It’s common for the exciting and novel issues that confront security professionals on a daily basis to be hyped up. Very often the reporting and discussion focuses on 0day exploits, nation state actors, sophisticated intrusions and theoretical attack classes. The reality, however, is much more mundane. This point is driven home by the GAO (General Accounting Office) post-mortem report of the 2017 Equifax breach. The GAO was asked to prepare a report detailing how the breach had occurred and what federal agencies could do to respond. There are lessons in the report for all types of organizations.
Recap
The intrusion is described in Figure 1:
Figure 1 – How the Equifax breach occurred
The reporting to date has focused on the Apache Struts vulnerability, which was known for two months before the intrusion happened. However, that wasn’t the only security issue that affected Equifax. The breach was undetected for four months, during which time the attackers were able to exfiltrate data from 51 databases. While the attackers did exhibit some tradecraft prowess by blending in with existing traffic flows to make detection harder, many mistakes were made, including the presence of unencrypted usernames and passwords in the environment, which greatly assisted the attackers.
Attacker Goals
According to the report, the attackers were searching for Personally Identifiable Information (PII). Specifically, the attackers made off with dates of birth, social security numbers (SSN), addresses, phone numbers, email addresses, driver’s license numbers, tax identification numbers, credit card data, as well as passport scans and other government issued IDs. Once found, the attackers exfiltrated the data in small chunks to better evade detection.
What went wrong?
The GAO report details two fascinating findings that give real insight into the security challenges that all organizations face.
1. Certificate expiration leads to loss of network visibility
Equifax had installed an SSL inspection device for monitoring encrypted communications in its networks. The attackers used encryption, presumably SSL/TLS, to conceal their activities. The SSL inspection appliance was intended to prevent such countermeasures. However, the certificate for the appliance had expired 10 months before the breach occurred. The consequence of the expiration was that the SSL inspection appliance “failed open”. That is, it continued to pass traffic uninspected. This greatly assisted the attackers in achieving their goals by not alerting the defenders to their presence in the network.
2. Communication failures lead to known vulnerabilities being exploited
The Apache Struts vulnerability that was used to gain initial access to the environment received much attention in the coverage of the breach. However, the GAO report adds some important nuance. According to the report, Equifax knew of the vulnerability in March 2017 when they were notified by the US-CERT (United States Computer Emergency Readiness Team) and circulated the notice to their systems administrators. Unfortunately, the distribution list for the notices was out-of-date, which resulted in the persons responsible for patching the affected systems not being notified.
Equifax also scanned their own network one week after the notice had been received. Yet, the scan failed to detect the presence of Apache Struts on their online dispute portal. Apache Struts is not as straightforward to detect on a web server as some other software where there is a clear banner or other information available to accurately fingerprint which software is running.
What can be done?
The following processes would have helped to mitigate the impact of the breach:
- Patch process: the GAO report stated that identification was part of the difficulty that Equifax faced when trying to patch their systems. Hardware and software asset inventory are the top two CIS critical controls for good reason but are very difficult to implement in practice due to the dynamic nature of modern IT environments. This is especially true when considering 3rd party software development, outsourced IT systems and mergers & acquisitions (M&A). Effective communication is essential for systems administrators to know about security-related issues.
- Monitoring process: protective monitoring is critical for detecting security breaches. Issues that can affect this, such as certificate expiration on a security appliance, should be prioritized. Proactive work is often required to ensure the health and correct functioning of security appliances. This also applies to tuning so that the number of false positives can be kept to an appropriate level.
The GAO rightly reports on the lack of network segmentation between the Internet-facing systems and the internal systems holding PII as a factor that enabled the attack. Inhibiting lateral movement with segmentation via firewall rules or private virtual LANs (VLANs) is a powerful defensive technique for obstructing adversary movement.
Summary
The GAO report details several findings that contributed to the severity of the attack on Equifax. The remediation advice, while sensible and appropriate, is not surprising. Implementing the advice successfully requires the mindset of the “Cyber Janitor”. Rather than infosec rockstars, janitors are required to maintain and clear up our environments. Paying attention to the small but important details such as members of a distribution list and expired certificates pays dividends!
To stay up to date with the latest Digital Shadows (now ReliaQuest) threat intelligence and news, subscribe to our threat intelligence emails here.
