TechCrunch: Equifax Hack-Checking Web Site Is Returning Random Results (techcrunch.com) 176
An anonymous reader quotes security researcher Brian Krebs:
The web site that Equifax advertised as the place where concerned Americans could go to find out whether they were impacted by this breach -- equifaxsecurity2017.com -- is completely broken at best, and little more than a stalling tactic or sham at worst. In the early hours after the breach announcement, the site was being flagged by various browsers as a phishing threat. In some cases, people visiting the site were told they were not affected, only to find they received a different answer when they checked the site with the same information on their mobile phones.
TechCrunch has concluded that "the checker site, hosted by Equifax product TrustID, seems to be telling people at random they may have been affected by the data breach." One user reports that entering the same information twice produced two different answers. And ZDNet's security editor reports that even if you just enter Test or 123456, "it says your data has been breached." TechCrunch writes: The assignment seems random. But, nevertheless, they were still asked to continue enrolling in TrustID. What this means is not only are none of the last names tied to your Social Security number, but there's no way to tell if you were really impacted. It's clear Equifax's goal isn't to protect the consumer or bring them vital information. It's to get you to sign up for its revenue-generating product TrustID.
Meanwhile, one web engineer claims the secret 10-digit "security freeze" PIN being issued by Equifax "is just a timestamp of when you made the freeze."
TechCrunch has concluded that "the checker site, hosted by Equifax product TrustID, seems to be telling people at random they may have been affected by the data breach." One user reports that entering the same information twice produced two different answers. And ZDNet's security editor reports that even if you just enter Test or 123456, "it says your data has been breached." TechCrunch writes: The assignment seems random. But, nevertheless, they were still asked to continue enrolling in TrustID. What this means is not only are none of the last names tied to your Social Security number, but there's no way to tell if you were really impacted. It's clear Equifax's goal isn't to protect the consumer or bring them vital information. It's to get you to sign up for its revenue-generating product TrustID.
Meanwhile, one web engineer claims the secret 10-digit "security freeze" PIN being issued by Equifax "is just a timestamp of when you made the freeze."
Do the math (Score:5, Funny)
The judgement Equifax will have to pay for this breach is massive. Unfortunately, the probability of it staying solvent enough to pay anything is the reciprocal of this amount.
Re: (Score:1)
+5 funny.
Re:Do the math (Score:5, Insightful)
I look forward to my "massive" $5 gift certificate.
Re:Do the math (Score:5, Funny)
$20 towards signing up for TrustID, I'm sure. Taxes and other fees apply.
Re: (Score:2)
Ooooh. Very generous.
Re: (Score:2)
Re:Do the math (Score:4, Informative)
This is a joke right? Equifax made more than $3 billion last year in revenue and has nearly $7 billion in assets. I'm sure they'll be perfectly fine after their slap on the wrist from the Trump Administration.
Re: (Score:3)
After the Election Integrity Commission debacle, it wouldn't surprise me if this was plan C to obtain shittons of voter information.
Equifax is going to crash hard, BearStearns/Lehman Brothers style hard.
Predictive (Score:3)
After the Election Integrity Commission debacle, it wouldn't surprise me if this was plan C to obtain shittons of voter information.
The major parties already have all the information they could want on you. More information is not always better. The most important predictors of your voting behavior are your age, political registration, parents' political registrations, income level, education level and other such things which tend to be either public or legally obtainable. The major parties have this information for the vast majority of citizens. Knowing the details of your past addresses or credit history isn't necessarily going to be
Re:Do the math (Score:5, Funny)
I'm afraid Monsanto has a patent on that
Re: (Score:2)
Nah. Their wings are delicious though.
Re: Do the math (Score:2)
Re:Do the math (Score:4, Funny)
Nah. Carly, Elop or Meg will take over for a while until they're bought out by Verizon. All the data owned by Equifax will then be used for yet another Verizon targeted advertising scheme, because apparently Verizon wishes it were Google.
Re: (Score:2)
Re: (Score:1)
Protip: DMCA was introduced by a Republican.
Funding Sources (Score:3)
Protip: One counterexample does not negate decades of history.
