise their presence by blending in with regular activity on the network." I find this statement to be surprising, and it raises questions: Does the dispute resolution database normally connect to these other databases and run the queries which were run? How was that normal activity characterized and analyzed? Encryption provides content confidentiality, not meta-data confidentiality. Would we detect these extra connections?
Specifically, while Equifax had installed a device to inspect network traffic for evidence of malicious activity, a misconfiguration allowed encrypted traffic to pass through the network without being inspected. According to Equifax officials, the misconfiguration was due to an expired digital certificate. The certificate had expired about 10 months before the breach occurred, meaning that encrypted traffic was not being inspected throughout that period.
Would your organization notice if one of hundreds or dozens of IDSs shut up for a week, or if one ruleset stopped firing?
More published incident reports will help us get smarter, and provide better answers to the questions that CEOs and boards are asking: could this happen to us? With this report we an answer that better, but still not well.