How to Protect Your Identity After the Equifax Cyberattack « Null Byte :: WonderHowTo

Equifaxreported onSept. 7that it discovered a breach on July 29 which affects roughly half of Americans, many of whom don't realize they have dealings with the company. Hackers got away with social security numbers, addresses, and driver's license numbers, foreshadowing a "nuclear explosion of identity theft." Let's explore what really happened and what you and those around you can do to protect yourselves.We will work to keep this article up to date with information on the security breach as the details become more clear over the next few days. For some guidance on the severity and impact of this breach that affects so many people, let's go to the Equifax press conference.Sorry, that was an executive summary of theEquifax's response so far. Suffice it to say, it is not going well. Here is the actual way they chose to inform customers about the breach.How Bad Is the Breach?Data breaches come in different forms and sizes, and some are worse than others. Those that involve identity information are bad, but what's worse is when hard to change information like someone's social security number is involved. People thought it was bad when health insurerAnthem got hacked and lost 80 million current and former customers data in 2015. Now enter Equifax, with it's data breach of 143 million Americans information (which equals approximately half the US population) and one can see whyMorgan Wright described it to Fox Businessas "the nuclear explosion of identity theft."This is not the worst breach of all time by a long shot in terms of pure numbers. That distinction goes to Yahoo ... They had a leak involving more than a billion users.But this leak is particularly worrisome because Equifax is a credit reporting service and tracks a history of your consumer life, credit cards, credit scores and more — and it gives the black market a potential gold mine of information about people's financial lives.—Ron Miller, TechCrunchIf you are concerned about how many times your identifying information may have been leaked in major hacking attacks in the last four years, there are tools to help you find out. You can check outHave I Been Pwned, as well asThe New York Times tool.How Did the Hackers Breach Equifax?On July 29, 2017, Equifax uncovered a vulnerability, saying that hackers "exploited a U.S. website application vulnerability to gain access to certain files." It is now believed, based on thefollowing report, that the vulnerability was a part of an open-source Java web application building framework called Apache Struts.Thanks to its open-source nature, Struts has become wildly popular with Fortune 100 companies where 65 percent of them use it including Lockheed Martin, Citigroup, Vodafone, Virgin Atlantic, Reader's Digest, Office Depot, and Showtime. Unfortunately for them, and Equifax in particular, 2017 has already seen at least two vulnerabilities in Struts discovered, one in March and another on Sept. 4. However, it's unclear which of these vulnerabilities the hackers may have used.Thevulnerability revealed on Sept. 4by Security researchers at lgtm has existed in Struts since at least 2008.This particular vulnerability allows a remote attacker to execute arbitrary code on any server running an application built using the Struts framework and the popular REST communication plugin. The weakness is caused by the way Struts deserializes untrusted data.—Bas van Schaik, lgtmTo take advantage of this issue, all one needs is a browser, an internet connection, and some very basic information about how the bug works. You can learn more about how this vulnerability was discovered by readingMan Yue Mo's blog post on lgtm. This vulnerability has been patched by Struts in its most recent updates, 2.3.34 and 2.5.13.The March exploit for a critical Apache Struts vulnerability being used.Image viaKevin BeaumontThe older March vulnerability can befound on Rapid7's Vulnerability and Exploit Database. It is equally as bad, making it trivial to hack and run any command you want to on a Struts system. This vulnerability allows a hacker to execute arbitrary commands via a #cmd= string in a crafted Content-Type HTTP header. This works because of the way that the Jakarta Multipart parser mishandles file uploads.What this all means is that the hackers had two vulnerabilities in the Struts system to chose from. TheBaird Equity Research report, however, only states that they used "a vulnerability," so it's unclear which one the hackers employed. The hackers proceeded to use the vulnerability to steal the sensitive data of 143 million unsuspecting Americans, which could have allowed them to delete data as well.How Is Equifax Handling the Breach?Once Equifax discovered the breach, they hired a "leading, independent cybersecurity firm" to perform aforensic reviewand discover the size and scope of the breach. Equifax then waited over a month, until September 7, to disclose the breach to the public. They didn't say why they waited so long, but it isn't uncommon for companies to do the same when they are in similar situations. It is possible that they waited at the request of law enforcement so that the law had time to work before the hacker knew they were discovered. To learn more about why it can take so long to disclose a breach publically,The Washington Post sums it up nicely.Meanwhile, three senior executives went about selling their Equifax shares, worth almost $1.8 million, before the hack went public. This turned out to a good idea, as Equifax Inc. (EFX)lost nearly 14 percent of its valueor $2 billion on Friday, Sept. 8, after the news broke. The company claims that the three had no knowledge of the hack, and the sales only represented a small portion of each individual's stock portfolio. Regardless, the action seems very suspicious, and undoubtedly will be investigated further.What Information Was Involved in the Breach?According to Equifax's official statement, a lot of information has been compromised.Most of the consumer information accessed includes names, Social Security numbers, birth dates, addresses, and in some instances, driver's license numbers. In addition, credit card numbers for approximately 209,000 consumers and certain dispute documents, which included personal identifying information, for approximately 182,000 consumers were accessed. In addition to this site, Equifax will send direct mail notices to consumers whose credit card numbers or dispute documents with personal identifying information were impacted. We have found no evidence of unauthorized access to Equifax's core consumer or commercial credit reporting databases.