U.S. officials looking at Apache vulnerability as cause for Equifax breach

The official's comments to CyberScoop are the first from a government source regarding the cause behind one of the largest data breaches in history, which was publicly announced last week.

This story has been updated with a statement from Equifax

It’s likely that whomever was responsible for the giant data breach at credit reporting firm Equifax targeted an old version of the Apache Struts framework, according to a senior government official who spoke on condition of anonymity to discuss an ongoing investigation.

The attackers, the official said, appear to have relied on a known vulnerability in the open-source web application that was disclosed in March 2017. The vulnerability is different from the one that was widely reported on last week.

The official’s comments to CyberScoop are the first from a government source regarding the cause behind one of the largest data breaches in U.S. history, which was publicly announced last week.

The official cautioned that while the Struts vulnerability is currently considered the mostly likely avenue, an investigation is ongoing and still developing.

The FBI is currently working with Equifax in order to fully investigate the cause of the breach and who may be responsible for compromising records affecting up to 143 million U.S. residents.

“I really do believe this is an inflection point,” the senior U.S. official said. “This is just as big as Sony, as Target, as OPM.”

Lawmakers in both the House and Senate have called for transparency from Equifax as they seek answers about how this breach occurred, when authorities were first notified and whether customers had been properly notified about the incident.

U.S. cybersecurity firm Mandiant was brought in by Equifax to respond to the breach, ZDNet first reported.

The Struts remote code execution vulnerability mentioned by the official was catalogued as CVE-2017-5683 in March.

Equifax’s main competitors, TransUnion and Experian, also reportedly rely on the popular Apache Struts framework. Some security experts believe Equifax’s competition were susceptible to the same vulnerability in recent months. Outdated software, which has not been updated or patched in months, is wildly susceptible to being hacked.

Experian did not respond to a request for comment.

A TransUnion official did not answer a specific question sent by CyberScoop about security measures taken in the aftermath of the Equifax breach, but instead provided the following statement: “We are aware of the Equifax announcement and have activated our standard protocol to investigate the nature of this attack. Our information security and technology teams are actively evaluating this incident to determine what, if any, actions from TransUnion might be appropriate.”

News that the Equifax breach had been caused by an Apache Struts vulnerability first appeared in press reports Friday after an analysis by equity research firm Baird noted the reason. A New York Post article concerning the breach quoted a Baird analyst saying that a source inside Equifax had told him about the Struts vulnerability.

Update: Equifax has confirmed CyberScoop’s reporting. In a public statement released late Wednesday night, an Equifax spokesperson said that CVE-2017-5683 allowed for hackers to break into the company and compromise records. 

https://twitter.com/zackwhittaker/status/908135177800601600

CFPB proposes new rule to regulate expansive data broker industry

The rule would force data brokers to adhere to the same standards as established credit agencies.

CFPB’s proposed data rules would improve security, privacy and competition

Personal data from T-Mobile breach still spreading on dark web, state governments warn

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure