Backdoor Discovered In Atlassian Crowd 133
An anonymous reader writes "Recently published on the Command Five website is a technically detailed threat advisory (PDF) in relation to a recurring vulnerability in Atlassian Crowd. Tucked away inconspicuously at the end of this document in a section entitled 'Unpatched Vulnerabilities' is the real security bombshell: Atlassian's turnkey solution for enterprise single sign-on and secure user authentication contains an unpatched backdoor. The backdoor allows anyone to remotely take full control of a Crowd server and, according to Command Five, successful exploitation 'invariably' results in compromise of all application and user credentials as well as accessible data storage, configured directories (for example Active Directory), and dependent systems."
Huh? (Score:5, Interesting)
What is Atlassian Crowd, where is it used, how does this effect me, why should I care?
Did I miss any important questions?
Re: (Score:3, Informative)
Here comes the aeroplane spoon... open up the hangar!
From the first page of the advisory:
"Atlassian Crowd is marketed as a secure single signon (SSO) product for the enterprise and is designed to be incorporated into third party applications and systems"
Re: (Score:2)
Re: (Score:1)
No, you got the important ones. I was wondering the exact same thing myself. Even googled about it, but saw nothing informative outside of their website, which would only slightly answer the first part.
So, what are your plans for the upcoming holiday? We are going to have a cookout with friends. Hope you enjoy whatever you have planned. Bye.
(That part added to give this /. story some meaning in our lives.)
Re: (Score:3)
You must have missed this part
Even googled about it, but saw nothing informative
In addition to the original poster and myself, I see several others posting either similar queries, or responses dismissive of this product. So don't act like I have to sign up for tech courses for this software before I comment on it.
Re: (Score:3)
You must have missed this part
Even googled about it, but saw nothing informative
Having just googled again, I still see nothing that is actually informative from the top 10 results. Most point to Atlassian's site. They have the uaual marketing blurb:
Identity Management for Web Apps
Finally, a single sign-on and user identity tool that's easy to use, administer, and integrate.
Users can come from anywhere – Active Directory, LDAP, Crowd itself, or any mix thereof. Control permissions to all your applications in one place – Atlassian, Subversion, Google Apps, your own apps.
Great! It's a way to sign into webapps. How enlightening. I have gotten a better description of it from the complaint posts below, than from searching for it in your approved way. But thank you for your concern of my inertial-challanged state.
Re: (Score:2)
Re: (Score:2, Informative)
Atlassian's turnkey solution for enterprise single sign-on and secure user authentication. Atlassian is a software vendor of modest relevance, producing Jira issue tracking and Confluence wiki software. I assume this would only be relevant if you run are rely on a system that uses Crowd for authentication. Where is it used? Where is any software package used?
Re: (Score:2, Informative)
It's some Java bug tracker software which whenever someone uses for their project you get frustrated with (and some open source does use it since it's monetarily free for them but fairly expensive normally), and a wiki that nobody but big business uses and is very slow. The SSO lets people in the java world integrate standard technologies for federated identity (so that the apps don't need to store or know the username/password of the people using them).
Re: (Score:2)
Atlassian's turnkey solution for enterprise single sign-on and secure user authentication. Atlassian is a software vendor of modest relevance, producing Jira issue tracking and Confluence wiki software. I assume this would only be relevant if you run are rely on a system that uses Crowd for authentication. Where is it used? Where is any software package used?
Atlassian's most famous product is Jira, which is pretty commonly used in large-scale businesses. Large-scale businesses are also more likely to use SSO, since it's less trouble than maintaining dozens of app-specific login subsystems.
So the net result is effectively that the login ID is "sa" and the password is blank and everyone from the NSA to the Brothers of the Islamic Revolution of Upper West Turdistan, the New Reform Church of Neo-Communist Mao-fu-tze, the haXors Anymous 7EEt, the 57th-Street Beagle
Re:Huh? (Score:4, Informative)
It appears to be some sort of software managing logins to sites. Their site cites their clientele to be a lot of major companies, such as facebook, twitter, hulu and netflix.