—EquifaxWhat Can You Do to Respond?Not all data breaches are alike, and this one poses a unique challenge. Not all of the people affected may be aware. Credit card companies, banks, retailers, and lenders all send massive amounts of data to companies like Equifax. In addition to this, they also leverage public records, which means that some of your data could have been revealed without you having ever directly dealt with Equifax. In fact, it is likely that many millions of people will find themselves in that exact situation of having never dealt directly with Equifax, but still having their information stolen.Often, us Null Byte readers are the first to explain these kinds of attacks to the less tech-savvy family members, friends, and coworkers. Below, we will look at some of the steps you can take to secure the identities of yourself and your loved ones in the wake of this incident.Step 1: Decide if You Want TrustedID PremierEquifax is attempting to provide some consolation to customers in the form of a free year of its TrustedID Premier service, which will provide credit monitoring, reports, and $1M Identity Theft Insurance.The Fine PrintBut what's this in the terms of service? When Equifax set uptheir toolthat people could use to see if they were affected, theterms of usefor TrustedID stated the following:No Class or Representative Arbitrations.This arbitration will be conducted as an individual arbitration. Neither You nor We consent or agree to any arbitration on a class or representative basis, and the arbitrator shall have no authority to proceed with arbitration on a class or representative basis. No arbitration will be consolidated with any other arbitration proceeding without the consent of all parties. This class action waiver provision applies to and includes any Claims made and remedies sought as part of any class action, private attorney general action, or other representative action. By consenting to submit Your Claims to arbitration, You will be forfeiting Your right to bring or participate in any class action (whether as a named plaintiff or a class member) or to share in any class action awards, including class claims where a class has not yet been certified, even if the facts and circumstances upon which the Claims are based already occurred or existed.The legalese above required that you sign away your right to sue Equifax, instead agreeing to mandatory arbitration, which is aquestionable tactic with a checkered pastbecause of how it bans you from being a part of a class-action lawsuit. The Consumer Financial Protection Bureau recently put in a ruleto ban these types of clauses.After the debacle described, above Equifax issued a new statement that attempts to clarify the arbitration clause, which you can see below.To confirm, enrolling in the free credit file monitoring and identity theft protection products that we are offering as part of this cyber security incident does not prohibit consumers from taking legal action ... to be as clear as possible, we will not apply any arbitration clause or class action waiver against consumers for claims related to the free products offered in response to the cybersecurity incident or for claims related to the cybersecurity incident itself.—EquifaxYou would think that Equifax would have thought about this sort of thing in the month it had to prepare. Apparently, it just slipped their mind. There is already at least oneclass-action lawsuit already in the works, so you're chances of joining one now are good.If you do decide to use TrustedID Premier, thenfollow this linkand fill in your last name and last 6 digits of you social. After that confirm your human status.Looks like Hoid is home free.Nice, it doesn't look like Hoid was affected. But what about Mr. Test, and his social security number containing last six digits 123456?Looks like this fake made up name wasn't so lucky. So much for accurate results.Mr. Test, you poor unfortunate soul! In either case, you can still click the Enroll button, and get a less-than-useful date a week or more from now to actually enroll. Better hope you remember, because you aren't going to get a reminder. On your enrollment date, head tothis pageto finish enrolling by November 21, 2017.Step 2: Activate Your Free Fraud Alert & Freeze Your CreditWhat is a credit freeze, and what is an alert? When you freeze your credit, anyone trying to open credit will be asked for a PIN, which you set over the phone when you freeze it. A fraud alert is similar; credit card companies must verify your identity before opening an account.If you found that your data was breached in the last step, then you will want to activate a fraud alert. This is is free and easy. Even if your data wasn't hacked, yet you still may want to do this. The service is free, and offered by all the major credit reporting agencies. You can find theform on TransUnion, but remember to only do it with one of the companies. Click on the "place a fraud alert" button and follow the steps provided. This puts a flag on your identity, which makes it much more difficult to defraud. You may also be interested inKrebs on Security's more detailed article on the subject.To freeze your credit, you can call the numbers below and set a PIN.Equifax: 