Equifax CEO to Congress: Not Sure We Are Encrypting Data

https://www.wsj.com/articles/equifax-ceo-to-congress-not-sure-we-are-encrypting-data-1510180486?mod=yahoo_hs&yptr=yahoo

by boyd • 9 years ago

289 156 9 years ago

mrguyorama2• 9 years ago

I don't know which is worse: That Equifax is straight up lying about their infrastructure to hide malpractice, or that they don't even know

sova5• 9 years ago

Encrypt your secrets in plaintext, the hackers will never see it coming

nobodyorother• 9 years ago

I just use double-ROT-13 as my TPM, that way I can invoke the DMCA too!

colejohnson662• 9 years ago

Why not 2ROT13? http://www.pruefziffernberechnung.de/Originaldokumente/2rot1...

porfirium• 9 years ago

People responsible for data protection in Equifax know perfectly well how the data is stored[]. The CEO, evidently, does not. No news here, just a headline to provoke outrage.

[] Yes, "no protection" is also a way of storing data.

ryandrake• 9 years ago

You'd think that when you're the CEO of a company going off to talk to Congress about your company's recent data security problem, you might, I dunno... bone up on a few pieces of information about how your own company does security? Crazy thought, I know.

leggomylibro2• 9 years ago

"Honestly, Senator, does it really matter at this point? The data is all out there now anyways, you'd may as well just let us carry on unless you want to give us a 9-figure contract to update our own infrastructure."

...Is what I can only imagine is being said when the cameras are off.

craftyguy2• 9 years ago

Well didn't the IRS hire equifax right after the breach was exposed publicly?

janesvilleseo• 9 years ago

Is there any way for me to get my information removed from Equifax?

Do I need to contact all of my line item creditors and ask them to remove references to Equifax?

username2232• 9 years ago

Is there any way for me to get my information removed from Equifax?

No. Pay cash or get tracked.

caio1982• 9 years ago

Tracking is different than having your score data stored somewhere. Do you have a source for your "no" by the way? I'm genuinely curious.

astura6• 9 years ago

Paying cash doesn't guarantee you won't end up in Equifax's databases. Your employer may report your income to The Work Number (owned by Equifax), your landlord may report your payment history, etc.

Furthermore, your case of "pay cash" pretty much excludes you from higher education and home ownership. Unless you are super wealthy.

toomuchtodo2• 9 years ago

Is there any way for me to get my information removed from Equifax?

No. (EDIT: If someone has a better idea, please reply!) I filed a complaint with the CFPB with citations from their breach as well as congressional testimony requesting my credit file be removed. The response was boilerplate:

"Thank you for contacting Equifax. We remain focused on consumer protection and committed to providing outstanding service and support. Protecting the security of the information in our possession is a responsibility we take very seriously and we apologize for the concern and frustration this cybersecurity incident causes. We have developed a comprehensive portfolio of services to support all U.S. consumers. Please refer to our dedicated website, https://www.equifaxsecurity2017.com, for the latest information and updates or contact our dedicated call center at 866-447-7559. The call center was set up to assist consumers and is open every day (including weekends) from 7:00 a.m. – 1:00 a.m. Eastern Time."

Do I need to contact all of my line item creditors and ask them to remove references to Equifax?

Even if you contact your creditors, Equifax is under no obligation to remove the data. Most credit lines have the possibility of falling off after 10 years (7 years for negative trade lines), but there is no obligation for them to be removed.

existencebox• 9 years ago

I'm honestly curious if Equifax would fall under GDPR regulations? I'm sure there's some overlap of EU citizens who have lines of credit in the US.

We're having to prep for that at my corp currently, and it's VERY explicit about being able to pull up and remove all personal data, with some very hefty fines if you don't.

EDIT: thought about this further and peeked at our guidelines, they may be able to get around this by the "data is integral to the function of the business" exemption, but I'd still wonder if someone could speak with authority on this.

dawnerd• 9 years ago

Fairly confident the CFPB does absolutely nothing to read complaints. I send in one for each credit agency and got the same boilerplate even though my complaint had nothing to do with the breach.