I imagine if you have a backdoor into software that manages facebook's login systems, that's pretty damn major.
Re: Huh? (Score:2)
Re: (Score:2)
Re: Huh? (Score:4, Interesting)
Actually you can hook Jira into Stash, which is a GIT repo server, hook that into FishEye/Crucible which is a code review portal and hooked into Jenkins, thereby creating a nearly round trip QA process.
QA creates a ticket, developer sees ticket, creates a branch from it, commits code, gets peer review after which the code is deployed to a QA server, ticket is moved back to a QA user who has a link to the QA server (typically a unique server instance is spun up for each ticket), QA confirms - this spins down the QA server instance and a pull request is made for the production branch.
So there you go. Automated code deployment with useful checkpoints in a workflow process.
Don't be jealous.
Re: (Score:3)
Facebook, twitter, hulu, etc probably use their ticketing system, Jira, which is what they're most well-known for. I doubt they use Crowd, which is one of their lesser-known offerings.
Re:Huh? (Score:4, Informative)
"Atlassian's turnkey solution for enterprise single sign-on and secure user authentication"
So Atlassian is some company, and it's a single sign-on/authentication system used in businesses.
And it lets a remote attacker take control of the servers it runs on, and possibly other computers in the business (via Active Directory, which is Microsoft's system administration/management package.)
Re:Huh? (Score:5, Funny)
Re: (Score:3)
Remember, single sign-on is just a strange way to spell "single point of failure".
Re:Huh? (Score:5, Informative)
They make Jira and Confluence... 2 applications that are widely used by some IS departments to manage their work. Jira for example, is an application for tracking software development, deployment and bugs. It's basically a ticketing system for programmers. You can track who created what, which bugs showed up in it later, who fixed them, how long all that took, etc...
I'm not sure how many people are using their LDAP/SSO stuff though though. There are lot bigger (and clearly more trustworthy) providers in town.
Re:Huh? (Score:4, Informative)
All of the individual apps can be tied to AD (or another directory) directly. Crowd is pretty much what you use when you want single sign-on/centralized auth, but you don't want to deploy AD or go through the pain in the ass of setting up and maintaining your own LDAP server.
I've also seen it used in large enterprises which have multiple authentication sources, the kind where systems just kind of creep, but no one wants to take the time (or risk the downtime) for consolidation. In that scenario, it's alot easier to tie the apps to Crowd for authentication, and then you just need to manage authentication sources in Crowd, instead of individually on the apps.
Atlassian actually makes some pretty good software, and their prices are reasonable for their starter kits to get used to it. My only gripe is that it's all pretty much Tomcat based
Re:Huh? (Score:4, Insightful)
There's not a single major piece of software that hasn't had security flaws at one point or another. Remember when OpenBSD's web page bragged about no remote security holes in the default install? Even they've had two, and those boys are the epitome of paranoid security freaks.
So I can forgive Atlassian to a degree, as long as they fix the damn thing, and fix it in a hurry. If your standard of 'good' software is no security holes at all, then I'm afraid you're going to have to log off and go back to playing with Lego's.
Some of Atlassian's software is easy to use, and some of it can overwhelm a user. I've ran into a few coworkers who hated Confluence, and it was because they couldn't figure out how to do what they wanted. After I showed them, the gripes mysteriously disappeared. Confluence and JIRA are good pieces of software. Not perfect, but they serve their purpose.
Re: (Score:2)
My only gripe is that it's all pretty much Tomcat based
There are worse things a J2EE-based applications to run under. Since Tomcat supports the essentials without the overhead of supporting the full stack, it has very modest resource requirements compared to, for example, WebSphere or JBoss.
Of course, Jetty is also lightweight, but Jetty isn't as commonly used or supported these days.