Entertainment lobbying has been solidly blue [opensecrets.org] for decades, and the energy lobby is even more extremely biased in the other direction [opensecrets.org]. The DMCA specifically had broad bipartisan support, passing the Senate unanimously. The entertainment industry tends to have broader representation of LGBTQ persons, and is also heavily unionized, and the Republican party opposes both of these things. The 2016 election shows the same bias in funding, with HRC gettin
Re: (Score:3, Funny)
If he hadn't invented the internet this hack wouldn't have occurred. Therefore, Obama is a Kenyan. QED.
Re: (Score:3)
I predict that they won't pay a penny. Not a single cent.
They are too well connected.
The credit bureaus can already ruin someone's life with wrong information and not suffer any consequences for what should be a crime, or at least libel.
Re: (Score:1)
Re:Do the math (Score:5, Interesting)
Of course, that means that all your ID eggs are now going to be in two baskets rather than three, and there's absolutely zero evidence that either of the other two major players are any better at this than Equifax as far as I can see. Good luck with that.
Re: Do the math (Score:3)
Their customers are the lenders. Nobody pays or asks to be in a credit reporters database. And the lenders have no reason to give a shit about this.
Re: (Score:2)
Re: Do the math (Score:1)
Re: (Score:2)
> I doubt very much the company is going to survive this
I'm sick of hearing this stuff. I heard it about virtually every Trump-related news story for the last year, I heard it about New Orleans, I heard it about BP. I heard it about Volkswagen.
Look, the market already priced this disaster, based on what data is available. They lost about 15% of their value. They have solid fundamentals that aren't changing in any sort of way that pose an existential threat to the company; unless there's a lot more of thi
The Experian hotline (Score:5, Interesting)
Today I tried calling the new Equifax help line (set up because of the data breach) and asked the woman I spoke to if Equifax intended to issue new PIN numbers to the people who already had credit freezes.
Long pause. "Sir, have you been to our web site?"
Me: "Yes, I have. According to your own site, my data is at risk. My wife and I froze our credit a couple of years ago, and you issued us 10-number PINs for unfreezing our credit online. Since the hackers now have everything they need to log into your web site with our credentials, I want to know if those PIN numbers were part of the compromised information, and if Equifax intends to issue new PIN numbers."
Another very long pause. "Sir, I don't have that information at this time, but I will log this request."
Me: "Yeah, Equifax doesn't have much information about anything, does it? Have a nice day."
Talk about incompetence compounded. So now it turns out that the PIN is nothing but a timestamp, and Equifax has given up all the information needed for a criminal to unfreeze my credit using their website. Anyone want to bet if that timestamp can be deduced from the information already stolen in the breach?
Re: (Score:2)
But, but... the lowest bidder PROMISED us security. It was even one of the bullet points on the Powerpoint! /s
Re: (Score:1)
But what did the Magic Quadrant say?
Re: (Score:2)
Re: The Experian hotline (Score:1)
Re:The Experian hotline (Score:5, Funny)
STOP SAYING PIN NUMBERS
Yes, he should have said personal PIN number, so it's not mistaken for a corporate PIN number.
PIN Number (Score:2)
Stop saying "PIN Number" too. PIN = Personal Identification Number. Why say "number" twice? :P
Re: (Score:2)
PI Numbers. Now do you see why redundancy is ok?
Re: (Score:3)
Re: (Score:2)
> Talk about incompetence compounded
Well, their Chief Security Officer is a liberal arts diversity hire. What do you expect?
Experian's Tom King is a diversity hire? Are you sure? Seems like more of a typically corporate exec...
Re: (Score:2)
Froze mine in 2016. Just checked it, and it sure is a timestamp.
Just Looked at My PIN (Score:5, Interesting)
It indeed IS a time stamp. Geezus. It's bad enough it's just a numeric PIN which isn't very secure to begin with, but then to be that obvious. Wow. Hopefully I can get that changed.
The good news is freezing my credit here in Indiana didn't cost me a dime. It's a law we have here.
Re: (Score:3, Informative)
Yeah it's ridiculous especially since TransUnion and Experian let you set your own PIN rather than relying on some incompetent to give you a deterministic 'random' PIN.
Re:Just Looked at My PIN (Score:5, Interesting)
"Incompetent" just doesn't cut it. Their name needs to become a verb. They've fucked up that hard.
"Hey, buddy, don't equifax that document!"
Re: (Score:3)
Re: Just Looked at My PIN (Score:1)
Weâ(TM)ve all been equif***ed.
Re: (Score:3, Informative)
Unfortunately, it looks like their timestamp only has one minute resolution, meaning t
Re:Just Looked at My PIN (Score:4, Interesting)
There's nothing intrinsically wrong with using a timestamp
Yes, there is, when the topic involves security (which is almost always). Unlike a well-vetted PRNG, truncating a timestamp (at either end) has no mathematical basis for producing high-entropy results.
Just about every modern programming language has a built-in mechanism for generating random numbers with high entropy. There is no reason to not use that functionality in a case like this.
Re: (Score:2)
At the risk of saying, "me too," I can also confirm that Equifax security freeze PINs are a timestamp.
PINs do not necessarily need to be "random" in order to be secure. They need only be unpredictable by an outside attacker. Right away, we can see that some digits are predictable. Years are limited by the age of the submitter. Hours are generally limited to those during which the submitter is awake. I'm not sure why they bothered with ten digits when the PIN actually has much less entropy than that.
The secu
Re: (Score:2)
Racketeering (Score:5, Interesting)
It has become increasingly obvious that Equifax and their cohorts are running a racket, running roughshod over consumer rights. The congressionally-mandated free annual credit report was inadequate to solve all the problems with their business. I pray that racketeering charges are brought against Equifax, for their practice of punishing people who don't sign up for their protection services whenever Equifax makes a mistaken data entry, and by holding proprietary information over their head limiting access to any significant financial transactions (although lenders are as at fault here too.) Furthermore, 'identity theft' should be an Equifax/lender problem, rather than a consumer problem.
Re: (Score:2)
Considering the pro business government that it's charge right now, I doubt that Equifax will get more than a slap on the wrist for this breach.
I don't think that much will change here until a bunch of congresspeople get their own identities stolen and this becomes a personal issue to them.
Of course, even then they'll all have VIP numbers to call that let them skip the line and get a senior level caseworker to get their credit problems resolved.
Re:Racketeering (Score:4, Insightful)
Right the big problem here is that there is not cost to the agencies to getting it wrong. If the report inaccurate information about it, it may cost you big, costs them nothing.
The 'free credit report' solution was BS. I it should not be my responsibility to verify on a regular basis some entity isnt spreading material falsehoods about me. Mind you making it my responsibility might be the only practical way, if we give the credit agencies the doubt and assume they at least try to get it right, they have no way to address the problem. They need to be penalized for forwarding bad information in some way. Maybe that is making it extra easy for libel(like) civil suits to succeed against this type of a business, with lower standards of proof of harm.
Re: Racketeering (Score:1)
Faster method (Score:4, Funny)
Just ask the Nigerian prince. Quick turnaround if you help him with a little banking snafu.
firefox: bad certificate for equifaxsecurity2017 (Score:2, Interesting)
with OSX firefox, visiting equifax.com and clicking the big orange button in the middle of the site for https://www.equifaxsecurity2017.com/ yields a browser certificate warning:
------------
www.equifaxsecurity2017.com uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. Error code: SEC_ERROR_UNKNOWN_ISSUER
------------
wei
Re:firefox: bad certificate for equifaxsecurity201 (Score:5, Informative)
The GeoTrust Global CA used to sign the GeoTrust DV SSL CA - G3 certificate is ancient (from 2002) and uses an SHA-1 algorithm, which is no longer considered secure..
So even if the intermediate certificate is SHA-256 sign, the chain is not trusted by clients that require strong security.
GeoTrust used to own Equifax Security, but sold out in 2006, and then got acquied by Verisign, which in turn got acquired by Symantec. So don't be too surprised at signs of incompetence.
Re: (Score:2)
Your scenario hints more at the incompetence of the browser than GeoTrust, in this case (not surprisingly, I'm only seeing this with Firefox). The root CA is self-signed and its security is not impacted by a weak hash. The rest of the chain, where the strength of the hash is important, uses SHA-256 hashes.
SHA1 is depreciated so all currently generated root CAs will use SHA2, but there is no security impact of a root CA with a SHA1 hash.
Re: (Score:2)
The issue there is that the server is sending a server cert that isn't signed by the Root CA, it is signed by GeoTrust DV SSL CA - G3 -- and that was not sent by the server. It is the servers responsibility to provide certificates that link the server cert with the root cert.
Re: (Score:2)
True, but the URI for the missing intermediate certificate is included in the "CA Issuers ( 1.3.6.1.5.5.7.48.2 )" field. It's not ideal, but it's not worth refusing to connect over. If downloading the intermediate from that URI failed, the chain should definitely be considered broken.
Re: firefox: bad certificate for equifaxsecurity20 (Score:1)
Dicey from start to finish (Score:5, Informative)
For as long as I can remember all credit scoring companies always behaved in opaque and obscure ways. That continues right up to this day.
When I was in my twenties the law was they had to disclose "everything" if you asked for it and it came on a form that was printed on a 132-column line printer. So I was in credit trouble (that of course is the age for it) and got turned down for a card so they sent me the free report. Most of what was on it was wrong or benign. The late payments on credit cards that I actually did have were not on the report except for Sears who was always the most aggressive on reporting these things. There was nothing on it that would explain an extremely low credit score even though in my case the low credit score was deserved.
I could only conclude that "everything" report in fact did not have everything on it in clear violation of what the law seemed to say. There was nothing I could do about it and nobody with actual influence seemed to care.
Today I have a very high credit score: at the moment my FICO score 876 out of 900. A few years back I bought a car and the dealership had to run a credit report even though I was paying cash. The guy said he had never seen a score that high and his customers he had sold to included highly successful silicon valley execs. I'm not rich by any means but I can pay my bills so whatever.
So I get a copy of the report and it had scant data on it but has a section "things that can adversely affect your score." It lists things there like "too many accounts with balances open." Say what? I don't owe a dime on any account except my mortgage. I have two credit cards with zero balance for months and I haven't paid a dime of interest or finance charge on them for a decade. But that's a problem: "No recent revolving balances." So if you aren't spending enough that's a negative.
I am pretty sure that none of Bill Gates, Larry Ellison and Elon Musk could get a 900. (Not that they would care, nor anyone giving them credit), My point is if it is impossible to ace the test then it is not a good test. But that's the way the credit industry is built -- a complex data base of hidden rules that they can exploit to make money.
It should surprise nobody that Equifax is using this crisis event to skim cash.
Re: (Score:2)
But that's the way the credit industry is built -- a complex data base of hidden rules that they can exploit to make money.
That's the way the insurance industry is built, as well. No one should ever be required to pay for a thing whose price is determined by secret formula.
Re: (Score:2)
As long as you can get quotes and shop around for insurance, why do you need to know what the formula is?
Re: Insurance is secrert formulas (Score:3)
I have worked for both the health insurance industry and now the property casualty side. Both use what is called "Predictive Modeling". The company I work for now uses 91 different "points" to assign you a "model rate code". One of those "points" is your Equifax credit score! Any time a policy is rated "numbers" are sent into the Predictive Modeling system it takes those "numbers" and gathers other information including your Equifax credit score (we store them in our databases and if we don't have it we cal
Hmm (Score:2)
So Equifax continues to provide credit scores even when the target has frozen it?
But... (Score:2)
...did you buy outright, or get a loan from the dealer? Sounds like the former, so credit frozen didn't affect the transaction.
Re:Dicey from start to finish (Score:4, Informative)
850 is the max for the scale people generally refer to when talking about credit scores. Googling around, some banks seem to use internally a different score scale, but let's set that aside for a sec.
People can, and in fact do get perfect score. If you understand exactly how it works, its' not that difficult. It has very little to do with how much money you make, and is a pretty artificial metric.
When you get a report and it says things like "too many accounts with balances open", it doesn't mean "you have too many accounts with balances open". It just means you don't have -precisely- the amount of accounts the algorithm uses for a perfect score, so you lost a non-zero amount of points for it, and since you said you have a mortgage, it's probably what it's referring to.
