What Was the Equifax Breach? The Door Was Patched, the Camera Was Off
The patch had been out for two months. The thing watching the door had been switched off for far longer.
What was the Equifax breach?
The vulnerability was CVE-2017-5638, a flaw in Apache Struts that let a crafted web request run commands on the server. It was disclosed, with a patch available, on 7 March 2017. Equifax ran an internet-facing dispute-portal application called ACIS on a version of Struts that still had the hole, did not apply the fix, and the attackers came through it in mid-May.
Once inside, they reached databases well beyond that one application, and took the personal data of about 147.9 million people: names, dates of birth, addresses, Social Security numbers, driver's licence numbers, and for some, credit card numbers. That is not customers who signed up for a service. It is roughly half the adult population of the United States, whose data Equifax held because it is a credit bureau and holding that data is its business.
The camera was off
The part that turns a missed patch into a catastrophe is what happened next, which was nothing. Equifax had a device that inspected encrypted network traffic looking for exactly this kind of data exfiltration. To read encrypted traffic, it needed a valid certificate, and that certificate had expired. While it was expired, the traffic passed uninspected, and the attackers moved data out for weeks without tripping a single alarm.
The intrusion was discovered only when someone renewed the certificate. The instant the monitor could see again, it saw the suspicious traffic, and Equifax pulled the application offline the same day, on 29 July 2017.
How long was the certificate expired?
This is genuinely disputed, and it is worth being honest about rather than picking the scariest number. A US House of Representatives report put the expiry at around nineteen months. Equifax told the Government Accountability Office it was closer to ten. The window during which the attackers operated undetected is variously reported as 76 or 78 days.
The precise figure does not change the shape of it. The certificate was expired before the Struts patch was ever released. The monitoring was blind before the vulnerability the attackers used was even public. The camera was off before anyone knew the door could be opened.
What made it worse
Several things, each ordinary on its own. The patch had been flagged internally and an email asking for it to be applied did not result in it being applied. A scan that should have found the vulnerable server used a path that missed it. Credentials for internal databases were found stored in a way that let the attackers move from the first server to many others. And three senior executives sold company stock after the breach was discovered internally but before it was disclosed to the public, which drew an insider-trading investigation.
What it cost
The settlement with the FTC, the Consumer Financial Protection Bureau and 48 states and territories, announced on 22 July 2019, was at least $575 million and up to $700 million, the largest data-breach settlement in US history at the time. It funded consumer compensation and free credit monitoring, and it made Equifax the standing example in every argument about whether a company that loses half a country's identity data faces consequences proportionate to the harm.
They patched the door eventually. Nobody had checked whether the camera was recording.
Further reading
- US Government Accountability Office — Data Protection: Actions Taken by Equifax and Federal Agencies in Response to the 2017 Breach, GAO-18-559, August 2018.
- US House Committee on Oversight and Government Reform — The Equifax Data Breach, majority staff report, December 2018.
- Federal Trade Commission — Equifax to Pay $575 Million as Part of Settlement, 22 July 2019.
- Apache Software Foundation — Struts security bulletin S2-045, CVE-2017-5638, March 2017.
EXHIBIT 0033 — EQUIFAX
We put it on a shirt. A framed inspection certificate on a wall, drawn as an engraving, with a wax seal and ribbon and a single diagonal stamp across it: EXPIRED.
Callouts: THE PATCH WAS OUT IN MARCH. THEY GOT IN IN MAY. THE MONITOR HAD AN EXPIRED CERTIFICATE. SO THE TRAFFIC WENT UNREAD.
The door was patched. The camera was off.
That's the whole idea.