I guess a "State-Sponsored Attack" sounds better than "we got pwned with a bug that was known since March that we didn't patch and could have been exploited by a guy in a basement" [https://qz.com/1073221/the-hackers-who-broke-into-equifax-ex...]
This kind of crap is out there, and people don't give it the attention it deserves until they get bitten in the ass. Thankfully, my company didn't get bitten, but if we had, it could have been very bad, and the fact that the issue was called to people's attention and they didn't do anything about it would have made it look that much worse.
Ultimately, this kind of stuff is something IMO a professional programmer should just do. It's irresponsible to let stuff like this go and you should do whatever it takes to make management understand. In a healthy organization it shouldn't even be questioned by management, you just tell them you found a security issue that will cost the company billions and has to be fixed immediately. In an unhealthy organization, maybe you just slip this into some other work without telling management.
Now (and given everything that's happened in the industry in recent years) I would definitely push more, and maybe fix it on my own, but at the time I just shook my head, and sent follow-up emails every few months to try to keep visibility on the issue.
Obviously I got out of that environment pretty quickly, but you're not in a position to just do things at big companies. Probably most of them.
If the code is not responsibility of you (your team / department) all you can do is create work requests / JIRA tickets for people/team responsible for the code.
You wouldn't even have access to the repository or dev/test environments for the affected system most likely.
And it might just sit there for months until it eventually gets picked up and fixed. Or it will never be fixed.
Teams are siloed. Code is siloed. The deployment process is siloed. Etc.
Do I know where the code lives? If I do, do I -have access to the code-? Write, as well as read? Will my checking in code trigger a huge change review process that will cause people to yell at me for touching code I'm not in charge of? Will my checked in code be picked up as part of what goes to prod? If not, do I have a way to get the code into that process? Etc.
Very few companies of that scale are just a "check the code out, fix it, create a pull request, and watch it work its way into prod".
It's like saying "why didn't the NASA engineers just fix the o-rings on the Space Shuttle Challenger? After all, they knew there was problems with them and people's lives were ask risk." They did what they could, which was this: http://www.lettersofnote.com/2009/10/result-would-be-catastr...
It's not great to have a non-revocable login token, but a "UUID that lets anyone log in as you" is how a lot of API access tokens work, which is why they usually have a mechanism where you can regenerate them if you know they are compromised.
I don't disagree with your premise that "a lot of crap is out there" though. Working in small to medium enterprises (SMEs) really opens your eyes about the real level of security of most sites.
Yes, a suitably random and therefore 'unguessable' secret is, fundamentally, the underpinning for auth systems, and some of those secrets utilize UUIDs.
No to the idea that these are comparable. Those are not -user identifiers-. A user identifier, vs a 'secret', require different perspectives in how they're treated, in API, in UI, etc.
For -any- sort of security model you figure out what bits of data must be kept secret, vs what bits of data should be treated as 'known'. A user identifier should always falls into the latter camp, a password or other credential falls into the former.
You said it yourself, "usually have a mechanism to regenerate them if you know they are compromised" - you really, REALLY don't want to have to regenerate your user identifiers if they leak out; that's almost invariably going to involve a great deal of complexity, breakages, regressions, etc. You're effectively changing the primary key of every entry in every database you have that this user exists in. Better to just not make them required to be kept secret for your security model. And even -that- assumes that they were -meant- to be secret; no developer is going to assume that about user identifiers, so you better have made that explicit to everyone who ever touched the code, or you just introduced a bunch of avoidable security holes.
"No CEO would be able to withstand a targeted attack from such a motivated adversary!"
I agree that hysteria over "election hacking" is tedious, but so is blanket dismissal that a foreign state actor would have an interest in influencing a US election. Of course they would.
Pretty sure that qualifies as 'unauthorized access'.
https://www.washingtonpost.com/news/the-fix/wp/2017/09/23/wh...
And in case you're interested, here it is from a more colorful source;
https://theintercept.com/2017/09/28/yet-another-major-russia...
How, by getting Equifax to hire IT staff that does not see the wisdom in patching known vulnerabilities?
> everything we now know about Russia's attempts to influence our elections and sew division
Be careful what you believe. To date there has not been hard evidence that the Russian government was involved in any of the mischief that has been discovered.
It could just as easily have been an activist group within Russia or even (sadly) the US intelligence agencies looking to fan the flames of war with Russia.