Re: (Score:1)
my beef with atlassian stuff is you end up running separate instances for each app yet on their own ports and if you want any kind of seamlessness you have to hide it behind an apache proxy. II don't understand why I need to run 3 tomcats and an apache for stash, jira, and confluence.
Re: (Score:1)
I wish there was a place i could get these answers.
LIKE THE FUCKING INTERNET.
Good news! (Score:1)
This is the Internet, Waffletwat!
Re:Huh? (Score:4, Funny)
Must be the heat playing tricks on my brain. I thought the headline said Atlassian Cloud. And that was going to be the excuse to post about a backdoor discovered in a real cloud. [photobucket.com]
Re: (Score:2)
That image looks more like a cloud version of goat.cx
Re: (Score:2)
And thus, the aforementioned backdoor.
Re: (Score:2)
I had imagined it was a Japanese Cloud computing firm located in the lost city of Atlantis.
Re: (Score:3)
That's "Chinese", you insensitive crod. :P
Re: (Score:2)
There's a pretty f'ing reasonable argument to be made that if you don't know, and can't be bothered to do any research, maybe you don't need to know. Certainly, I will tell you that as someone who actually uses Crowd, and has been known to configure and administer Crowd, I know what it is.
Come on.
Re: (Score:2)
What is Atlassian Crowd, where is it used, how does this effect me, why should I care? Did I miss any important questions?
Im' particularly dyslexic tonight - I read that as "Assassin's Creed"
Re: (Score:2)
Re: (Score:1)
...along with ... Zynga...
Well then, this is an appropriate product for them, the backdoor thing and all, since Zanga is a bunch of assholes...
Re: (Score:2)
I know full well that I'm probably
Re: (Score:2)
In Atlassian's case, usage of their products is actually about as widespread as it appears. I say this from a lot of firsthand knowledge with installing, configuring, and managing their products in a lot of environments.
What exactly do you mean when you say "locked down server?" Unless you mean "disconnected from the Internet and/or sitting behind a NAT gateway that requires additional authentication via a VPN or other means to traverse," this sort of vulnerability doesn't depend on anything more than havin
Re: (Score:1)
Re: (Score:1)
The terminology in article confused me as well. It's talking about "enterprise single sign-on" which actually means something different from what Crowd actually seems to provide. It's usually used to refer software that does SSO to desktop applications (well known software in that sector are like Oracle ESSO, NetIQ (formerly Novell) SecureLogin, IBM SAM ESSO (formerly IBM TAM ESSO)). Crowd, however, seems to be WebSSO+IDM [atlassian.com] solution.
Not surprising (Score:5, Interesting)
Atlassian has absolute contempt for their paying customers. Each release of JIRA has functionality and flexibility that people actually want removed in the name of making it easier to use for new users. JIRA and Crucible use some monstrosity of JavaScript that causes lag when typing into intput fields, and certain versions clash with Ghostery in a way that causes certain characters (e.g. spaces) to be swallowed. It's sad, but it doesn't surprise me at all that they don't care about security in an authentication system.
Re: (Score:2)
So that's where the licensing fees go - making professional-looking fluff videos. Well at least they have _something_ to show for it.
Re: (Score:1)
Atlassian has absolute contempt for their paying customers. Each release of JIRA has functionality and flexibility that people actually want removed in the name of making it easier to use for new users. JIRA and Crucible use some monstrosity of JavaScript that causes lag when typing into intput fields, and certain versions clash with Ghostery in a way that causes certain characters (e.g. spaces) to be swallowed. It's sad, but it doesn't surprise me at all that they don't care about security in an authentication system.
No shit. What's that old joke about shrink-wrapped stool samples?
And you are informative - I never bothered to learn what sphincter JIRA came out of. Heaven forbid someone makes a mistake calculating required disk storage for JIRA - if that SuperTurd fills up its disk storage it fails spectacularly and corrupts everything.
