Hitachi and Siemens data-stalking firm not bugged by security bods' report

IT monitoring outfit should be more bovvered, claims infosec firm

An open-source IT monitoring software firm has clashed with a security consultancy over the seriousness of a security bug in its technology.

GroundWork's technology provides a platform for IT operations management (network, system, application, and cloud monitoring) that is used by customers including Hitachi Data Systems, the Royal Bank of Canada, NATO, National Australia Bank, Siemens, and Tivo, among many others.

Security bods at SEC Consult last week published an advisory warning of "multiple critical vulnerabilities" in the GroundWork Monitor Enterprise platform. The firm said that many of the flaws cover authentication problems and claimed they are so serious that customers ought to avoid using the technology until the flaws are patched. The Austrian security consultancy also published a separate bulletin warning of other "high risk" bugs.

In response, GroundWork said its users were looking for "ease of use" rather than "maximum security". It didn't release a patch and told its users that tightening up settings was optional.

GroundWork uses the JBoss Portal’s Single Sign-On technology to restrict access to GroundWork components and improve many of their own security capabilities. Most GroundWork customers have expressed a preference for ease of use rather than maximum security, and the default settings reflect those wishes.

These are suggestions and not mandatory for a GroundWork Monitor installation.

Johannes Greil, the security researcher at SEC Consult who discovered the bugs in GroundWork's software, strongly disagreed with this assessment. "The identified vulnerabilities have nothing to do with 'maximum security' but rather conforming to web application security standards and guidelines such as OWASP Top 10," he told El Reg.

"Furthermore, GroundWork is not going to fix the vulnerabilities within the source code, but will only add an authentication layer and implement some changes in authorization (roles) through an optional technical bulletin," Greil told us in an email (his emphasis).

We put Greil's allegations to GroundWork last week but have yet to hear back. We'll update if we do.

Greil said he is also irked by GroundWork's lack of urgency about issues first reported to it two months ago. "The slow response and insufficient measures by Groundwork are not a responsible way to react for a vendor who supplies software for government agencies and large data centers," he said.

"An attacker who is (easily) able to take over this monitoring software is, for example, able to gain access to plaintext passwords of the monitored systems and spread the attack within the internal network," Greil claimed. "In order to mitigate the risk, the vulnerabilities have to be fixed within the source code. In secure environments, such as operating centers where this software is for instance used, it is highly undesirable to use insecure applications. Furthermore, we advise against using this software in the current state of security."

"We have identified multiple different critical vulnerabilities with different impacts. The most severe problems are that an unauthenticated attacker is able to elevate his privileges (admin access), execute arbitrary operating system commands, take over the whole monitoring system and gain access to sensitive configuration files with clear text passwords of the monitored systems. An attacker is therefore easily able to spread the attack within the internal network," Greil added.

SEC Consult's previous research includes the discovery of undocumented backdoors in data centre kit from Barracuda Networks. ®