794CD01• 9 years ago

It's not your information in the sense of you having any ownership or control over it. It's just information about you. I got information about you by looking through your comment history. You cannot make me forget it. Lucky for you, I will anyway in a few minutes, since I am not in the business of selling that kind of information and thus don't really care.

nostrademons3• 9 years ago

While what you say is factually true, does anyone else find it morally repugnant? The idea that information like your genetic code, behavioral data, photos of your likeliness, etc. might be owned by someone else strikes me as both slightly ridiculous and incredibly dehumanizing.

swalsh• 9 years ago

Not a lawyer, curious if this would be a violation of https://www.law.cornell.edu/uscode/text/15/6801

Equifax themselves are not a financial institution, but as a vendor of one, would it not apply to them too?

leggomylibro2• 9 years ago

Doesn't matter; realistically, laws don't apply to them.

(Also not a lawyer)

TylerE• 9 years ago

Just give them the corporate death penalty all ready.

cdolan• 9 years ago

It may be appropriate, but that is such a rare tool to have used, you could argue that it should be avoided at all costs. Watching the government unravel companies just strikes me as dangerous.

That said, I find these credit agencies to be absurd, and need to either disappear or 100% change their business.

ouid2• 9 years ago

you could argue that it should be avoided at all costs

ok, argue this.

sova5• 9 years ago

How many years can a corporation spend in jail?

JumpCrisscross• 9 years ago

What does that mean? The government just takes investors’ property when it doesn’t like what they do? That’s called expropriation. It redistributes the assets to the shareholders? They could just reconstitute the parts. This concept does not happen because it is silly.

icebraining2• 9 years ago

If you forced them to stop doing business and sell their assets, the shareholders would just get money. You can't simply rebuild a company from that, not to mention they'd probably get a significant haircut from that forced sale.

benchaney• 9 years ago

In this context the "Corporate death penalty" could just be allowing them to get sued for the full amount of the damage they caused without baling them out. In practice, there is no way that they could survive that.

orangepenguin• 9 years ago

Can anyone give a summary or point me to another article (not paywalled) with similar information? I'm very interested, but don't have a WSJ subscription.

ng-user• 9 years ago

I second this

bonestamp2• 9 years ago

Non-Paywall version http://archive.is/ikG4d

Source: u/neurotech1 https://news.ycombinator.com/item?id=15672691

plandis• 9 years ago

This guy needs to be held personally responsible. But he won’t be and that makes me extremely mad.

It sucks that the rich and wealthy can be as morally bankrupt as they want without any/many consequences.

malux85• 9 years ago

Thank you. Understanding enough encryption to know how to protect your company data would take about 1 day of learning, every CEO should know this, no excuses.

I dont expect them to be able to debate cipher strengths or argue key length, but I do expect them to know about Machine-To-Machine communication, Data at rest, One-way encryption and what it takes to be HIPAA compliant etc, it's their job to know this, and it's NOT HARD. I makes me mad too.

jnwatson• 9 years ago

Equifax doesn't store medical data, so HIPAA doesn't apply.

Here's the thing: short of some California disclosure laws, it isn't clear that Equifax broke any laws, or even any contracts.

They don't have any particular duty to protect the data they have about you, other than protecting their own IP. Equifax is a clearing house for information that people say about you.

Look, if I follow you around, reporting all your movements, write it down, and then my notes about you get posted on the internet, what law did I break? (Equifax used to report "his marital troubles, jobs, school history, childhood, sex life, and political activities", so it isn't that far of a stretch).

Given that perspective, it makes sense that they would protect the data as much as any data vendor would. Certainly they didn't predict the PR backlash such a failure would cause and should have factored that in.

firloop• 9 years ago

To be fair, the headline quote is from the interim chief. Richard Smith, the CEO at the time of the breach, has already resigned.

FRex• 9 years ago

The interim CEO is not a complete newcomer though, he was in Equifax since April 2010[0] and is former head of the company’s Asia-Pacific business[0]. And considering the huge controversy around the data, it being their main/sole business and the fact it made his predecessor step down he should take a bit more interest than random journalists and randoms online to understand crystal clear what's going on in there, especially when preparing to go to a hearing in Congress to get drilled about it.

Then there's this gem [0]: "Barros also led the company’s U.S. Information Solutions (USIS) business, which includes U.S.-based services that provide businesses with consumer and commercial information and insights related to areas of risk management, identity and fraud, marketing and a variety of industry-specific solutions."

