Equifax website hacked again, this time to redirect to fake Flash update

https://arstechnica.com/information-technology/2017/10/equifax-website-hacked-again-this-time-to-redirect-to-fake-flash-update/

by Larrikin • 9 years ago

390 96 9 years ago

arstechnica.com

gaius• 9 years ago

I am not generally a fan of heavy handed regulations but the government needs to step in and shut Equifax down right now. Literally pull the plug on everything they own.

theyregreat• 9 years ago

Updating James Madison:

If everyone were honest, neither greedy nor malicious, did pay attention, were competent, including securing their apps, and didn’t have either fires, floods or roads, no regulation or government would be necessary.

eradicatethots2• 9 years ago

I think we should still strive to move towards being that way. Greed and maliciousness breed greed and maliciousness and it’s be good to root them out wherever we can.

emmab• 9 years ago

If they have this much trouble with security imagine what else they might be failing at unbeknownst to us.

bryanrasmussen• 9 years ago

drinking water without it dribbling out the corners of their mouths?

dcow• 9 years ago

I'm not sure what's worse: the fact that Equifax just got $7.25M for identity services from the IRS or the realization that the IRS just spent $7.25M on data they can get for free...

TeMPOraL2• 9 years ago

That $7.25M went to get the data of the different colour than the data they could find for free. Even when stuff is bit-for-bit identical, sadly, color matters. IRS needs to have the data painted "official", not "from a hack".

http://ansuz.sooke.bc.ca/entry/23

porfirium• 9 years ago

That's like saying "I just spent $100 on this piece of software I could have torrented"

HHalvi• 9 years ago

What's their excuse this time ? A single worker brought in a cat that bit our entire server facilities power supply ? Or some random guy who handled credentials was picked up by Aliens.

eltoozero2• 9 years ago

Aliens would be about the only acceptable excuse.

Russian aliens.

TeMPOraL2• 9 years ago

Mars is Red. Coincidence?

pilsetnieks• 9 years ago

You know how "admin:admin" aren't very good credentials for a supposedly secure production system dealing with sensitive information? Well, turns out, neither is "admin123"

ecshafer• 9 years ago

Issue closed. Credentials updated to admin123! For increased security.

jonssons• 9 years ago

what. again?

eltoozero2• 9 years ago

Part of me says "wow, what blatant incompetence", but the part of me that does IT consulting is not surprised.

warent• 9 years ago

This isn't fair and they need to slow down; I want my small claims lawsuit to pay off before they put themselves out of business.

YPCrumble• 9 years ago

Say more please! What are the damages you claimed?

Just having your personal information stored insecurely should be grounds enough for damages but in the world of "identity theft" I didn't think it would have a case in small claims.

0xfeba• 9 years ago

Yeah, good luck showing damages. You basically have to wait until your identity is used for fraud, and then probably tie it specifically to the breach.

rlvesco7• 9 years ago

Noticed this on Monday. After registering for fraud alert, they send an email that has link to http://www.equifax.com/fcra for free credit report. This was getting hijacked. But not if you used https://

Matt3o12_2• 9 years ago

Why would they send you to a http at all if they already have https. This just seems like complete incompetence. It’s not like they have an excuse like their ad networks don’t work with https.

froindt• 9 years ago

Someone in marketing probably didn't know that it mattered. Same with the head person who approved the email.

But don't worry, they'll have an engineer approve it next time as well!

BearGoesChirp• 9 years ago

I know of companies with typos in their links that they email. These typos lead to scam sites. I've contacted them and they haven't yet fixed it. There needs to be a serious re-evaluation of the costs associated with failing such basic security measures like using https and just making sure you send people the correct link. Right now it isn't even a slap on the wrist.

reaperducer• 9 years ago

Probably because security is handled by the IT department, and email communication is handled by the much less tech-savvy Communications department.

tyingq7• 9 years ago

The specific js that was hijacked is here: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js

That page pulls it in.

Edit: maybe a red herring. Sure looks shady though.

Sujan• 9 years ago

g0510513• 9 years ago

So was it Equifax that was hacked, or Fireclick?

jbeales2• 9 years ago

If you don't want to pull out your phone, throw Chrome into Responsive Design mode and you'll get the same results.

jbeales2• 9 years ago

Looks like they just took the page down as I was poking around trying to figure out where the redirect(s) came from.

