Feeds

Hitachi and Siemens data-stalking firm not bugged by security bods' report

IT monitoring outfit should be more bovvered, claims infosec firm

Build a business case: developing custom apps

An open-source IT monitoring software firm has clashed with a security consultancy over the seriousness of a security bug in its technology.

GroundWork's technology provides a platform for IT operations management (network, system, application, and cloud monitoring) that is used by customers including Hitachi Data Systems, the Royal Bank of Canada, NATO, National Australia Bank, Siemens, and Tivo, among many others.

Security bods at SEC Consult last week published an advisory warning of "multiple critical vulnerabilities" in the GroundWork Monitor Enterprise platform. The firm said that many of the flaws cover authentication problems and claimed they are so serious that customers ought to avoid using the technology until the flaws are patched. The Austrian security consultancy also published a separate bulletin warning of other "high risk" bugs.

In response, GroundWork said its users were looking for "ease of use" rather than "maximum security". It didn't release a patch and told its users that tightening up settings was optional.

GroundWork uses the JBoss Portal’s Single Sign-On technology to restrict access to GroundWork components and improve many of their own security capabilities. Most GroundWork customers have expressed a preference for ease of use rather than maximum security, and the default settings reflect those wishes.

These are suggestions and not mandatory for a GroundWork Monitor installation.

Johannes Greil, the security researcher at SEC Consult who discovered the bugs in GroundWork's software, strongly disagreed with this assessment. "The identified vulnerabilities have nothing to do with 'maximum security' but rather conforming to web application security standards and guidelines such as OWASP Top 10," he told El Reg.

"Furthermore, GroundWork is not going to fix the vulnerabilities within the source code, but will only add an authentication layer and implement some changes in authorization (roles) through an optional technical bulletin," Greil told us in an email (his emphasis).

We put Greil's allegations to GroundWork last week but have yet to hear back. We'll update if we do.

Greil said he is also irked by GroundWork's lack of urgency about issues first reported to it two months ago. "The slow response and insufficient measures by Groundwork are not a responsible way to react for a vendor who supplies software for government agencies and large data centers," he said.

"An attacker who is (easily) able to take over this monitoring software is, for example, able to gain access to plaintext passwords of the monitored systems and spread the attack within the internal network," Greil claimed. "In order to mitigate the risk, the vulnerabilities have to be fixed within the source code. In secure environments, such as operating centers where this software is for instance used, it is highly undesirable to use insecure applications. Furthermore, we advise against using this software in the current state of security."

"We have identified multiple different critical vulnerabilities with different impacts. The most severe problems are that an unauthenticated attacker is able to elevate his privileges (admin access), execute arbitrary operating system commands, take over the whole monitoring system and gain access to sensitive configuration files with clear text passwords of the monitored systems. An attacker is therefore easily able to spread the attack within the internal network," Greil added.

SEC Consult's previous research includes the discovery of undocumented backdoors in data centre kit from Barracuda Networks. ®

The essential guide to IT transformation

More from The Register

next story
Rupert Murdoch says Google is worse than the NSA
Mr Burns vs. The Chocolate Factory, round three!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Think crypto hides you from spooks on Facebook? THINK AGAIN
Traffic fingerprints reveal all, say boffins
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.