Feeds

Hitachi and Siemens data-stalking firm not bugged by security bods' report

IT monitoring outfit should be more bovvered, claims infosec firm

Using blade systems to cut costs and sharpen efficiencies

An open-source IT monitoring software firm has clashed with a security consultancy over the seriousness of a security bug in its technology.

GroundWork's technology provides a platform for IT operations management (network, system, application, and cloud monitoring) that is used by customers including Hitachi Data Systems, the Royal Bank of Canada, NATO, National Australia Bank, Siemens, and Tivo, among many others.

Security bods at SEC Consult last week published an advisory warning of "multiple critical vulnerabilities" in the GroundWork Monitor Enterprise platform. The firm said that many of the flaws cover authentication problems and claimed they are so serious that customers ought to avoid using the technology until the flaws are patched. The Austrian security consultancy also published a separate bulletin warning of other "high risk" bugs.

In response, GroundWork said its users were looking for "ease of use" rather than "maximum security". It didn't release a patch and told its users that tightening up settings was optional.

GroundWork uses the JBoss Portal’s Single Sign-On technology to restrict access to GroundWork components and improve many of their own security capabilities. Most GroundWork customers have expressed a preference for ease of use rather than maximum security, and the default settings reflect those wishes.

These are suggestions and not mandatory for a GroundWork Monitor installation.

Johannes Greil, the security researcher at SEC Consult who discovered the bugs in GroundWork's software, strongly disagreed with this assessment. "The identified vulnerabilities have nothing to do with 'maximum security' but rather conforming to web application security standards and guidelines such as OWASP Top 10," he told El Reg.

"Furthermore, GroundWork is not going to fix the vulnerabilities within the source code, but will only add an authentication layer and implement some changes in authorization (roles) through an optional technical bulletin," Greil told us in an email (his emphasis).

We put Greil's allegations to GroundWork last week but have yet to hear back. We'll update if we do.

Greil said he is also irked by GroundWork's lack of urgency about issues first reported to it two months ago. "The slow response and insufficient measures by Groundwork are not a responsible way to react for a vendor who supplies software for government agencies and large data centers," he said.

"An attacker who is (easily) able to take over this monitoring software is, for example, able to gain access to plaintext passwords of the monitored systems and spread the attack within the internal network," Greil claimed. "In order to mitigate the risk, the vulnerabilities have to be fixed within the source code. In secure environments, such as operating centers where this software is for instance used, it is highly undesirable to use insecure applications. Furthermore, we advise against using this software in the current state of security."

"We have identified multiple different critical vulnerabilities with different impacts. The most severe problems are that an unauthenticated attacker is able to elevate his privileges (admin access), execute arbitrary operating system commands, take over the whole monitoring system and gain access to sensitive configuration files with clear text passwords of the monitored systems. An attacker is therefore easily able to spread the attack within the internal network," Greil added.

SEC Consult's previous research includes the discovery of undocumented backdoors in data centre kit from Barracuda Networks. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.