TFPU - EQUIFAX FAIL (YOUR'E WELCOME?)

The credit reporting agency Equifax said Thursday that hackers gained access to sensitive personal data — Social Security numbers, birth dates and home addresses — for up to 143 million Americans, a major cybersecurity breach at a firm that serves as one of the three major clearinghouses for Americans’ credit histories.

Equifax said the breach began in May and continued until it was discovered in late July. It said hackers exploited a “website application vulnerability” and obtained personal data about British and Canadian consumers as well as Americans. Social Security numbers and birth dates are particularly sensitive data, giving those who possess them the ingredients for identity fraud and other crimes.

Most states do not put a timeline on how quickly companies must notify customers after discovering a breach, though eight do:

Connecticut, Florida, Maine, New Mexico, Ohio, Rhode Island, Tennessee and Vermont.

The timelines range from 30 days to 90 days. (California sets a timeline, but just for notice on breaches of medical information.)

Many companies and lawmakers have called for a national data breach notification law to provide a baseline standard for when customers should learn about hacks to help streamline the process.

Equifax has changed its terms of service to note that users checking to see if they've been affected by a massive breach it endured are not waiving their right to file a class action lawsuit.

WASHINGTON ― The credit monitoring company that compromised the personal information of nearly half the U.S. population said Monday it won’t ask people for credit card info if they sign up for its “free” service.

Last week, Equifax Inc. announced that it had been hacked by criminals who obtained personal details about 143 million Americans, including names, addresses and Social Security numbers. To make up for its massive cybersecurity failure, the firm said it would give victims a free one-year subscription to its credit monitoring service.

There was a catch: the supposedly free service required credit card information up front and would begin charging the card after the free trial ended unless users proactively canceled, according to terms of use for the product dated Sept. 6.

Equifax quietly deleted the information about fees from its website over the weekend, and on Monday, the firm announced it wouldn’t ask for credit cards when people sign up for the service, which is called TrustedID Premier.

Amanda Werner of the consumer advocacy group Public Citizen said Equifax changed its policy in the face of public pressure.

“This is what happens when someone’s watching,” Werner said. “Equifax got caught trying to profit from a massive security breach and the outrage from consumers and advocates made them reverse their position.”

Forget Equifax. Facebook and Google Have the Data That Should Worry You

Equifax faces at least 23 proposed class-action lawsuits since its disclosure that personal identifying information for 143 million U.S. consumers may have been compromised by a massive cyberbreach.

And additional cases are likely to come.

A Canonical Password Strength Measure
Eugene Panferov
Abstract
We notice that the “password security” discourse is missing a fundamental notion of the “password strength”.
We propose a canonical measure of password’s strength. We give formal definition of the “guessing attack”, and
the “attacker’s strategy”. The measure is based on the assessment of the efficiency of the best possible guessing
attack. Unlike naive password strength assessments our measure takes into account the attacker’s strategy. We
argue strongly against widespread informal assumptions about “strong” and “weak” passwords, and advise to
adopt formal metrics such as proposed one. This paper does NOT advise you to include “at least three capital
letters”, seven underscores, and a number thirteen in your password.

The tale began on July 29, when the company’s security team detected suspicious network traffic associated with the software that ran its U.S. online-dispute portal. After blocking that traffic, the company saw additional “suspicious activity” and took the portal’s software offline.

At this point, Equifax’s retelling grows cloudy. The company said an internal review then “discovered” a flaw in an open-source software package called Apache Struts used in the dispute portal, which it then fixed with a software patch. It subsequently brought the portal back online.

But that vulnerability had been known publicly since early March 2017, and a fix was available shortly thereafter — facts that Equifax acknowledged in its Friday statement. The company did not say why the software used in the online-dispute portal hadn’t been patched earlier, although it claimed that its security organization was “aware” of the software flaw in March, and that it “took efforts” to locate and fix “any vulnerable systems in the company’s IT infrastructure.”

Hackers have successfully breached CCleaner’s security to inject malware into the app and distribute it to millions of users

...

CCleaner has been downloaded more than 2 billion times according to Avast, making it a popular target for hackers. Dubbed “crap cleaner,” it’s designed to wipe out cookies and offer some web privacy protections. 2.27 million users have been affected by the attack, and Avast Piriform believes it was able to prevent the breach harming customers. “Piriform believes that these users are safe now as its investigation indicates it was able to disarm the threat before it was able to do any harm,” says an Avast spokesperson.

The U.S. Justice Department has opened a criminal investigation into whether top officials at Equifax Inc. violated insider trading laws when they sold stock before the company disclosed that it had been hacked, according to people familiar with the investigation.