To get a perfect score, you need a bunch of accounts open, that were opened several years ago (none recently), that are used but have 0 balance at the moment they were audited. Your available credit across those account has to be very high, and you need multiple accounts from different credit providers. There are a few other factors, but if you do it just right its pretty simple, given enough time, to manipulate your credit to get a perfect score.
In fact, some people make a game out of it. The only gotcha is you have to use those accounts sometimes but they have to be at 0 or nearly 0 the moment they're reported, and you never know when that will be (since it can change). So often you'll hover between 845 and 850 (or whatever other scale you're looking at, though those may have slightly different criterias)
Re: (Score:2)
850 is the max for the scale people generally refer to when talking about credit scores. Googling around, some banks seem to use internally a different score scale, but let's set that aside for a sec.
People can, and in fact do get perfect score. If you understand exactly how it works, its' not that difficult. It has very little to do with how much money you make, and is a pretty artificial metric.
Another big misconception about credit scores is that a "perfect" score is best. A credit score isn't how likely you are to pay back a debt, its a measure of how much money a lender makes on average on your debt. So if you always pay on time or ahead of time, then your credit score can actually go down. Keeping a small balance on your credit cards causes your credit score to go up because you are paying interest. So a good credit score can actually better for you than a perfect one as it means
Re: (Score:3)
No recent revolving balances (Score:2)
I hadn't realized this myself, and do in fact have 3 -- soon to be 4 -- no-AF
Re: Dicey from start to finish (Score:2)
FICO? (Score:2)
I just checked again. It is service provided by citibank's account page "check your FICO® score". The values are Mar: 867, Apr: 863, May: 867, Jun: 867, Jul: 856, Aug: 856.
My guess is the drop in July had to do with us getting a line of credit against the equity in our house.
At the bottom of the chart it says "Score ranges is 250 to 900." I have never found an explanation as to why credit score ranges don't use a more intuitive scale, such as 0-100 but they have always done this.
Re: (Score:1)
But the person did give them permission.
Re: (Score:2)
They can't just get your report for no reason
Correct. The dealership had to get my sign-off to get the report for which they paid. (At least up front -- I am sure they made a profit off the sale). I signed off because I didn't feel any reason not to but I wonder what they would have done had I refused.
As for "reason" I suppose they consider themselves vulnerable to scams. When I said "cash" I really meant personal check which of course be kited. Of course also they could have called the bank to clear it. Maybe they had some kind of insurance
Re: (Score:2)
Don't forget that credit scores cost money.
Re: (Score:2)
Credit is a scam so wise up and don't use it. Buy things you can afford with money you have.
Credit is a scam on those willing to be scammed. The term "loan shark" is quite honest about this.
However the credit card companies offer lots of benefits and perks. If you don't fall into the interest and finance charge trap (mostly by living beyond your means) credit cards are quite worth having.
Try renting a car or buying an airline ticket or checking into a hotel without a credit card. It can be done but it is a hassle.
On top of that I get airline miles with every purchase and that indeed is a good
Re: (Score:2)
Beware of TrustID (Score:2, Informative)
According to my sources, a condition for enrolling is giving up your right to participate in a class action suit against Equifax. At least, read the fine print before signing up.
Personally, I'd just lock my credit records with Equifax. Leave them open with the other agencies, so lenders can still approve loans. Just not with Equifax.
Re:Beware of TrustID (Score:5, Interesting)
Personally, I'd just lock my credit records with Equifax. Leave them open with the other agencies, so lenders can still approve loans. Just not with Equifax.
Is your name, address, birthdate, social security number, etc., with TransUnion and Experian different than the information leaked by Equifax? If so, why do you only worry about locking Equifax?
Re: (Score:2)
Re: (Score:2)
Given the comments on the related articles, it seems to me that a lot of people here have never had credit except for maybe their government guaranteed student loan for their gender studies.
Re: (Score:2)
why do you only worry about locking Equifax?
Because they are fuck-ups and don't deserve my business. There's nothing I can do about information that is already out there. But I can discourage banks and other lenders from taking my business to Equifax by never granting an unlock request for credit through them.
