Equifax Breach (2017) — Linux & Apache Log Analysis

Attackers exploited a known vulnerability in Apache Struts on a Linux web server. Forensics teams analyzed /var/log/httpd/ to trace SQL injection patterns.

## Background

Attackers exploited a known vulnerability in Apache Struts on a Linux web server. Forensics teams analyzed /var/log/httpd/ to trace SQL injection patterns.

## Learning Objective
Analyze Unix-based log files (auth.log, syslog, bash history) and macOS plist/Spotlight artifacts.

## Scenario
You are the lead digital forensic investigator assigned to this case. Based on the real-world events described, you must analyze the available evidence, reconstruct the timeline, and produce a forensic report.

### Key Facts
- Case: Equifax Breach (2017) — Linux & Apache Log Analysis
- Year: 2017
- Domain: Cyber Forensics
- Difficulty: Advanced

## Evidence Available

Refer to the dataset at: https://github.com/arora200/aplly_case_db/tree/main/datasets/fss303-equifax-breach

## Investigation Questions

1. What was the root cause of the Equifax breach?
2. How did .bash_history reveal the attacker's actions?
3. What log files on a Linux system are critical for forensic analysis?
4. Why is NTP synchronization critical for forensic timeline reconstruction?
5. Trace the attacker's kill chain using the provided Apache logs.

## Deliverables

1. Forensic Report — Document your findings, methodology, and conclusions
2. Timeline Reconstruction — Map the sequence of events
3. Evidence Log — Document all evidence collected with hash values
4. Legal Admissibility Checklist — Ensure your evidence meets evidentiary standards

## Expert Insight
A Linux system doesn't lie unless the clock is wrong. Always check NTP synchronization logs first.

## Forensic Takeaway
Linux leaves a meticulous digital breadcrumb trail. .bash_history showed the exact commands used to deploy the web-shell. UTC timestamps were crucial.