Yes, folks, supply chain risks through third party libraries is a thing...

Yes, folks, supply chain risks through third parties is a thing... 

And at a banking site to boot: https://www.bankinfosecurity.com/equifax-transunion-websites-served-up-adware-malware-a-10379

Well, not really banking, credit reporting services, like Equifax or Transunion,  are using code for web reporting.

It's kinda malvertising, where the site has links that go outside, but I think it's include files, that go to a site on the fly, which is compromised, and serving up fake flash malware, which in this case is Adware.Eorezo.

There's also talk about third party providers in general https://www.pymnts.com/news/b2b-payments/2017/bitsight-financial-services-face-third-party-cybersecurity-risk/


Malwarebytes is quoted multiple times and has a good blog post https://blog.malwarebytes.com/threat-analysis/2017/10/equifax-transunion-websites-push-fake-flash-player/

Lets not forget Equifax

In a nutshell:

1. Equifax was hacked big time, everybody knows that
2. Came out in September 2017
3. Found out in March?
1.  Slashdot: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed
4. Execs sold lots of stock
1.  And even bigger and largely unappreciated, Options!
5. So if you're a responsible person with good credit, you're a target ripe for the picking
1. Equifax will do a credit with themselves for free ( and their PIN isn't even a time stamp )
2. Not sure about the others
3. Is something other than a credit freeze better?
4.  The Equifax Breach: Here's How to Protect Yourself | WIRED
5. There's something on TWIT, they discussed it on Security Now  #62
6. 
   

Update: Continuing this dumpster fire, according to Slashdot,  Equifax Has Been Sending Consumers To a Fake Phishing Site for Almost Two Weeks for theft protection.  They created "EquifaxSecurity2017.com", but were sending people to "securityequifax2017.com" in tweets between September 9 and 20 2017.  in Gizmodo:

Another Update: (9/22/2017)

The 3 executives that made $2mil were a story, but the options that were bought on August 21 for $160K were worth about $10M on Sept 7

https://www.cnbc.com/2017/09/20/house-finance-committee-seeks-information-on-equifax-options-activity.html