Edit: Of course the error message is truthful:

The Equifax.com website and Equifax Member Center are experiencing unusually high volumes due to responses to the recently announced Cybersecurity Incident. We are working diligently to better serve you, and apologize for any inconvenience this may cause. We appreciate your patience during this time and ask that you check back with us soon.

hacker_9• 9 years ago

I assume this must be because after the initial hack, every kid with a script pointed it at Equifax to see what they could get too. I would not want to be in the IT department at that company right now.

mrguyorama• 9 years ago

If the average script kiddie can meaningfully compromise your infrastructure, aren't you already screwed? Pretty much every automated attack possible is launched at every internet addressable server on a daily basis. I ran a web server for a couple years with nothing on it but nearly empty personal sites and files, and over 50% of its hits were automated scans and attacks

pbadenski• 9 years ago

Makes me think. Can I ask my bank to stop sharing my data with Equifax. Would they honour the request? Anyone working for a bank, what do you think?

jon-wood• 9 years ago

At least in the UK it's a legal requirement for banks to share details with credit rating agencies, so no, they couldn't if they wanted to.

Silhouette• 9 years ago

Can you give any more information about that, please?

Certainly when you apply to use financial services in the UK the terms often include consent to share your data with credit reference agencies, but this is the first time I've ever seen a suggestion that banks were required by law to do so.

If that's the case then, given the demonstrable incompetence of Equifax, that law should be changed immediately!

rahimnathwani3• 9 years ago

I don't believe that's true. (If it were, I could set up a credit rating agency, have all the banks share details with it, and then have free credit reports for my own (hypothetical) consumer lending business, rather than paying a pound or two for each pull.)

Care to cite the specific law? I'd be very interested in knowing, if such a law exists.

rahimnathwani3• 9 years ago

Credit rating agencies provide ratings for securities (e.g. corporate bonds). Their clients choose to pay them to issue ratings, so that the buyers of the securities will be more likely to buy them.

Credit reference agencies (Experian, Equifax, Callcredit) collect information about individuals and provide that information (credit history) to lenders for a fee.

There's no statutory obligation for banks to provide information to CRAs[0]. But agreements between CRAs and their clients (banks and lenders) generally requires that, if bank A uses CRA B to get info on prospective customers, then bank A must also report details of all its customers to CRA B.

There's some truth to what you said, though. It's often a problem for SMEs (small/medium businesses) to get loans. And, since only the bank they use for day-to-day banking has a good idea of their creditworthiness, they can't easily shop around to other banks. So there's legislation which forces the largest banks to make that information available to 3 CRAs, which must provide them to any lender which asks. BUT this only applies to SMEs (not consumers) and any SME can opt not to have their information shared in this way.[1]

[0] https://ico.org.uk/for-the-public/credit/ "As there is no DPA requirement for lenders to report such data to the credit reference agencies, it is up to the lender to decide which credit reference agency they wish to use, if any."

[1] https://www.gov.uk/government/publications/designation-of-ba...

need2sleep• 9 years ago

Since when is it ok to publish this without a single shred of evidence to support the dude's claims?

Laughable to say the least.

Dude probably got owned locally.

eradicatethots2• 9 years ago

Maybe I’m not aware but I’m pretty used to just trusting large news outlets with good credibility on things like this

RainaRelanah2• 9 years ago

Not at all, the site is definitely compromised. Someone posted a link[0] that when I opened on mobile is redirecting to a malware site. Confirmed on two separate Android devices running 7.1 + Chrome.

[0] https://news.ycombinator.com/item?id=15456533

tyingq7• 9 years ago

Just tried http://www.equifax.com/fcra myself...it redirects to obviously shady sites, right now.

Edit: Currently it's doing it only for specific client user agents. Try an android one. This javascript is driving part of it: https://a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/se...

Edit: Found the bad bits. They are here: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js

See the part that starts with document.write()

Edit: maybe a red herring. Sure looks shady though.

ballenf• 9 years ago

What's the stack used for the real https version? I got redirected there (I guess malware doesn't like Safari desktop or uBlock origin saved me) and felt like I fell through a time warp to 2007 (update: 2004, in actuality) with the form Equifax presents. So much low-res skeuomorphism I almost got nostalgic.

Not necessarily related to the security issues, just curious.

