An out-of-date mailing list, an expired certificate, and 76 days unseen
Not yet reviewed
This one was written here from the source and has not yet been signed off, so it carries no byline. Every factual claim in it comes from the document linked below and can be checked against it. The judgements are ours, and until somebody has been back through them they are marked as unverified rather than presented as settled.
On 10 March 2017 unidentified individuals scanned Equifax's systems for an Apache Struts vulnerability that US-CERT had publicly identified 2 days earlier, found it on the server housing the online dispute portal, and confirmed they could run commands. Beginning on 13 May 2017 attackers used the portal to query other databases, ran approximately 9,000 queries and removed data in small increments over encrypted channels. The breach exposed personal information of at least 145.5 million individuals and lasted about 76 days before Equifax discovered it on 29 July 2017. GAO's account rests on what Equifax officials told it and was not independently assessed.
What worked
Discovery came from routine work: a network administrator checking the operating status and configuration of IT systems found the misconfigured inspection device and replaced its expired certificate. Once inspection of traffic resumed, the administrator recognised signs of an intrusion, Equifax blocked several Internet addresses, and the portal was taken offline on 30 July 2017. GAO notes that logs on the affected systems had not been damaged or erased, which let Equifax reconstruct the attackers' actions and determine what data was compromised.
What failed
Equifax circulated the US-CERT notice to its systems administrators, but the recipient list was out of date, so the people responsible for installing the patch did not receive it. A network scan a week after the vulnerability was identified did not detect it on the dispute portal. The digital certificate on a device installed to inspect network traffic had expired about 10 months before the breach, so encrypted traffic passed uninspected throughout it. Databases were not segmented, which let the attackers move from the 3 databases associated with the portal to an additional 48 unrelated databases, helped by a repository of unencrypted usernames and passwords. Nothing restricted the frequency of database queries.
The number
76 days
the attack ran before it was discovered, while an expired certificate left encrypted traffic uninspected.
What to do instead
Do not route a critical patch notice through an email distribution list: tie advisories to an asset inventory that names an owner for every internet-facing application, and require a positive acknowledgement. Verify patching with authenticated scans, and treat a clean scan for a technology you know you run as a question, not an answer. Monitor certificate expiry on security tooling as closely as on public websites, and alert when an inspection device stops inspecting. Segment databases, keep credentials out of plain-text stores, and rate-limit queries so that thousands of them look abnormal.