Equifax security issues uncovered in 2016
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique. Duis cursus, mi quis viverra ornare, eros dolor interdum nulla, ut commodo diam libero vitae erat. Aenean faucibus nibh et justo cursus id rutrum lorem imperdiet. Nunc ut sem vitae risus tristique posuere.
Security issues identified in 2016 on the Equifax website are still not fixed. It is one step to identify the problem but it's an even bigger challenge to fix it. It requires time and skill to go back into the code, understand the context and fix the issues.
It is clear developers at Equifax were under a lot of stress and many known vulnerabilities didn't get fixed. Unfortunately that lack of action has now had the worst possible response.
Security needs to be baked in from the start and developers needs the skills, training and in-IDE tools to minimize writing known vulnerabilities. It requires specific language and framework knowledge to fix the problems identified. The general principle on fixing a XSS issue stays the same, however the actual implementation is dependent on the frameworks in place.
If you want to do some interactive training on how to fix XSS issues in Struts, check out: https://portal.securecodewarrior.com/#/simple-flow/web/xss/reflected/java/struts
Skip forward to 2016 and a security researcher found a common vulnerability known as cross-site scripting (XSS) on the main Equifax website, according to a tweet from a researcher who goes by the name x0rz. Such XSS bugs allow attackers to send specially-crafted links to Equifax customers and, if the target clicks through and is logged into the site, their username and password can be revealed to the hacker.
https://www.forbes.com/sites/thomasbrewster/2017/09/08/equifax-data-breach-history/#552ab1c9677c
Matias Madou, Ph.D.
Related Articles We Recommend
Related Articles We Recommend
Dive into onto our latest secure coding insights on the blog.
Our extensive resource library aims to empower the human approach to secure coding upskilling.
Get the latest research on developer-driven security
Our extensive resource library is full of helpful resources from whitepapers to webinars to get you started with developer-driven secure coding. Explore it now.
Equifax security issues uncovered in 2016
Security issues identified in 2016 on the Equifax website are still not fixed. It is one step to identify the problem but it's an even bigger challenge to fix it. It requires time and skill to go back into the code, understand the context and fix the issues.
It is clear developers at Equifax were under a lot of stress and many known vulnerabilities didn't get fixed. Unfortunately that lack of action has now had the worst possible response.
Security needs to be baked in from the start and developers needs the skills, training and in-IDE tools to minimize writing known vulnerabilities. It requires specific language and framework knowledge to fix the problems identified. The general principle on fixing a XSS issue stays the same, however the actual implementation is dependent on the frameworks in place.
If you want to do some interactive training on how to fix XSS issues in Struts, check out: https://portal.securecodewarrior.com/#/simple-flow/web/xss/reflected/java/struts
Skip forward to 2016 and a security researcher found a common vulnerability known as cross-site scripting (XSS) on the main Equifax website, according to a tweet from a researcher who goes by the name x0rz. Such XSS bugs allow attackers to send specially-crafted links to Equifax customers and, if the target clicks through and is logged into the site, their username and password can be revealed to the hacker.
https://www.forbes.com/sites/thomasbrewster/2017/09/08/equifax-data-breach-history/#552ab1c9677c