[0] https://www.equifax.com/about-equifax/corporate-leadership/

neurotech1• 9 years ago

Non-Paywall version http://archive.is/ikG4d

pogue• 9 years ago

Thanks for this. Also, for future reference, can you just paste wsj article URLs into archive.is and it will go out and pull the non paywalled article? Or does archive.is get the cached page from your browser or something?

tptacek11• 9 years ago

Encryption wouldn't have mattered here. To a pretty good first approximation, none of the "encryption" done at scale at any Fortune 500 company in the US is more than a speed bump for attackers. Unless you're using moon math --- nobody is --- enterprise backend encryption is hamstrung by the fact that you're keeping the data because automated business processes need to use it, which means automated systems need to decrypt it.

sova5• 9 years ago

You mean because the data is used in a readable form at some point or another, a compromise would have resulted either way? Can't say I'm sold, my friend.

tptacek11• 9 years ago

Yes: because the point of encryption is to protect you from a compromise in your server (that's what happened at Equifax), but for the server to be able to use the data, it has to have have some means of getting plaintext access to it. Once you've lost your server to an attacker, you've lost control of that mechanism as well.

This is a problem even with HSM designs; in real-world systems, HSMs usually just present an oracle interface to data. The hope is that with sufficient monitoring, you can use the oracle to buy time for defenders to detect a compromise before all your data is exfiltrated.

I think most penetration testers have the experience of owning up a server and going on the brief treasure hunt for the static key stored somewhere on the filesystem.

itissid• 9 years ago

Once you have remote code execution with privilege escalation on box Z, no amount of encryption can save at least box Z

Johnny555• 9 years ago

Encryption wouldn't have mattered here

I think you mean "encryption wouldn't have mattered for the known attack", but there are lots of cases where encryption would help... even in cases that don't involve hacking, like hard-drive disposal.

kakarot• 9 years ago

Isn't that what he means by specifying "here"?

wonderous• 9 years ago

What is moon math?

saulrh• 9 years ago

Presumably whiz-bang space-age cryptostuff, homomorphic encryption and differential privacy et. al.. Things that'd be spectacular if you found them in a startup two years from now, much less in an enterprise that hasn't done any core tech upgrades since 2005.

tptacek11• 9 years ago

Anything where the underlying math hasn't been proven at Amazon/Apple/Google scale, and/or isn't available in production-ready form in open-source software, and/or is heavily patented.

reza_n2• 9 years ago

We have an encryption scheme where all user data has its own unique user based key. So compromising 1 user key only lets you have access to that user data and that key has access to nothing else. Your statement is correct when you said that automated systems which need access to all data will inevitably lead to mass decryption and compromise. In the system described above, there is no way for an automated system (or anything) to have access to all keys and therefor no system or person can access all data.

kabdib2• 9 years ago

How does this help if you've got an API that decrypts for you?

It's possible that you've protected the data at rest, but if some 'get' operation is just going to serve it up, what is the effective difference?

SAI_Peregrinus• 9 years ago

Remember that the users in this case are the banks. Their data wasn't what got leaked. Product data got leaked.

skosch• 9 years ago

Thank you for bringing sense into the discussion. I don't know how many times I've been asked "but will our data be encrypted on your server, in case someone hacks it?" and I need to explain this basic concept to otherwise intelligent people. It's like demanding that the driver's side door in a car must have a child lock installed.

technion• 9 years ago

I'm interested in a genuine discussion about how to answer that. For all the commonsense explanations you could give like that ones in this thread, all a client tends to hear is "anyone can hack it".

For all the horrible stuff ups Equifax management has had, it sounds like congress would be substantively happier with them if they said "yes our SAN has an FDE feature". The media would certainly be kinder to them.

I'm in two minds about rolling something objectively pointless just so I can address these sorts of concerns.

schoen2• 9 years ago

This is an excellent point, but you can also envision attack scenarios in which only parts of a distributed system are compromised. In that case, the inability of some systems to read the data that they store could be a benefit because the systems that are compromised are not absolutely guaranteed to be the same systems that possess the keys.

One nice example of this which I once saw in a real system is that a system that collects credit card numbers from the public might not need to be able to read those numbers after they're recorded, if the charges are going to be made by a later batch process. So the credit card number receiving system can use a public key to encrypt the incoming data in such a way that the batch processor will later be able to decrypt it. In this case, there is certainly a machine that has the capacity to read the data, but it's not the same machine that stores the data or that is exposed to connections from the general public. (But that paradigm is a lot easier for the case of offline batch processing, which is mostly different from the applications that you were describing... but wherever a system has a component like this, it may be possible to reduce the window of exposure with this pattern.)

Another example is that a database server might be compromised via a different vector from its clients. If some database fields were encrypted, the impact of a database-only compromise would be reduced.