1-800-349-9960Experian: 1-888-397-3742TransUnion: 1-888-909-8872Equifax Secure 'PINs' Are Basically Just a DatestampWhen you freeze your credit files with Equifax, it gives you a PIN. However, they don't use a strong PIN, which should be treated just likemaking a strong password. It would be easy for Equifax to use a random number generator for its PINs, but instead, it uses the date and time of your freeze with the format MMDDyyHHmm. And as pointed out in a Twitter post byTony Webster, they have been using this format for over a decade.This makes it very easy for a hacker to brute-force the PIN. At ten digits long, you have a one in ten billion chance to pick the right one, but by using this format, the odds are closer to one in 5,000. Let's look at why.Since there are only 12 months, the first number is limited to 0 or 1, and then since no month has more than 31 days, the third number will never be more than 3. You can continue to reduce the possibilities by discounting PINs before the Sept. 8, because no one knew about the hack yet. This leaves you with a fairly easy number set that can be quickly brute-forced. That being said, you can still freeze with the other two credit agencies, and put out a fraud alert.Step 3: Monitor Your Own CreditYou may not realize it, but each of the major credit reporting agencies (Equifax, Experian, and TransUnion) offers you a free credit report once per year. We can use this cleverly to check our credit for free every 4 months with a different credit agency. If you want more detailed information,USA.govdescribes how the process works.To actually check our credit, we need to go tothis page. The link will behere if you live in the UK. You'll have to fill out a bunch of personal information and complete a captcha. After this, you will be taken to the following page.The best idea would be to pick only one of the three, and then come back and do the same process every 4 months. Look for anything out of the ordinary when you get your report, such as new accounts you didn't open, late payments, debts you don't recognize, and so on. Even if the credit report comes back clean, remain vigilant.Step 4: Monitor Your StatementsYou shouldn't have to be told this one, but as a friendly reminder, check your credit card and bank statements. Try to recall all of the transactions you've made — do any of them look out of the ordinary?Step 5: Social Networks and Operational SecurityThis one is simple, if you're putting all your information on Facebook, Twitter, Instagram, and other social media then you are just making the identity thief's job super easy. First and foremost, set stricter privacy settings. For example, on Facebook, strongly consider limiting all the bio information you can to "friends only." Your birthday, hometown, and other information can be used against you, to create new accounts and solve security questions.Step 6: Report Identity TheftIf you do discover evidence that your identity has been stolen, such as open credit cards, loans, or re-opened accounts, then immediately alert your bank and credit card companies. You are not responsible for fraudulent charges, as long as you report them. Additionally, you will want to go andreport it to the Federal Trade Commission.It's hard to quantify the damage a breach like this can do, as often the worst is not apparent until much later, when identity thieves assume everyone has moved on and forgotten about the breach. We hope that this article gives you a better understanding of what happened, and what you can do to secure your identity, and help explain those things to anyone who may not understand the kind of impact this may have on them.Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image via123RF; Screenshots by Hoid/Null Byte (unless otherwise noted)RelatedHow To:Protect yourself from identity theft on FacebookHow To:Keep your identity safe from thievesHow To:Recover if you have been a victim of identity theftHow To:Prevent someone from stealing your identityHow To:Prevent identity theft and know how thieves workHow To:Blur out a face in your video using Wax 2.0How To:Blur faces to protect identities in MotionHow To:15 Million T-Mobile Customers Hacked—Here's How to Protect Yourself from Identity TheftApple Pay Cash 101:How to Verify Your Identity with AppleHow To:Make a super hero mask prop for a film or HalloweenHow To:Keeping Your Hacking Identity SecretHow To:Make a Fake IdentityHow To:Pixelize an image in PhotoFiltre  (GMask)How To:Change your IP address from the Windows command lineHow To:Spot Fake Businesses & Find the Signature of CEOs with OSINTHow To:Prove some random trigonometric identitiesHow To:VeePN Keeps Your Online Identity Safe & Secure While You Browse the InternetHow To:Access the Dark Web While Staying Anonymous with TorHow To:Solve math problems involving the identity property of oneHow To:Preserve identity with PhotoshopHow To:Add YouTube Channel ArtHow To:Verify trigonometric identitiesHow To:Hack WPA wireless networks for beginners on Windows and LinuxNews:'Hackers-for-Hire' Attempted to Steal Baidu's Self-Driving Car SecretsTypoGuy Explaining Anonymity:Your Real IdentityHow To:Strengthen your credit scoreHow To:Inside Bitcoin - Part 1 - Bitcoin and AnonymityHow To:Become Anonymous & Browse the Internet SafelyHow To:This Extensive Python Training Is Under $40 TodayNews:Mastercard, Qualcomm-Powered ODG Smartglasses Use Iris Authentication for AR ShoppingNews:Admin's Cards, in BoxesNews:Should Google+ Require You to Use Your Real Name?News:Pariah - Movie Trailer & PosterNews:Norden Bombsight Official video - Help DeskHow To:Permanently Erase Data So That It Cannot be RecoveredDeal Alert:VPN Unlimited Is Only $39 Right Now for a Lifetime LicenseHow To:Effectively Disguise Yourself and Keep Your Identity SecretHow To:Get the 'Vamp Eyer' Achievement in Metal Gear Solid 2: Sons of Liberty HDNews:LEGO Tron QuorraHow To:Create a Fake Online Identity for Website Registrations in Just One Click