Edited to add: The site has a Copyright of 2004. None of the JS tools are later than that. Is this really the current site in use? Unchanged for 13 years... wow. Would be sorta cool, you know, if it wasn't completely hacked.

didgeoridoo• 9 years ago

Want evidence? Click the link. Unless realcasinoslots.com is a creative new revenue stream for Equifax, the site has been hijacked.

ceejayoz3• 9 years ago

Unless realcasinoslots.com is a creative new revenue stream for Equifax...

I'm not sure if that'd increase or decrease their sleaze factor.

davidcollantes• 9 years ago

Does Randy Abrams has a website? Does anyone knows anything else about the source?

EDIT: Found it: http://randy-abrams.blogspot.com

noinput• 9 years ago

Maybe now they'll add the Hacker Safe badge to their site so this never happens again.

poorman• 9 years ago

Nothing surprises me these days. http://www.snopes.com/2017/10/05/equifax-contract-irs/

DarronWyke• 9 years ago

I used to work for Experian (I know, not Equifax, but it's an equivalent company).

None of this surprises me. These companies will do anything they can to protect and maintain revenue streams. This includes avoiding security.

sdshx• 9 years ago

It seems to be a random occurrence, I was able to trigger a pull of the infected page with the full request records:

https://tools.pingdom.com/#!/dWEfQI/http://www.equifax.com/f...

Interestingly, I ran into a similar issue with Yahoo earlier this week serving almost identical advertisements so this may be more widespread.

g0510513• 9 years ago

Equifax was loading this script: https://aa.econsumer.equifax.com/aad/uib/js/fireclick.js

This script, from Fireclick Web Analytics, then loaded a script via Akami CDN that was hosted for a Fireclick domain, netflame.cc: a248.e.akamai.net/f/248/5462/3h/hints.netflame.cc/service/script/www.annualcreditreport.com

So this package was not coming from Equifax, but was being injected by a compromised analytics provider.

FilterSweep• 9 years ago

That's Internet 2.0 in it's purest form, no?

easytiger• 9 years ago

Just got this same thing on some other site.

ceejayoz3• 9 years ago

We were just talking about the potential dangers of these third-party analytics scripts the other day.

https://news.ycombinator.com/item?id=15442636

Bartweiss• 9 years ago

This is only reinforcing my conviction that blocking scripts and advertising isn't a consumer decision but a security one. I'm not unwilling to be advertised to (or analyzed), but I'm completely unwilling to expand my vulnerability from "the site I opened" to "every external service they can think to load".

politician• 9 years ago

That's exactly the threat that Monday's post about Circle CI was about! Literally 3 days to a concrete example!

bkovacev• 9 years ago

Could you please give me a link to that? Are users in danger of a possible hack?

tyingq7• 9 years ago

After poking around a bit, the "netflame.cc" domain may be where this was compromised.

It used to be a Fireclick owned domain, but the current ownership might not be Fireclick.

Try: whois -h whois.dynadot.com netflame.cc | grep Registrant

The results don't really look like what they would be if Fireclick owned it. It's registered to a Thailand national using a personal gmail account.

Can't prove it, but I have a suspicion Fireclick let the domain lapse/expire, and some bad actor registered it, then figured out what content to post where, or got hacked themselves.

shallot_router• 9 years ago

WHOIS history on that domain shows the registration changed hands on November 15, 2016. Before that, it was owned by "Digital River, Inc.":

    Registrant Name: Digital River, Inc.
    Registrant Organization: Digital River, Inc.
    Registrant Street: 10380 Bren Road West
    Registrant City: Minnetonka
    Registrant State/Province: MN
    Registrant Postal Code: 55343
    Registrant Country: US
    Registrant Phone: +1.9522531234
    Registrant Email: hostmaster@digitalriver.com

Digital River appears to be an online commerce company: https://www.digitalriver.com/cloud-based-ecommerce-solutions...

They were probably the legitimate owners. The domain registration expiration date at that time was set for 2017, so it doesn't look like a registration lapse. It's unclear how and why the ownership was transferred.

yellowapple• 9 years ago

So which IT employee is going to be thrown under the bus this time?

MrGhrelin• 9 years ago

These people need to spend some money and get some good IT staff. The people at the top are getting all the cream, while the people that actually keep things going need an upgrade.

tony1013• 9 years ago

Equifax (and other sites that should care about security) should use Subresource Integrity, which prevents resources from being hijacked.

https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

LP550• 9 years ago

erlendr• 9 years ago

CSP.

Equifax website hacked again, this time to redirect to fake Flash update

Related Stories