5 ms·

> According to the cybersecurity company, it replied by saying it wouldn't agree to swift disclosure, and pointed JetBrains to its policy against silently patch

> According to the cybersecurity company, it replied by saying it wouldn't agree to swift disclosure, and pointed JetBrains to its policy against silently patching vulnerabilities, which stipulates that if companies violate that policy, Rapid7 will itself release the full details of the vulnerability, including enough information to allow people to develop exploits, within 24 hours. Did JetBrains engage Rapid7 to conduct an audit? If not, I think describing this as a “violation” is a step too far: if two companies have no pre-existing relationship then there’s no reason for one of them to start complying with arbitrary policies set by the other. If on the other hand JetBrains engaged Rapid7 to audit TeamCity and then tried to wriggle out of their contract when a vulnerability was found, then this isn’t a great look.

kevml 3y ago
Agreed, this feels a bit like extortion based on the way this article was written. Especially if they were engaged in a paying contract, why would Jetbrains accept disclosure?
deleted 3y ago
[deleted]
yread 3y ago
That would be insane terms for an audit
- c0pium 3y ago
  It’s not uncommon for security researchers to require coordinated disclosure (although often with longer timelines) even in paid engagements.
  - hiatus 3y ago
    Any basis for this statement? Having been through multiple pentests I have never seen any clause like that in a contract. Given the commoditized nature of security vendors these days, I would be surprised to see such an anti-customer clause become commonplace.
    - c0pium 3y ago
      Why would you think I’m talking about pentests? Those are largely checkbox engagements run by people who use some automated tool; they’re pretty unlikely to find 0-days. I’m talking about real security audits, where a researcher takes significant time to understand a codebase. Those tend to be conducted by people and firms who know what they’re doing and can be picky about who they work with. The purpose of an engagement like that is expressly to find and patch 0days, so requiring that CVD be done in a specific way is just an implementation detail. My source for this is that I require them, and many (although certainly not all) other researchers I have talked with do as well.
      - hiatus 3y ago
        I don't know what kinds of pentests you've seen but those automated scans are just for checking boxes. I'm talking about source-available pentests which sounds like the "real security audits" you are talking about. > The purpose of an engagement like that is expressly to find and patch 0days, so requiring that CVD be done in a specific way is just an implementation detail. All of the engagements I have been a part of have had NDAs and public disclosure of vulnerabilities would probably result in a lawsuit, but these have been for private companies. > My source for this is that I require them, and many (although certainly not all) other researchers I have talked with do as well. Do you work for an organization or just yourself?
c0pium 3y ago
>… then there’s no reason… The reason is to avoid getting dragged by Rapid 7. If you don’t play by the generally accepted community standards for coordinated vulnerability disclosure, you can expect the researchers to point that out as loudly as possible. It’s extortion, but the alternative is going back to companies ignoring security issues and not telling users about problems.
- jillesvangurp 3y ago
  I think the truth is probably in the middle. Big companies often release patches before they detail what is in them so as to not create a lot of zero day issues where they helpfully explain to hackers how to hack the unpatched masses of users. I can see why that is a good thing. At least I'd hate it if e.g. Apple published a detailed howto on how to hack me hours/days before I even see the patch they released along with it. Normal users and companies need some time. So, I can see why Jetbrains would want these patches out ASAP without alerting hackers to the notion that there are a lot of valuable corporate targets to hack. I guess that's why this article is titled "Rapid7 throws JetBrains under the bus ...". And their users, you could add. At least the article suggests "Exploits began within hours of the original disclosure, so patch now". Sounds like things might be getting ugly for some people out there. There might be more graceful ways to deal with this.
  - c0pium 3y ago
    That’s not really how it works, unfortunately. Once a company releases a patch, the clock starts ticking on reverse engineering what that patch does. Amusingly, all of the efforts to shrink patch sizes have made this even easier, as you can quickly zero in on which bits are the important ones. The only safe thing to do is for companies to be loud about which patches relevant for security and for their customers to take them quickly. All else is security-via-hopium. > Normal users and companies need some time. Revil doesn’t care about your patch testing.
tiahura 3y ago
This seems extortion adjacent enough that, if I was counsel for JetBrains, I'd advise a call to the FBI.
- IshKebab 3y ago
  Doubtful since they're not asking for money or any other benefit.
  - rovr138 3y ago
    If they weren't engaged, it's hacking under the CFAA.
    - hazmazlaz 3y ago
      Please explain why you think that's true, because I am certain it's not, and it's irresponsible to suggest it is.
      - rovr138 3y ago
        The CFAA is what's used against cases for hacking. They engaged with a system for which they didn't have permission to operate against. > (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— > (C) information from any protected computer; and if you want to argue extortion like other comments here, > (7) with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any— > (B) threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act -- UNLESS an entity has a program for this (by which they give permission) or you have an engagement to engage with their system (and this system), you NEVER engage. Ask anyone in security.
mc32 3y ago
In the latter scenario it's not a good look for either party. JB looks like they want to slide under the radar but R7 looks like it's extorting them. From a biz perspective, though, why would anyone go to R7 if there's a possibility of them disagreeing with you a throwing you under the bus?
- ziddoap 3y ago
  >From a biz perspective, though, why would anyone go to R7 if there's a possibility of them disagreeing with you a throwing you under the bus? Rapid7 is following the industry-wide best practices of coordinated vulnerability disclosure (CVD). If you don't like how they handled it, you'll have to avoid every reputable infosec company. The article does a bad job of explaining why silent patches are bad, and a bad job at explaining the normal, industry standard, CVD process.
  - mc32 3y ago
    Yes, silent patches are bad --but even worse is publishing details about the vulnerability so it can be used as an exploit before there is a chance to push the patch out or make it available. So yes, vendor is not great trying to silently patch but even worse is a security vendor publishing how to exploit it before the patch is made available. Surely it would be in both of their interests to coordinate the disclosure to minimize the risk to the ultimate users. As a user a silent patch is better than there being published exploit paths.
    - ziddoap 3y ago
      The patch was available. >Rapid7 spotted fresh patches for CVE-2024-27198 and CVE-2024-27199 on Monday, without a published security advisory and without telling the researchers.
      - mc32 3y ago
        That's not much leadtime to patch --but they have a point in that JB did not coordinate with them. To me it still looks spiteful on R7's side and irresponsible on JBs part as well as R7s part. They both are guilty of not having proper communication to reach a mutually agreeable result. It looks bad. R7 is making the other guy JB look less bad with the way they went about this. They both could have handles this better --but ultimately it looks worse for R7 from my PoV.