Re: (Score:1)
All you'll do is discourage those banks and lenders from doing business WITH YOU and nothing more.
Re: (Score:2)
Fine. There are other banks.
Re:Beware of TrustID (Score:5, Interesting)
All you'll do is discourage those banks and lenders from doing business WITH YOU and nothing more.
I disagree, this is the first good idea about what to do about Equifax I've heard. If many many people all locked their Equifax accounts, then lenders would start expecting that this is common, rational behavior. They would then stop seeing the need to use Equifax. This is the first real idea that has a chance at actually impacting their business which is the only way to reform this horribly broken industry.
Re: (Score:1)
But everyone is not going to do it. A tiny fraction might and not much more. That's why no bank or lender is gonna care because they can move on to the millions of other people who aren't a hassle to deal with.
Re: (Score:2)
Your sources are incapable of reading, direct from the site - "2). NO WAIVER OF RIGHTS FOR THIS CYBER SECURITY INCIDENT
In response to consumer inquiries, we have made it clear that the arbitration clause and class action waiver included in the Equifax and TrustedID Premier terms of use does not apply to this cybersecurity incident."
Re: (Score:2)
Six months down the road, my credit goes to shit because of the hackers. And TrustID proves to be useless. Where did I indicate that I applied for it specifically because of this incident? Absent that, standard TOS will apply. We can't even get a straight answer as to whether we are or are not a part of the affected group (the subject of this thread).
Wow (Score:1)
It's like they don't have any shame at all...
Oh wait, they don't. Of course they don't.
It's a company that profits from digging up people's information, storing it in an insecure manner, where executives thought it was fine and dandy to hold up breach information for just enough time do some insider trading, save their own asses, and leave costumers to burn.
And can you take a wild guess on what side the current administration in which no one watches the watchmen will take?
Do read the ToS of equifaxsecurity2017.com (Score:3)
Dated September 8, 2017. It's as bad as the article claims https://trustedidpremier.com/s... [trustedidpremier.com]
LOVE IT (Score:2)
Dumpster fire. Train wreck. Shit sandwich.
As Angus Deayton used to say ... (Score:2)
So, no change there then.
Everyone...it was everyone (Score:5, Interesting)
These data breaches follow an inevitable life-cycle:
1) Initial release: "We had a data breach which effected some, but not all, of our customers. The data breach was limited, and did not include bank account numbers, CC numbers, etc."
2) A week or two later: "The data breach we reported may have included more customers than we initially reported. Some customers may have had sensitive information like CC information and bank account information compromised."
3) A month later (in a quiet press release late on a Friday afternoon): "It was everyone, and they got everything."
Re: (Score:2)
Re: (Score:1)
Don't forget 0): Executives sell personal stock in the company shortly before the initial press release.
Re: (Score:2)
followed by a statement that 'they take security very seriously'.
Code for "verifying" whether you are affected (Score:1)
Re: (Score:1)
I agree.... (Score:1)
bait (Score:2)
Let's see, you have to give up your right to sue in a class action, and all you get is random bullshit that tells you nothing anyway.
This smells like nothing more than bait for an immunity grab.
Good riddance! (Score:1)
It is a totally incompetent company anyway; a useless, outdated service that serves only it's stockholders.
Umm, I mean USED to serve it's stockholders. Now it serves no one. Go away.
Re: (Score:1)
"If an otherwise scummy company like BofA or Wells Fargo said they would stop using them..."
The problem here of course is just who owns these Credit Reporting Agencies. For instance, TransUnion is mostly owned by Goldman & Sachs. Remember them?
Pimps own the Whores, even as they hide in the shadows.
Don't even get me started on that mostly American phenomenon- "Title Insurance". If you have Title Insurance on the home that you own, and you almost certainly do, Banks require it, pay attention to the fine p
Re: (Score:2)
I wouldn't be surprised if Equifax just manufactured this breach to push their TrustID product.
If a company were to "manufacture" such a breach, then they would also sell the information on the black market which adds another win.
Essentially, if they say that they were breached, then your data is out there even if they werent breached.
Re: (Score:1)
Re: (Score:2)