Slashdot Mirror
FireEye Tries to Bury Keynote Reporting That It Ran Apache As Root On Security Servers
An anonymous reader writes: Leading network security company FireEye, which has customers in government and the Fortune 500 list, has caused a controversy at a London security conference today after its legal attempts to stop a keynote speech detailing the repair of major security loopholes in its customer-facing systems this year. Reported among these now-fixed vulnerabilities were the running of a significant number of FireEye's Apache-based security servers as 'root' — meaning that any attacker able to compromise the servers would have had absolute power over all its operations and commercial connections.
Why is 'root' in quotes? Why is it defined (poorly) as if it were this mysterious thing giving absolute power over "commercial" connections?
We're not the general public. We're nerds. Don't submit articles written for people who don't know what "root" is.
I was just staring at Process Explorer, wondering why my company decided that the FireEye policy would allow it to max out one of my cores in the middle of the afternoon.
is not that they were running Apache as root - although that it a stupid thing to do, it could have been an oversight (just about). What is of major concern is how they try to hide their mistake by abuse of legal system - this abuse is not an oversight and only makes me wonder what else FireEye is hiding -- I would think 3 times before hiring them.
I am also disgusted at the German judge who gave an ex-parte order without having a return date so that the defendant (security researcher) could present his side of the argument. It does happen often in spite of heads of courts saying that it must not happen (in some UK court divisions anyway).
Sometimes the companies most in need of the services they provide are themselves.
I frequently walk by this handyman's house where he has a sign advertising his various services including painting. I shake my head every time I see it because his house needs a good paint job more than any other house on the block.
Well not without compiling from source with -DBIG_SECURITY_HOLE set, which surely provides a "maybe we are doing this wrong" double check...
If you do work for hire, you do not control whether you can publish information you discovering doing that work.
And what kind of security consultant airs his customers' dirty laundry? Not one that wants future customers.
If he had found this on his own, it'd be his call. But if he did it for FireEye, it's FireEye's call.
http://lkml.org/lkml/2005/8/20/95
It turned out that the root password was "password"
From the Forbes article, there were many problems, with running the webservers as 'root' just one of them. Another was a pair of zip email attachments could trigger the FireEye software to "open the files for analysis and in doing so open a backdoor on its appliance". It sounds like the researcher heavily redacted his presentation, then presented, which is why we know what we do. It also means a lot of other juicy bits were probably removed and not presented, so the bad we know about (which is bad) is just part of their problems. My guess is they considered what the guy discovered in the process to be revealing of their software's architecture and therefore would be revealing IP.
"We tried to conceal from the researchers to publish our IP. No company in the world would want their IP revealed. We did that to protect our customers. We openly worked with them to fix the vulnerabilities, and patches have been available for months now. Our Customers are protected." ref
So looking at this in depth, it looks like FireEye has already publicly disclosed said vulnerabilities after fixing them months ago. They then try to stop the presentation because it allegedly reveals too much of their IP (which is itself worth discussing but totally separate) and we get a bunch of headlines saying "ZOMG! FireEye is trying to silence people for revealing vulnerabilities!". This is trigger happy, bullsh*t journalism at its finest. Not quite accurate or informative but just close enough to get people prematurely worked up in a tizzy for page views.