Slashdot Mirror
Backdoor Discovered In Atlassian Crowd
An anonymous reader writes "Recently published on the Command Five website is a technically detailed threat advisory (PDF) in relation to a recurring vulnerability in Atlassian Crowd. Tucked away inconspicuously at the end of this document in a section entitled 'Unpatched Vulnerabilities' is the real security bombshell: Atlassian's turnkey solution for enterprise single sign-on and secure user authentication contains an unpatched backdoor. The backdoor allows anyone to remotely take full control of a Crowd server and, according to Command Five, successful exploitation 'invariably' results in compromise of all application and user credentials as well as accessible data storage, configured directories (for example Active Directory), and dependent systems."
What is Atlassian Crowd, where is it used, how does this effect me, why should I care?
Did I miss any important questions?
[Fuck Beta]
o0t!
Atlassian has absolute contempt for their paying customers. Each release of JIRA has functionality and flexibility that people actually want removed in the name of making it easier to use for new users. JIRA and Crucible use some monstrosity of JavaScript that causes lag when typing into intput fields, and certain versions clash with Ghostery in a way that causes certain characters (e.g. spaces) to be swallowed. It's sad, but it doesn't surprise me at all that they don't care about security in an authentication system.
with it too without you meddling NSA kids being unable to catch snowden!
use cas and it's jasig developed altlassian plugin, Crowd is shit.
https://jira.atlassian.com/browse/CWD-3366
'Resources' of the Obama Regime, including c[r]o[w]d infrastructures at NSA, Ft. Meade and Utah, are compromised !
Allied forces in Europe gained access to servers at US NSA Ft. Meade Maryland and Utah Installation Intelligence Community Comprehensive National Cybersecurity Initiative Data Center at 00:07 UTC July 2013.
US Forces Central Command and National Security Council and C3I Directorate have not been informed at this time.
45 Penta-bytes of files have been copied 1 hour after gained entrance to servers in Reykjavík, Iceland and co-copyed to servers in København, Denmark.
At 00:10 UTC servers at the USA White House were compromised and access gained to storage units. Files from the Obama Regime have been copies to servers in Berlin and Paris, with copies sent to København, Denmark.
At 00:15 UTC servers at the USA Supreme Court and the District Court of the District of Columbia were compromised and access gained to storage units. 13 Penta-bytes of files have been copied to servers in Brussels, Belgium with copies of the files sent to servers in Reykjavík, Iceland.
The European Union Headquarters in Brussels has alerted INTERPOL that USA Government Flights are not allowed across EU Air Space. European Forces will be dispatched if a USA Government Flight invades European Air Space. European Forces Fighter Jets are given legal ground to interdict USA Government Flights which enter EU Air Space with orders to escort the invading aircraft on a reverse trajectory. If the USA Government Aircraft refuses or does not answer to the EU Forces Jet Fighter, the EU Forces Jet Fighters are instructed to shoot down the USA Government Aircraft as it is an invader to the peaceful airspace of the European Union.
A General of the European Union Forces gave this comment: "Perhaps there is a God to Forgive Obama and his Regime, ... We however will not ! "
While it is nice for the persons in charge of this obscure software to be notified about a problem on Slashdot, I am not sure I would be very happy to see that generalized.
But that leads to a real question: how do you learn about vulnerabilities for the softwares you are in charge?
Unless it starts to really, really hurt selling this kind of trash, not fixing _known_ vulnerabilities and not using secure coding practices, nothing will change. It is just cheaper this way and most customers do not care or cannot do anything anyways. One reason surely is managers at the customers that made this broken decision or supported it and now cannot back out without hurting themselves. Another is that absolutely nothing is going to happen to the vendor legally.
Unless we start to require sound secure software engineering practices OR ELSE! nothing will change.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Today I learned about Atlassian, a company whose software I will never use.
The NSA has pretty much proven to me that the INTERNET is an "un-patched vulnerability..."
ATLAS SHRUGS at your weak, pathetic, concerns.
This is the Internet, Waffletwat!
I tried really hard to like Atlassian's products. Jira is okay. Confluence, on the other hand, turned me off to all Atlassian products. The interface is awful, and it is slower than molasses. I have no idea how anyone evaluates that product and thinks, "Yeah, this looks great and is snappy. This will work wonderfully!"
I think Atlassian is more interested in putting on dog shows than writing quality software.
space aliens in a group?
The original report says about the last vulnerability discussed (but not disclosed)
Indicators such as covert positioning, the use of special parameters, absence of log messages, facilitation of persistence, and apparent lack of legitimate purpose suggest that this vulnerability could be classified as a symmetric backdoor if malicious intent were to be established (which it has not).
I like the tone: they stop short of stating this is a deliberate backdoor of the worst kind, but give extremely convincing argument that it is one.
I've been treated at my $company to some Atlassian products (Jira, Confluence).
From my POV, it's just your "enterprise level Java hairball" (in marketing talk a "stack", perhaps because it sounds a bit more orderly) rendering a sad and bureaucratic caricature of things which already are around, like wiki and issue tracker. Crowd seems to be some single-sign-on thingie (think Kerberos and Moonshot, but perhaps pounded into a buzzword compliant but barely usable minceball).
there is no spoon
there is no spoon
shakes head YES THERE IS....
i dont live in da matrix
Appropriately enough, they are looking to hire a "Director of Security" in their Sydney office.
https://www.atlassian.com/company/careers/jobs/listing?org=ATLASSIAN&cws=1&rid=688
(Actually, Atlassian make some really good software and it would be a great place to work.)
Your attitude is infectious...
Perhaps if they found some to hire, this slashdot story might never have appeared? http://www.smh.com.au/it-pro/business-it/desperate-search-for-geniuses-goes-to-ends-of-the-earth-20130317-2g8rp.html/
Seriously, it takes about 10 minutes to get an installation up and running. Even for small networks it makes sense these days.
Just fyi for all this puzzlement. I have an atlassian jira, confluence and crowd install that I setup for a customer. The reason we chose crowd was to help drive adoption for the system, as it made the browser login only needed once to access either product. My only complaint at the time was the annoyance of dealing with license seats, but it otherwise worked as advertised without much effort to set up.
From the PDF, first footnote
Atlassian did not remove the original database from their servers during the migration. The original database contained unencrypted (plainÂtext) customer credentials and was successfully exfiltrated by hackers in April 2010, likely resulting in the compromise of multiple customer accounts. (Erdos, 2013)
That sucks...
Having read TFA, I don't *think* the embedded version of Crowd used for LDAP/AD authentication in JIRA since 5.x is effected by this, but it doesn't explicitly say it isn't. Anybody know for certain?