Edit: elsewhere in this thread someone points out that your argument may be meant to be more specific to this breach, and I think it's most likely right with respect to this particular incident.

da_chicken2• 9 years ago

Well, that depends. If the attackers gain complete control of the automated application, they can potentially decrypt the entire system (or, at least, the parts that application has access to). If they only gain access to just the datastore, they may or may not be able to decrypt the data -- the encryption keys might not be in the datastore at all. It depends on the manner and scope of the access that's gained.

tptacek11• 9 years ago

As a general rule, if you get the database, you can assume remote code execution.

If you're a defender, I would go further and say you must assume it.

lawnchair_larry• 9 years ago

It wouldn't have mattered, but they should absolutely still be doing it to mitigate exposure through loss of physical disks, and this question should be an easy yes.

The other reason to do it, frankly, is because when you end up in the news, this is the first thing everyone asks. It's easier to say yes than to "no, but..." and explain why this is a dumb question to ask (as you are trying to do here, with a far more technical audience).

tptacek11• 9 years ago

I mostly agree, but my concern is that this is not the perspective most people, including practitioners, are bringing to the discussion when they talk about "encryption". They mean, "if you had encrypted, this data never would have been exfiltrated in a breach". Which, of course, is false.

Blazespinnaker2• 9 years ago

It's called defense in depth. Google the term, it's a useful mechanism for real security.

tptacek11• 9 years ago

If that's true, why encrypt just once? Why not three times, and then add a rot14 just to be safe? Every millimeter of depth counts!

lmkg• 9 years ago

My understanding is that many businesses choose to encrypt their data because many laws requiring disclosure of data breaches have an exception for encrypted data (few of these laws have a good definition of 'encrypted'). Businesses are encrypting in a way that legally mitigates the PR risk, and not particularly paying attention to the actual security risks.

walshemj• 9 years ago

Simples use HSM's and use proper physical security

girvo2• 9 years ago

We’re using spooky moon math (semi-homomorphic encryption in a rather restricted case, mind you) for exactly this reason for the 4 biggest companies in a huge industry here in Australia. These companies are starting to understand why it might be needed, which is super exciting. And hell, even if the prototype gets killed, it’s been fun as hell to work on.

tinco• 9 years ago

What kind of operations are you able to do on the data?

adrr• 9 years ago

Encryption would have reduced the damage if encryption was done right. There's no reason for a front-end system to have access to SSN and with modern secure storage like Vault you can grant encryption(Write) and decryption(Read) rights specific to each app on your platform.

tptacek11• 9 years ago

Vault is designed for application configuration secrets, not for at-scale storage of raw business data.

bskap• 9 years ago

Having separate read and write permissions is entirely orthogonal to having encryption. That certainly would help (assuming the compromised system didn't need to have read permissions), but you don't need encryption to implement that and adding encryption doesn't imply that you've done it.

justicezyx• 9 years ago

Why encryption wont help?

Is it because the keys are easily comprimisable, or stolen?

AnimalMuppet• 9 years ago

Because the attacker is in a position to query the database. That (probably) means that they have compromised one of the machines that can legitimately query the database. But if that machine can query the database, and the data in the database is encrypted, then that machine must be able to decrypt it, or else it can't use it. So the keys must be on the machine - and the attacker has compromised that machine. Or else, that machine has authorization to send requests to some other machine that is the decrypting authority - and the attackers, by having compromised that machine, have gained the ability to send requests for decryption.

TL;DR: If a machine can actually use the data in the database, it has to be able to get the data in a decrypted form. If an attacker compromises that machine, the attacker can also get the data in decrypted form.

mseebach• 9 years ago

All the best locks in the world doesn't help one iota if your attack is to get the janitor to open the gate for you.

The compromised component at Equifax was the running application which is built to retrieve data from the database - it knows how to log in to the database and do whatever decryption is required to retrieve data. You don't particularly need to compromise passwords or encryption keys or whatever, because the application will just use them for you.

Encryption protects against compromising the server itself either physically or at the OS level, which is not nothing, but also doesn't help if you have an underpaid janitor with a gambling problem with all the keys in his pocket guarding the loading bays out back.

patio11• 9 years ago

For some color here, the Fermi estimate for number of unique consequential writes Equifax will make in a day is about ~1 billion and the number of "pull that entire file, please" is in the tens of millions.

All the data is hot data. That's what Equifax exists at all. There are multiple internal services which can cause "pull that entire file." If you lose any of them, your data store doesn't matter; there goes the ball game.

