Equifax security issues uncovered in 2016

Published Sep 12, 2017
by Matias Madou, Ph.D.
tl;dr?

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.

cASE sTUDY

Equifax security issues uncovered in 2016

Published Sep 12, 2017
by Matias Madou, Ph.D.
View Resource
View Resource
tl;dr?

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.

Security issues identified in 2016 on the Equifax website are still not fixed. It is one step to identify the problem but it's an even bigger challenge to fix it. It requires time and skill to go back into the code, understand the context and fix the issues.

It is clear developers at Equifax were under a lot of stress and many known vulnerabilities didn't get fixed. Unfortunately that lack of action has now had the worst possible response.

Security needs to be baked in from the start and developers needs the skills, training and in-IDE tools to minimize writing known vulnerabilities. It requires specific language and framework knowledge to fix the problems identified. The general principle on fixing a XSS issue stays the same, however the actual implementation is dependent on the frameworks in place.

If you want to do some interactive training on how to fix XSS issues in Struts, check out: https://portal.securecodewarrior.com/#/simple-flow/web/xss/reflected/java/struts

Skip forward to 2016 and a security researcher found a common vulnerability known as cross-site scripting (XSS) on the main Equifax website, according to a tweet from a researcher who goes by the name x0rz. Such XSS bugs allow attackers to send specially-crafted links to Equifax customers and, if the target clicks through and is logged into the site, their username and password can be revealed to the hacker.

https://www.forbes.com/sites/thomasbrewster/2017/09/08/equifax-data-breach-history/#552ab1c9677c

View Resource
View Resource

Author

Matias Madou, Ph.D.

Want more?

Dive into onto our latest secure coding insights on the blog.

Our extensive resource library aims to empower the human approach to secure coding upskilling.

View Blog
Want more?

Get the latest research on developer-driven security

Our extensive resource library is full of helpful resources from whitepapers to webinars to get you started with developer-driven secure coding. Explore it now.

Resource Hub

Equifax security issues uncovered in 2016

Published Mar 07, 2023
By Matias Madou, Ph.D.

Security issues identified in 2016 on the Equifax website are still not fixed. It is one step to identify the problem but it's an even bigger challenge to fix it. It requires time and skill to go back into the code, understand the context and fix the issues.

It is clear developers at Equifax were under a lot of stress and many known vulnerabilities didn't get fixed. Unfortunately that lack of action has now had the worst possible response.

Security needs to be baked in from the start and developers needs the skills, training and in-IDE tools to minimize writing known vulnerabilities. It requires specific language and framework knowledge to fix the problems identified. The general principle on fixing a XSS issue stays the same, however the actual implementation is dependent on the frameworks in place.

If you want to do some interactive training on how to fix XSS issues in Struts, check out: https://portal.securecodewarrior.com/#/simple-flow/web/xss/reflected/java/struts

Skip forward to 2016 and a security researcher found a common vulnerability known as cross-site scripting (XSS) on the main Equifax website, according to a tweet from a researcher who goes by the name x0rz. Such XSS bugs allow attackers to send specially-crafted links to Equifax customers and, if the target clicks through and is logged into the site, their username and password can be revealed to the hacker.

https://www.forbes.com/sites/thomasbrewster/2017/09/08/equifax-data-breach-history/#552ab1c9677c

Fill out the form to access the full report

We would like your permission to send you information on our products and/or related secure coding topics. We’ll always treat your personal details with the utmost care and will never sell them to other companies for marketing purposes.

To submit the form, please enable 'Analytics' cookies. Feel free to disable them again once you're done.