There has been consistent conflict between the US and Russia all along since the cold war ended. And certainly lots of mischief on both sides. The danger in this case is allowing US propagandists to frame the recent mischief as cyber warfare, which it is not.
Considering the way that information about the alleged hacks have been strategically leaked and timed to convince the American people to resent Russia, it's pretty clear what the objective is.
Wars don't just happen, they are the result of significant propaganda effort. We are seeing the beginnings of it with the outrage over "meddling". It's only going to get worse. Expect to read additional revelations about Putin's character and Russian society/culture. The goal is to gradually foment mistrust and hate to the point where Americans actually consent to a war which may kill many Russians and many Americans.
Neither of those square with observed data, unless you posit a rather massive conspiracy to control that information.
And you still have to contend with a highly suggestive narrative involving key Trumpistas, key Russians, a gloating "denial" from Putin himself, highly suspicious correlations between Trumpist-public actions and private meetings, and the fact that the administration has zero credibility with their stories, having been repeatedly caught out brazenly lying about significant events.
Not to mention, eventually Mueller's investigation will come out. That should be amusing.
> The danger in this case is allowing US propagandists to frame the recent mischief as cyber warfare, which it is not.
Care to elaborate? What do you call it? I've always preferred 'info war' ('cyber' is just insipid), but unfortunately that phrase has been rather coopted.
> Wars don't just happen, they are the result of significant propaganda effort
Very, very true. And we have at least three players here, all spinning in support of their own motives. I just believe you've misidentified the motives of at least one of them.
What is the observed data? Anyone who had a VPS in Russia could have been responsible for the data that is currently known to the public. The intelligence agencies claim there is additional data but it appears unlikely that there actually is.
> Trumpistas
I think it's important not to let distaste for Trump interfere with analysis of this issue. Trump attempts to maximize all publicity in his favor, which is why he thanked "the Russians" for leaking the HRC emails. Just as many lobbyists for Ukraine hire American officials as consultants, Russian firms have in some cases hired former American officials and influencers to help with business/political goals in the US. This is just a normal phenomenon and not in and of itself cause for alarm.
> having been repeatedly caught out brazenly lying about significant events
They found themselves in an unexpected situation where the Russia story got legs that they had not anticipated. Some lies had been told thinking that the non-story would go away faster, and some Trump affiliates were caught in those lies. As unappealing as it is, the lies were probably the right strategy at the time for Trump, since his political enemies had made the Russia story front page news for a period of weeks.
> Care to elaborate? What do you call it?
Russia has first world state actor hacking capability. There is a decent chance that a Stuxnet-like worm has deeply penetrated many of the firms that make voting machines used in US elections. If anything, evidence of minor pentesting artifacts on the web servers of a few voting machine companies ought to make us think Russian involvement is less likely rather than more likely.
The stuff we saw in the past year (phishing, pentesting) requires such little sophistication that moderately interested teenager could have done it. Might Russia have some sort of after school program for patriotic teens? Certainly it might, but any such program would not be considered likely to have any impact other than the remote possibility of a lucky chain of events.
I think it's relevant to consider "Russia" the government vs any of the millions of moderately tech-savvy Russian people who might have been involved in content farming or low-sophistication hacking/phishing.
Since the probability of one of those attacks succeeding is so low (and likely had nothing to do with the 2016 US election outcome) having people conducting those attacks on Russian soil would much more likely be viewed by the Russian government as a liability, analogous to someone in Alaska launching home made missiles into Russia trying to "help" US interests.
Only in the most myopic, partisan political mindset can anyone take seriously the notion that somehow "The Russians" knew how to leverage < $200K in ad spend on Facebook and Twitter to shift the outcome of the 2016 US presidential election. It's just a ludicrous claim, and one that anyone actually doing marketing or involved in budgeting for social media marketing would laugh at without hesitation. It relies on the same sort of fiction that existed during the cold war that imagined super-genius Russian scientists creating super-weapons that would wipe out the US. It's useful for fear-mongering, but much more a figment of the imagination than based in reality.
Coming right on the heels of economic sanctions and a stream of threats my wild guess is North Korean involvement. Or else that's who they'll eventually blame it on. Or who knows.
Which none of this in any way excuses Equifax's shockingly bad behavior.
Even tech readers. I worked with a veteran who would just take that kind of stuff as fact because "17 intelligence agencies cant be wrong"