Slashdot Mirror
PwC Sends Legal Threats To Researchers Who Found Critical Security Flaw (zdnet.com)
An anonymous reader quotes a report from ZDNet: A security research firm has released details of a "critical" flaw in a security tool, despite being threatened with legal threats. The advisory said that an attacker could "manipulate accounting documents and financial results, bypass change management controls, and bypass segregation of duties restrictions," which could result in "fraud, theft or manipulation of sensitive data," as well as the "unauthorized payment transactions and transfer of money." An attacker could also add a backdoor to the affected server, the advisory said. The researchers contacted and met with PwC in August to discuss the scope of the flaw. As part of its responsible disclosure policy, the researchers gave PwC three months to fix the flaw before a public advisory would be published. Three days later, the corporate giant responded with legal threats. A portion of the cease-and-desist letter, seen by ZDNet, said that PwC demanded the researchers "not release a security advisory or similar information" relating to the buggy software. The legal threat also said that the researchers are not to "make any public statements or statements to users" of the software. The researchers told PwC that they would publicly disclose their findings once the three-month window expires, which is in line with industry standard disclosure practices. That was when PwC hit the security firm with a second cease-and-desist letter. Undeterred, the researchers released a security advisory a little over two weeks later.
comment!: Typical for incapable companies to threaten with lawsuits because they can't be bothered to actually do thir job!
...are laywers cheaper than developers?
Or is the Higher Management unable to think in any other way because they are only laywers themselves??
Well this company completely missed the memo regarding the Streisand effect. This company obviously thought that using lawyers and burying the truth was cheaper than fixing the problem. Now, not only will they have to fix the problem, their users will be aware of the fact that the company tried to hide it from the users of the software. Talk about damage of trust. This company may also get hammered in court with anti-SLAPP penalties from the company they were threatening. Hopefully, this ends up being a very costly bout of stupidity making the company think twice about doing it again.
"Be particularly skeptical when presented with evidence confirming what you already believe." -
- Researchers met with PWC, told them they had 3 months before the advisory is released
- 3 days leater, PWC sends cease and desist
- Researchers confirm 3 months
- Some unspecified time later (maybe another 3 days?) a new cease and dsist letter arrives
- 2 weeks later, advisory is released - not seeing 3 months in this timeframe?
- Advisory is on a product security sales page that requires contact info to view
Looks like both sides are assholes!
Do PwC employ a lot of H1Bs?
Fair question where the authors got the software if they didn't have a license. Just because you're a security researcher doesn't give you carte blanche to pirate.
They should've released it as soon as the C&D came in, and attached the C&D to it while saying "We discovered a security hole and instead of fixing it, they threatened us."
Captcha: Prompt
It is apparently some sort of big accounting firm.
Working as intended.
They don't deserve otherwise. Those parasites (who prefer to invest into the appearance of doing their job instead of actually doing their damned job) should disappear from the market.
Q: "Why didn't you build the hospital to whithstand a mid-sized hurricane?"
A: "Your honor, we sued weather report, if we win, they are going to pay all the patient's relatives"
For an accountant firm, they have a lot to learn about accountability.
It doesn't have to be like this. All we need to do is make sure we keep talking.
This will likely going to be very expensive for the security researchers, as PricewaterhouseCoopers have deep pockets and a history of shady litigations.
Assholes like PwC is why most security researchers don't bother with responsbile disclosure. It is by far much safer to anonymously dump it to pastebin.
There is probably a conscientious developer that wanted to work on this the day it was discovered but the company thought the cheaper track was to bury it, and now he's probably going to be fired and implicated as the reason the bug existed, or worse, wasn't patched.
Is to treat security researchers that are working with you responsibly like shit
It looks like the vulnerability is in a PwC product called ACE, which analyzes SAP security settings.
The flagship product of the security firm that produced the disclosure appears to be "ESNC Security Suite", which from what I could tell appears to be a competing product.
While I definitely support security research and responsible disclosure, it makes me a little uncomfortable that it appears this security firm could have chosen to target and test the PwC software because it is a competitor to software they produce.
Sued for telling the truth and giving fair warning...
" an attacker could "manipulate accounting documents and financial results, bypass change management controls, and bypass segregation of duties restrictions," which could result in "fraud, theft or manipulation of sensitive data," as well as the "unauthorized payment transactions and transfer of money." An attacker could also add a backdoor to the affected server, the advisory said."
Then legal threats
Perhaps we could use a little deductive reasoning to conclude that this was not a flaw, but a critical feature of the software that some folks didn't want getting out?
Financial history is full of interesting accounting tricks.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Who the fuck is/are PwC?