Now I know Atlassian is that sphincter.
Re: (Score:2)
> Heaven forbid someone makes a mistake calculating required disk storage for JIRA - if that SuperTurd fills up its disk storage it fails spectacularly and corrupts everything.
Sadly, I've experienced what the AC is talking about =( I mean WTF? The consequences of running out of disk space could / should be better disclosed. (I know, I know... anyone 'worth their salt' should already know better. But still...)
Otherwise, JIRA's not-too-shabby, especially if you're getting it for the really cheap license fe
Re: (Score:2)
> Heaven forbid someone makes a mistake calculating required disk storage for JIRA - if that SuperTurd fills up its disk storage it fails spectacularly and corrupts everything.
Sadly, I've experienced what the AC is talking about =( I mean WTF? The consequences of running out of disk space could / should be better disclosed. (I know, I know... anyone 'worth their salt' should already know better. But still...)
Otherwise, JIRA's not-too-shabby, especially if you're getting it for the really cheap license fee...
No.
No product should ever respond to a failed IO operation by going batshit crazy and corrupting data willy-nilly. Because IO operations can fail for a lot of reasons.
JIRA's a turd, plain and simple.
Re:Not surprising (Score:5, Informative)
... So when they repeatedly state that the built in database is for evaluation purposes ONLY and that usage of it may result in data corruption or loss ... on EVERY PAGE ADMIN PAGE UNTIL YOU SWITCH OFF OF the built in database, that wasn't enough of a warning for you?
I'm not sure how much more warning you can get, short of them corrupting your database intentionally on a daily basis so you get the point sooner.
Re: (Score:3)
Atlassian has absolute contempt for their paying customers. Each release of JIRA has functionality and flexibility that people actually want removed in the name of making it easier to use for new users. JIRA and Crucible use some monstrosity of JavaScript that causes lag when typing into intput fields, and certain versions clash with Ghostery in a way that causes certain characters (e.g. spaces) to be swallowed. It's sad, but it doesn't surprise me at all that they don't care about security in an authentication system.
Actually you gave the answer why. Since they are focused on new customers, it's all about the money they can get. Fixing stuff cost money, so they don't.
Re: (Score:2)
Perhaps if they had an issue tracking system they could manage those defects and get them fixed...
Re: (Score:3)
Perhaps if they had an issue tracking system they could manage those defects and get them fixed...
Well it appears you can sign in yourself. So go ahead and file a bug report!
Re: (Score:1, Troll)
Each release of JIRA has functionality and flexibility that people actually want removed in the name of making it easier to use for new users
What are you talking about? I've been using JIRA for years and have worked with many companies who use JIRA and have heard no complaints about their features. They have many features and they work very well for me and others.
Personally, I enjoy the Atlassian stack, find it unrivaled in feature coverage and have migrated many clients to the Atlassian stack.
And I've ever seen any sort of lag when typing in any field in JIRA or Crucible, or Crowd or Greenhopper or Fisheye or Confluence.
But then again, I don't
Re: (Score:1)
I will admit their services are rather resource intensive. But I've installed the JIRA stack at least twice without major issue and the response time was just fine. I find it best not to put more than 2 or 3 services on a given machine. And have ran it on Mac Mini Servers to 1U rack servers.
And how did Nginx factor in? If I recall, the JIRA apps provide their own HTTP services via Tomcat and Apache.
So it's likely you fucked up your own custom install and are holding Atlassian responsible for your own mess.
F
Re: (Score:3)
If you're virtualizing Atlassian apps, it does take a bit of work and optimization to make them play nice, which is how every install (including my own personal ones) I've ever worked on has been installed. Once they're tuned, they hold up and scale pretty well though.
Re:Not surprising (Score:5, Interesting)
It may be a factor of whether you're talking as a user or as an administrator.
