Equifax security issues uncovered in 2016
Equifax security issues uncovered in 2016
![](https://cdn.prod.website-files.com/5fec9210c1841a6c20c6ce81/6022b7940e3c2140969c0b58_5fb344e87c4f7b0442b99ba4_Equifax%2520Security%2520Issues%2520Uncovered.webp)
![](https://cdn.prod.website-files.com/5fec9210c1841a6c20c6ce81/6022b7940e3c2140969c0b58_5fb344e87c4f7b0442b99ba4_Equifax%2520Security%2520Issues%2520Uncovered.webp)
Security issues identified in 2016 on the Equifax website are still not fixed. It is one step to identify the problem but it's an even bigger challenge to fix it. It requires time and skill to go back into the code, understand the context and fix the issues.
It is clear developers at Equifax were under a lot of stress and many known vulnerabilities didn't get fixed. Unfortunately that lack of action has now had the worst possible response.
Security needs to be baked in from the start and developers needs the skills, training and in-IDE tools to minimize writing known vulnerabilities. It requires specific language and framework knowledge to fix the problems identified. The general principle on fixing a XSS issue stays the same, however the actual implementation is dependent on the frameworks in place.
If you want to do some interactive training on how to fix XSS issues in Struts, check out: https://portal.securecodewarrior.com/#/simple-flow/web/xss/reflected/java/struts
Skip forward to 2016 and a security researcher found a common vulnerability known as cross-site scripting (XSS) on the main Equifax website, according to a tweet from a researcher who goes by the name x0rz. Such XSS bugs allow attackers to send specially-crafted links to Equifax customers and, if the target clicks through and is logged into the site, their username and password can be revealed to the hacker.
https://www.forbes.com/sites/thomasbrewster/2017/09/08/equifax-data-breach-history/#552ab1c9677c
Resources to get you started
Trust Agent by Secure Code Warrior
Discover SCW Trust Agent, an innovative solution designed to enhance security by aligning developer secure code knowledge and skills with the work they commit. It provides comprehensive visibility and controls across an organization's entire code repository, analyzing each commit against developers' secure code profiles. With SCW Trust Agent, organizations can strengthen their security posture, optimize development lifecycles, and scale developer-driven security.
Resources to get you started
Women in Security are Winning: How the AWSN is Setting Up a New Generation of Security Superwomen
Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.
Women in Security are Winning: How the AWSN is Setting Up a New Generation of Security Superwomen
Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.
SCW Trust Agent - Visibility and Control to Scale Developer Driven Security
SCW Trust Agent, introduced by Secure Code Warrior, offers security leaders the visibility and control needed to scale developer-driven security within organizations. By connecting to code repositories, it assesses code commit metadata, inspects developers, programming languages used, and shipment timestamps to determine developers' security knowledge.
Equifax security issues uncovered in 2016
![](https://cdn.prod.website-files.com/5fec9210c1841a6c20c6ce81/6022b7940e3c2140969c0b58_5fb344e87c4f7b0442b99ba4_Equifax%2520Security%2520Issues%2520Uncovered.webp)
Security issues identified in 2016 on the Equifax website are still not fixed. It is one step to identify the problem but it's an even bigger challenge to fix it. It requires time and skill to go back into the code, understand the context and fix the issues.
It is clear developers at Equifax were under a lot of stress and many known vulnerabilities didn't get fixed. Unfortunately that lack of action has now had the worst possible response.
Security needs to be baked in from the start and developers needs the skills, training and in-IDE tools to minimize writing known vulnerabilities. It requires specific language and framework knowledge to fix the problems identified. The general principle on fixing a XSS issue stays the same, however the actual implementation is dependent on the frameworks in place.
If you want to do some interactive training on how to fix XSS issues in Struts, check out: https://portal.securecodewarrior.com/#/simple-flow/web/xss/reflected/java/struts
Skip forward to 2016 and a security researcher found a common vulnerability known as cross-site scripting (XSS) on the main Equifax website, according to a tweet from a researcher who goes by the name x0rz. Such XSS bugs allow attackers to send specially-crafted links to Equifax customers and, if the target clicks through and is logged into the site, their username and password can be revealed to the hacker.
https://www.forbes.com/sites/thomasbrewster/2017/09/08/equifax-data-breach-history/#552ab1c9677c
Resources to get you started
Women in Security are Winning: How the AWSN is Setting Up a New Generation of Security Superwomen
Secure-by-Design is the latest initiative on everyone’s lips, and the Australian government, collaborating with CISA at the highest levels of global governance, is guiding a higher standard of software quality and security from vendors.
SCW Trust Agent - Visibility and Control to Scale Developer Driven Security
SCW Trust Agent, introduced by Secure Code Warrior, offers security leaders the visibility and control needed to scale developer-driven security within organizations. By connecting to code repositories, it assesses code commit metadata, inspects developers, programming languages used, and shipment timestamps to determine developers' security knowledge.
Trust Agent by Secure Code Warrior
Discover SCW Trust Agent, an innovative solution designed to enhance security by aligning developer secure code knowledge and skills with the work they commit. It provides comprehensive visibility and controls across an organization's entire code repository, analyzing each commit against developers' secure code profiles. With SCW Trust Agent, organizations can strengthen their security posture, optimize development lifecycles, and scale developer-driven security.