It should be made a criminal offence, worded such that it can't be offloaded on the shareholders' pockets by means of a fine or settlement, to deter any security firm or white hat hacker that gives proper notification of a security flaw from publishing a security advisory after 90 days have expired from the moment of notification. That means responsible executives (or lawyers) will go to federal prison if this can be proven, whether they "knew about it" or not (to protect "junior staffers"). The public needs to be protected, this will force the provider to fix the issue within 3 months, or else the users will be informed... while also making the provider liable for potential losses (heh, borrowed that from the copyright industry) for as long as no effective fix has been published. Yes, the "potential losses" was no joke, as if an ATM network needs to be brought down for a week, that's a lot of potential losses right there at $2 / transaction. Effective fix means: mitigate the security threat but keep functionality, so a "just turn the damn thing off fix" is not a fix.
When the copyright term is "forever minus a day", live every day like it's the last.
This is why you're better off selling the vulnerabilities to hackers. Doubly true when dealing with sleaze bags like PWC.
> It should be made a criminal offence
100% agreed.
> such that it can't be offloaded on the shareholders' pockets
Oh, no. Shareholders get to suffer part of the risk, that's OK. They should *learn* to invest wisely, and if they are in the market, they should learn by market means. If some CEO psychopath at the helm lied to them it's up to them to sue the ass off said CEO.
I have *no* sympathy for shareholders who just choose by maximizing their speculative profits with no regards to ethics. They should be shredded to pieces by the same maelstrom which they feed in the first place.
Too many self-proclaimed security experts are big time bullshitters. They want high consulting fees and will spend as many hours as they can "analyzing". But in the end they don't do squat and the system is still not properly secured. I've seen them milk a company for months before they get kicked out and drive away in their Mercedes.
A really good security consultant is worth what they cost. But unless you're an expert yourself you have no way of knowing if the guy you're hiring knows anything.
Comment removed based on user account deletion
... then exploit the flaw, and release sensitive data to the victims, attached with the Pwc behavior regarding their product's security. Get popcorn and enjoy the mess.
1) Discover the magic phrase that makes large corporations destroy their stock value in this way
2) Use it
3) Profit!!!!
Requiem for the American Dream
In an email, a spokesperson for PwC acknowledged the existence of the vulnerability and confirmed that it had been fixed.
The spokesperson also said in separate prepared statement: "The code referenced in this bulletin is not included in the current version of the software which is available to all of our clients."
It seems the article does a poor job of being impartial. Despite the above quotes, they continue with:
It's far from the first time that a security firm or its researchers have faced the wrath from a company that fights instead of fixes.
I am not sure what to make of this since there is still too much information being withheld from both PwC and the article and ESNC.
It stands for penetration testing, like what the Big Bad Wolf was hired to do in the short story "The Three Little Pigs".
makers of turbine engines for helicopters and the AW-609...
Besides ... patching the software is never a permanent solution. Anarchist sympathisers will burrow into the system until they've found another vulnerability. And another. And another.
Best to attack the problem at its root: sue anyone who publishes a leak out of existence. That will also deter malfeasants, right?
It went very smooth.
So they ask for a name and e-mail to receive the advisory, which also puts you on a subscription list for other advisories in the future.. and that's a problem how? Ya know you can always put in a fake name, and even go so far as to create a temporary e-mail for the purpose of registering for it, right? It's not like they're making you create an account with a password or something to access this information. You make it sound like there's a bunch of hoops you have to jump through to receive this information.
Exaggerating much?
From the tone of PwC's response it's *obvious* they wanted to keep it secret. And use it to bypass any accountability measures, which are really a veneer of legitimacy if this "bug" is what it purports to be.
I love the responses PWC gave.
"ESNC did not receive authorized access or a license to use this software. The software is not publicly available and was only properly accessed by those with licenses, such as PwC clients working with trained PwC staff,"
In other words trying t discredit them. There is nothing in that about the flaw not being real.
But the one that had me laughing at the spin was:
"The code referenced in this bulletin is not included in the current version of the software which is available to all of our clients."
Makes it sounds like it's an old version that wasn't in use much anymore. But it was announced AFTER the fix. So publish the fix, which is now the "current version of the software" and since it's published "is available to all of our clients.". But really, that doesn't mean that most of your clients are running the patch, it silently sidesteps the whole thing.
And the final one:
"The bulletin describes a hypothetical and unlikely scenario -- we are not aware of any situation in which it has materialized,"
Yes, I would expect access to an admin account not to be listed on the main menu, I can believe it's an unlikely scenario. It's not actually hypothetical if it's been done by the security firm, so that part is a lie. The "we are not aware of any situation in which it has materialized" just means "we didn't catch it".
LITTLE GIRL: But which cookie will you eat FIRST? C. MONSTER: Me think you have misconception of cookie-eating process.
and named security companies should simply report what they see on pastebin. fuck all this legality bullshit.
You know, a simple "Thank you for finding this flaw in our product. Here is a $check as our thank you for finding this and reporting it before the $BadGuys exploited it."
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50