Someone's about to say "But rate limiting!" and not understand that Bank of America can ask for 10 million files at a time. (One cron job talking to a another cron job, etc etc, will fetch an update to a substantial fraction of all of their customers to update their internal records for underwriting. A larger recurring use case is "Refresh the soft pull on everyone in our marketing funnel whose pull is stale." Note that that is a sizable portion of the adult population.)

tialaramex• 9 years ago

One good thing you get out of encryption at rest is that when some fool loses the backup tapes, or sells old servers to a "certified" recycling business that turns out to just put them on eBay without wiping anything, you may still be fine. So long as the keys weren't on the same tapes/ old servers.

It's small, but it is something.

sanmon3186• 9 years ago

none of the "encryption" done at scale at any Fortune 500 company in the US is more than a speed bump for attackers.

So why Fortune 500 companies only? I am just trying to understand what this has to do with the scale of a company.

jdavis703• 9 years ago

Well I heard from the FBI that only criminals encrypt data using these fancy counting machine things. So it seems like Equifax may have actually done the right thing here. /sarcasm>

On a serious note, we really need to make encryption a part of high school mathematics. What teenager doesn't want to write secret messages?

When I took an intro to security course in college we spent a couple of classes building a very elementary understanding of how encryption works with plenty of hands on examples (using laughably insecure algorithms, but still enough to get the points across). I think most students found it the most interesting part of the course since most everything else was more about security policy (a MBA could've probably easily taken the course successfully).

Balgair2• 9 years ago

Taking a chance of derailing the thread here, sorry:

SO taught HS freshmen in physics (close, but still). I'd say we need to make math a part of HS mathematics. ~60% of the kids can't do algebra in any way. Really. Trying to make encryption a part of it is essentially useless. I hear from time to time that a 'basic-adulting' course would be great to have had. HA! You think mortgage interest rates and basic car maintenance would be learned? Most HS students in the US can barely keep from snaping their genitals at each other during class. Find me a cell-phone jammer that the FCC will approve of for under $200 and EVERY teacher in the US will buy five that very same day. You'd make billions.

tlrobinson• 9 years ago

Business idea: Faraday cage classroom kits.

crankylinuxuser• 9 years ago

So, has the data been actually leaked, or do you still have to pony up a load of BTC to see this?

ineedasername• 9 years ago

At this point I think there is literally nothing about Equifax incompetence that would surprise me. I mean nothing.

They could reveal tomorrow that their data center fire protection protocols mandate the use of printed backups, feeding them to the flames with hopes the god of data destruction would be appeased and leave their servers alone. I would not be surprised. Nor would I be surprised if the paper backups were only available as printouts on toilet paper, 1000 miles away, in the CEO's office.

No, my reaction would be, "sounds about right for them, though I guess it's +1 point for effort on keeping any backups at all"

jve• 9 years ago

I would like to quote PostgreSQL Experts (this applies to all DBs): FULL DISK ENCRYPTION IS USELESS. [1]

FDE protects against… • … theft of the media. • That’s it. • That is about 0.00000002% of the actual intrusions that you have to worry about. • Easy rule: If psql can read it in cleartext, it’s not secure. • (It’s a great idea for laptops, of course.)

And then it recommends: "Always encrypt specific columns, not entire database or disk"

However encrypt your backups.

I think it is fairly sensible.

[1] Securing PostgreSQL [PDF], Page 31 : http://thebuild.com/presentations/pgconfeu-2016-securing-pos...

markarichards• 9 years ago

If encryption is enriched with appropriate identity, authorisation and authentication systems then...

Encryption at network level is a must. Corporate routers/firewalls have been very vulnerable before and the risk of grabbing everything is a lot easier if you've comprised the network.

Encryption at rest is a must, as at some point you need to replace those disks and it's a lot easier if you can be cavalier with the handling afterwards because you know it is unreadable.

Encryption at application level (object encryption and between services) is a must. Which means if a service is hacked or you dump the dB you may not be able to read any of it or only those records accessed whilst the hack happens. You replicate access control patterns, like in a secure building... These may come down to one or more common denominators (can you trust the security receptionist), but better that than the whole chain is vulnerable... You then only have one set of alarms, logs, metrics, etc to keep an eye on and to test very thoroughly.

In the physical world: for security scenarios we have very strict procedures with locks, boxes, safes, multiple security door/gate entry systems, multiple participants and signatures involved in every action, etc to mitigate internal and external error, failure or attack - all of these can have an electronic information system equivalent and we should start designing security in web systems with these ideas in mind when it as significant as Equifax.

Equifax CEO to Congress: Not Sure We Are Encrypting Data

Related Stories