I can't speak authoritatively to JIRA as a product I'm responsible for -- I never owned a JIRA installation (well, not one with significant volume) -- but I use JIRA, and we use JIRA here, for a whole crapton of things from change tickets to production emergency handling, to task handling, to all development tasks. As a software engineer, and a software engineering manager, I love it -- and so do most of the other users we have here.
It helps that we think of this kind of stuff as something you should actually invest in, and we have someone who probably has about 50% of his time dedicated to making JIRA run and making it work better for us. I've always found that bug/defect/issue/task tracking systems are better, and make their users happier, when they have a champion who's allowed to invest real resources in their care and feeding.
Re:Not surprising (Score:4, Insightful)
It's a browser plugin for blocking intrusive tracking elements in web sites. I've never had it cause trouble with any other web site besides those that intentionally require you to submit to tracking (e.g. airport wi-fi sign-on pages), but those sites will usually detect the elements being blocked and give you an upfront message about it. It's almost like Atlassian went out of their way to make their stuff not work with Ghostery.
From the tone of your post you are a shill who has something to gain from Atlassian sales, jumping at a chance for a cheap sales pitch with vague anecdotes.
Ah, right. You sell Atlassian software. Can you say "conflict of interest"?
Re:Not surprising (Score:4)
No, I don't sell Atlassian Software, I consult startups for a living.
I get nothing from Atlassian, and don't put all my clients on Atlassian.
Many of them I put on Github Enterprise.
It depends on the client, the product, the development cycle, the team, and the roadmap.
But hey -- don't let that stop you from making wild and baseless accusations.
Re:Not surprising (Score:4)
Ah, right. You sell Atlassian software. Can you say "conflict of interest"?
You're being a dick. It's fairly obviously he does consulting work for clients, and as such, provides them with solutions to meet their requirements and improve their work flow. That's like saying that, just because I'm a network engineer whose decides to implement a Cisco solution for a customer, that I'm selling Cisco hardware.
You're sounding like a bitter jerk.
Re: (Score:2)
That's like saying that, just because I'm a network engineer whose decides to implement a Cisco solution for a customer, that I'm selling Cisco hardware.
That is what you're doing. You're a middleman. You're at minimum making purchasing decisions on their behalf. And you're getting paid for doing it. You have to justify your actions, so that's what you're doing.
Re: (Score:2)
For starters, there was no real point to contradict, just an assumption on your part without any substantiating evidence.
I did address your assertion. It's bad logic to assume that just because you implement a solution that's inline with your customers budget and requirements, that you're 'selling' that product. Unless he either admits or you can prove beyond a shadow of a doubt that he's getting a commission out of Atlassian for implementing their products, you're pulling assumptions out of your ass.
But yo
Re: (Score:1)
Had nothing to do with the technical stuff beyond the fact that it replaced a bunch of people who could derive metrics from database queries -- with a bunch of people who could only use webapps. But the webapp crowd was buzzword-compliant, and the middle of the pack was more than willing to go along in order to put "JIRA" on their resumes. The top devs were driven out because they weren't agile enough, or whatever the managers came up with. (The managers could understand th
Re: (Score:2)
4 years ago when I used Atlassian products JIRA was great and worked just fine for our company. Crucible was fine too. Fisheye seemed a bit slow.
Customer support was responsive. I don't think their other products deserve the vitriol your posting but this backdoor, if indeed put in intentionally by them, is pretty damning.
The bug report with included patch (Score:3, Informative)
Re: (Score:1)
>
That's for the bug that the report actually discusses, not the backdoor that the report mentions but does not discuss.
security alerts (Score:5, Insightful)
While it is nice for the persons in charge of this obscure software to be notified about a problem on Slashdot, I am not sure I would be very happy to see that generalized.
But that leads to a real question: how do you learn about vulnerabilities for the softwares you are in charge?