kevml 3y ago

Agreed, this feels a bit like extortion based on the way this article was written. Especially if they were engaged in a paying contract, why would Jetbrains accept disclosure?

deleted 3y ago

[deleted]

yread 3y ago

That would be insane terms for an audit

c0pium 3y ago
It’s not uncommon for security researchers to require coordinated disclosure (although often with longer timelines) even in paid engagements.
- hiatus 3y ago
  Any basis for this statement? Having been through multiple pentests I have never seen any clause like that in a contract. Given the commoditized nature of security vendors these days, I would be surprised to see such an anti-customer clause become commonplace.
  - c0pium 3y ago
    Why would you think I’m talking about pentests? Those are largely checkbox engagements run by people who use some automated tool; they’re pretty unlikely to find 0-days. I’m talking about real security audits, where a researcher takes significant time to understand a codebase. Those tend to be conducted by people and firms who know what they’re doing and can be picky about who they work with. The purpose of an engagement like that is expressly to find and patch 0days, so requiring that CVD be done in a specific way is just an implementation detail. My source for this is that I require them, and many (although certainly not all) other researchers I have talked with do as well.
    - hiatus 3y ago
      I don't know what kinds of pentests you've seen but those automated scans are just for checking boxes. I'm talking about source-available pentests which sounds like the "real security audits" you are talking about. > The purpose of an engagement like that is expressly to find and patch 0days, so requiring that CVD be done in a specific way is just an implementation detail. All of the engagements I have been a part of have had NDAs and public disclosure of vulnerabilities would probably result in a lawsuit, but these have been for private companies. > My source for this is that I require them, and many (although certainly not all) other researchers I have talked with do as well. Do you work for an organization or just yourself?

