4 ms·

And that decompiler operates as part of popular enterprise passive network monitoring hardware, so the attack vector is literally any JAR sent over the monitore

And that decompiler operates as part of popular enterprise passive network monitoring hardware, so the attack vector is literally any JAR sent over the monitored switch, giving the attacker full read only access to the entire network (possibly even write access in some configurations). That said, the manufacturer had configurations to mitigate the damage out within hours and a full patch 2 days after they were notified by Project Zero.

mike_hearn 11y ago
I guess the more important question is what kind of process changes are FireEye going to make? FireEye is a security company. Their business is security and catching hacking attempts. They of all people should know how dangerous it is to scrape and parse potentially malicious data off the wire in large quantities, and yet it doesn't sound like they've taken any special precautions. OK, the JAR disassembler doesn't run as root, but there's a privilege escalation so simple the description fits in a single line of text, so that's not worth much. The fact that JODE has the potential to execute arbitrary code whilst decompiling isn't a secret, it's mentioned in the FAQ. So there must have been some kind of failure in the development process that led to the appliance developers simply grabbing whatever package they encountered first in order to ship the feature, without taking into account the security of their own software stack. To me this says that the appliance is very likely to have lots of other vulnerabilities in it. Sort of like how anti-virus engines have been found to be vipers nests of exploits.
- adrianN 11y ago
  "The hackers could only exploit us because we used open-source for Java decompilation! From now on all open source is forbidden."
- noir-york 11y ago
  I used to work for a security vendor and MIME/email used to be another great target for exploiting mail filters. We had our own sec team checking the security of our own software - amazing what stuff they found in our own code base and third party libraries. Security is hard.
- pyvpx 11y ago
  JODE is basically not maintained and quite ancient in its feature set. I don't understand why JODE is being used here. I thought perhaps because of licensing, but it is GPL/LGPL as are other, more maintained and modern java decompilers. does anyone out there know why they're using JODE?

mike_hearn 11y ago

I guess the more important question is what kind of process changes are FireEye going to make? FireEye is a security company. Their business is security and catching hacking attempts. They of all people should know how dangerous it is to scrape and parse potentially malicious data off the wire in large quantities, and yet it doesn't sound like they've taken any special precautions. OK, the JAR disassembler doesn't run as root, but there's a privilege escalation so simple the description fits in a single line of text, so that's not worth much. The fact that JODE has the potential to execute arbitrary code whilst decompiling isn't a secret, it's mentioned in the FAQ. So there must have been some kind of failure in the development process that led to the appliance developers simply grabbing whatever package they encountered first in order to ship the feature, without taking into account the security of their own software stack. To me this says that the appliance is very likely to have lots of other vulnerabilities in it. Sort of like how anti-virus engines have been found to be vipers nests of exploits.

adrianN 11y ago
"The hackers could only exploit us because we used open-source for Java decompilation! From now on all open source is forbidden."
noir-york 11y ago
I used to work for a security vendor and MIME/email used to be another great target for exploiting mail filters. We had our own sec team checking the security of our own software - amazing what stuff they found in our own code base and third party libraries. Security is hard.
pyvpx 11y ago
JODE is basically not maintained and quite ancient in its feature set. I don't understand why JODE is being used here. I thought perhaps because of licensing, but it is GPL/LGPL as are other, more maintained and modern java decompilers. does anyone out there know why they're using JODE?