Re: (Score:2)
But that leads to a real question: how do you learn about vulnerabilities for the softwares you are in charge?
you read one or more risks digests (which used to be a name for a thing, dunno if it still is) as well as whatever security-related information your vendor puts out. If your vendor doesn't make reports of this sort of thing via some sort of standard vector, it's time to start shopping for a new solution.
Re: (Score:2)
you read one or more risks digests (which used to be a name for a thing, dunno if it still is)
That's it. And this is a painful task since you have to filter the information relevant to you.
In this 2.0 world, it is suprising we did not managed to create some machine-parsable security alert feed (hint: XML), which could be gathered from various vendors and filtered to get the information relevant to a specific installation. In an ideal world, Nagios would get that and send me an alert when I have a pending update for a security alert
Re: (Score:2)
you read one or more risks digests
That's it. It is a painful task because you have to filter hat is relevant to your installation.
In this 2.0 world, it is odd that we do not have some machine-parsable (hint: XML) format for security information. In an ideal world, I could gather that from various vendors, filter it to fit my installation, feed it to Nagios, and automatically get an alert when I have a pending update for a security alert.
Commercial Trash (Score:4, Interesting)
Unless it starts to really, really hurt selling this kind of trash, not fixing _known_ vulnerabilities and not using secure coding practices, nothing will change. It is just cheaper this way and most customers do not care or cannot do anything anyways. One reason surely is managers at the customers that made this broken decision or supported it and now cannot back out without hurting themselves. Another is that absolutely nothing is going to happen to the vendor legally.
Unless we start to require sound secure software engineering practices OR ELSE! nothing will change.
Thanks! (Score:2)
Today I learned about Atlassian, a company whose software I will never use.
"un-patched vulnerability..." (Score:1)
The NSA has pretty much proven to me that the INTERNET is an "un-patched vulnerability..."
Re: (Score:3)
Confluence works fine, but you have to be willing to throw the right hardware at it, or be willing to tune it. Something like Doku or Mediawiki is alot less resource intensive, but Confluence is, in a nutshell, a java app, and you need to treat it accordingly. Once tuned and scaled properly, it works just as well as any other wiki, and I personally find formatting for it to be alot easier, as well as the actual management of it.
Re: (Score:2)
Yeah, I'm a tad annoyed at some of the changes in Confluence 5.
As far as tuning goes, that I cannot offer any advice on. In the enterprise, we run Confluence virtualized, and our VMWare admins and server admins were the ones who beat their heads against it. My personal install is also virtualized on VMWare, and I just tossed 4 gigs of memory and 2 vCPU's at it, and it works fine. However, it only supports like 4 users, so it's not exactly the greatest stress test in the world.
The report's author are pretty convincing (Score:1)
The original report says about the last vulnerability discussed (but not disclosed)
Indicators such as covert positioning, the use of special parameters, absence of log messages, facilitation of persistence, and apparent lack of legitimate purpose suggest that this vulnerability could be classified as a symmetric backdoor if malicious intent were to be established (which it has not).
I like the tone: they stop short of stating this is a deliberate backdoor of the worst kind, but give extremely convincing argument that it is one.
Re:The report's author are pretty convincing (Score:4, Informative)
I work for Atlassian and the author has not yet disclosed the vulnerability described in the "UNPATCHED VULNERABILITIES" section to us.
Atlassian provides source code for most of our products (including Crowd) to paying customers. We would never deliberately build a backdoor into any of our products and I personally would never work for a company that would do that.
You can make a difference... (Score:1)
Appropriately enough, they are looking to hire a "Director of Security" in their Sydney office.
https://www.atlassian.com/company/careers/jobs/listing?org=ATLASSIAN&cws=1&rid=688
(Actually, Atlassian make some really good software and it would be a great place to work.)
Embedded Crowd in JIRA effected? (Score:2)
Having read TFA, I don't *think* the embedded version of Crowd used for LDAP/AD authentication in JIRA since 5.x is effected by this, but it doesn't explicitly say it isn't. Anybody know for certain?