c0pium 3y ago

>… then there’s no reason… The reason is to avoid getting dragged by Rapid 7. If you don’t play by the generally accepted community standards for coordinated vulnerability disclosure, you can expect the researchers to point that out as loudly as possible. It’s extortion, but the alternative is going back to companies ignoring security issues and not telling users about problems.

jillesvangurp 3y ago
I think the truth is probably in the middle. Big companies often release patches before they detail what is in them so as to not create a lot of zero day issues where they helpfully explain to hackers how to hack the unpatched masses of users. I can see why that is a good thing. At least I'd hate it if e.g. Apple published a detailed howto on how to hack me hours/days before I even see the patch they released along with it. Normal users and companies need some time. So, I can see why Jetbrains would want these patches out ASAP without alerting hackers to the notion that there are a lot of valuable corporate targets to hack. I guess that's why this article is titled "Rapid7 throws JetBrains under the bus ...". And their users, you could add. At least the article suggests "Exploits began within hours of the original disclosure, so patch now". Sounds like things might be getting ugly for some people out there. There might be more graceful ways to deal with this.
- c0pium 3y ago
  That’s not really how it works, unfortunately. Once a company releases a patch, the clock starts ticking on reverse engineering what that patch does. Amusingly, all of the efforts to shrink patch sizes have made this even easier, as you can quickly zero in on which bits are the important ones. The only safe thing to do is for companies to be loud about which patches relevant for security and for their customers to take them quickly. All else is security-via-hopium. > Normal users and companies need some time. Revil doesn’t care about your patch testing.

tiahura 3y ago

This seems extortion adjacent enough that, if I was counsel for JetBrains, I'd advise a call to the FBI.

IshKebab 3y ago
Doubtful since they're not asking for money or any other benefit.
- rovr138 3y ago
  If they weren't engaged, it's hacking under the CFAA.
  - hazmazlaz 3y ago
    Please explain why you think that's true, because I am certain it's not, and it's irresponsible to suggest it is.
    - rovr138 3y ago
      The CFAA is what's used against cases for hacking. They engaged with a system for which they didn't have permission to operate against. > (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— > (C) information from any protected computer; and if you want to argue extortion like other comments here, > (7) with intent to extort from any person any money or other thing of value, transmits in interstate or foreign commerce any communication containing any— > (B) threat to obtain information from a protected computer without authorization or in excess of authorization or to impair the confidentiality of information obtained from a protected computer without authorization or by exceeding authorized access; or https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act -- UNLESS an entity has a program for this (by which they give permission) or you have an engagement to engage with their system (and this system), you NEVER engage. Ask anyone in security.

mc32 3y ago

In the latter scenario it's not a good look for either party. JB looks like they want to slide under the radar but R7 looks like it's extorting them. From a biz perspective, though, why would anyone go to R7 if there's a possibility of them disagreeing with you a throwing you under the bus?

ziddoap 3y ago
>From a biz perspective, though, why would anyone go to R7 if there's a possibility of them disagreeing with you a throwing you under the bus? Rapid7 is following the industry-wide best practices of coordinated vulnerability disclosure (CVD). If you don't like how they handled it, you'll have to avoid every reputable infosec company. The article does a bad job of explaining why silent patches are bad, and a bad job at explaining the normal, industry standard, CVD process.
- mc32 3y ago
  Yes, silent patches are bad --but even worse is publishing details about the vulnerability so it can be used as an exploit before there is a chance to push the patch out or make it available. So yes, vendor is not great trying to silently patch but even worse is a security vendor publishing how to exploit it before the patch is made available. Surely it would be in both of their interests to coordinate the disclosure to minimize the risk to the ultimate users. As a user a silent patch is better than there being published exploit paths.
  - ziddoap 3y ago
    The patch was available. >Rapid7 spotted fresh patches for CVE-2024-27198 and CVE-2024-27199 on Monday, without a published security advisory and without telling the researchers.
    - mc32 3y ago
      That's not much leadtime to patch --but they have a point in that JB did not coordinate with them. To me it still looks spiteful on R7's side and irresponsible on JBs part as well as R7s part. They both are guilty of not having proper communication to reach a mutually agreeable result. It looks bad. R7 is making the other guy JB look less bad with the way they went about this. They both could have handles this better --but ultimately it looks worse for R7 from my PoV.