<story><title>The Equifax Hack Has the Hallmarks of State-Sponsored Attack</title><url>https://www.bloomberg.com/news/features/2017-09-29/the-equifax-hack-has-all-the-hallmarks-of-state-sponsored-pros</url></story><parent_chain><item><author>f055</author><text>I guess a &amp;quot;State-Sponsored Attack&amp;quot; sounds better than &amp;quot;we got pwned with a bug that was known since March that we didn&amp;#x27;t patch and could have been exploited by a guy in a basement&amp;quot; [&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;qz.com&amp;#x2F;1073221&amp;#x2F;the-hackers-who-broke-into-equifax-exploited-a-nine-year-old-security-flaw&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;qz.com&amp;#x2F;1073221&amp;#x2F;the-hackers-who-broke-into-equifax-ex...&lt;/a&gt;]</text></item></parent_chain><comment><author>megamark16</author><text>I used to work for a company that had a big security hole that would allow you to log in as any user as long as you knew the user&amp;#x27;s UUID (I know, right?)  I logged a ticket and raised the issue up the flagpole to let folks know that if someone slipped in some code (we ran a lot of third party javascript) to harvest UUIDs, they could fairly trivially log in as an admin and do some serious damage.  The issue sat for months (MONTHS!) until finally a user complained about some non-https content being loaded on our login page, which sparked a whole security review, and gave me an opportunity to bring additional attention to my ticket, which finally got fixed.&lt;p&gt;This kind of crap is out there, and people don&amp;#x27;t give it the attention it deserves until they get bitten in the ass.  Thankfully, my company didn&amp;#x27;t get bitten, but if we had, it could have been very bad, and the fact that the issue was called to people&amp;#x27;s attention and they didn&amp;#x27;t do anything about it would have made it look that much worse.</text></comment>
<story><title>The Equifax Hack Has the Hallmarks of State-Sponsored Attack</title><url>https://www.bloomberg.com/news/features/2017-09-29/the-equifax-hack-has-all-the-hallmarks-of-state-sponsored-pros</url></story><parent_chain><item><author>f055</author><text>I guess a &amp;quot;State-Sponsored Attack&amp;quot; sounds better than &amp;quot;we got pwned with a bug that was known since March that we didn&amp;#x27;t patch and could have been exploited by a guy in a basement&amp;quot; [&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;qz.com&amp;#x2F;1073221&amp;#x2F;the-hackers-who-broke-into-equifax-exploited-a-nine-year-old-security-flaw&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;qz.com&amp;#x2F;1073221&amp;#x2F;the-hackers-who-broke-into-equifax-ex...&lt;/a&gt;]</text></item></parent_chain><comment><author>pvarangot</author><text>It&amp;#x27;s fun how when a big corporation is hacked it&amp;#x27;s always &amp;quot;a sate sponsored group with 0-days worth millions of dollars&amp;quot;, but then again nation states themselves keep getting hacked by &amp;quot;a lonely autist in a basement that&amp;#x27;s just very smart for his own good&amp;quot;.</text></comment>