flawopen.com/보안 사고/Equifax / Apache Struts
방문객이 자신의 언어를 말해야 하는 안내 데스크 인터폰이 있습니다. 그런데 방문객이 언어 대신 컴퓨터 프로그래밍 코드를 말하자, 안내 시스템이 오류를 내는 대신 명령을 그대로 수행하여 본관 금고 문을 전부 열어주었습니다.
The technical flaw is unremarkable; the organisational failure is the reason this breach is still taught. Congressional and regulatory findings identified a cluster of causes that compounded one another:
Equifax is the canonical demonstration that vulnerability management is an inventory problem before it is a patching problem. The organisation knew about the CVE, had the patch, and issued the instruction — and still lost 147 million records, because the instruction could not be mapped onto a system nobody had recorded.
The second durable lesson is about monitoring integrity. A security control that has silently stopped working is worse than a missing one, because it produces false assurance. An expired certificate on an inspection appliance is a mundane operational defect that, in this case, cost 76 days of detection time.
The initial exploit was not. CVE-2017-5638 was public, widely weaponised, and being scanned for at internet scale within days of disclosure. What distinguished the incident was the length of undetected access and the breadth of data reachable once inside.
For an internet-facing, unauthenticated RCE in a widely deployed framework, the practical window is days, not weeks — mass scanning typically begins within 24–72 hours of public disclosure. The prerequisite is knowing where the software runs, which is why inventory work pays off more than patch-speed targets alone.