Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Communications Network Networking Software The Internet Your Rights Online

PwC Sends Legal Threats To Researchers Who Found Critical Security Flaw (zdnet.com) 188

Posted by BeauHD from the cease-and-desist dept.
An anonymous reader quotes a report from ZDNet: A security research firm has released details of a "critical" flaw in a security tool, despite being threatened with legal threats. The advisory said that an attacker could "manipulate accounting documents and financial results, bypass change management controls, and bypass segregation of duties restrictions," which could result in "fraud, theft or manipulation of sensitive data," as well as the "unauthorized payment transactions and transfer of money." An attacker could also add a backdoor to the affected server, the advisory said. The researchers contacted and met with PwC in August to discuss the scope of the flaw. As part of its responsible disclosure policy, the researchers gave PwC three months to fix the flaw before a public advisory would be published. Three days later, the corporate giant responded with legal threats. A portion of the cease-and-desist letter, seen by ZDNet, said that PwC demanded the researchers "not release a security advisory or similar information" relating to the buggy software. The legal threat also said that the researchers are not to "make any public statements or statements to users" of the software. The researchers told PwC that they would publicly disclose their findings once the three-month window expires, which is in line with industry standard disclosure practices. That was when PwC hit the security firm with a second cease-and-desist letter. Undeterred, the researchers released a security advisory a little over two weeks later.
This discussion has been archived. No new comments can be posted.

PwC Sends Legal Threats To Researchers Who Found Critical Security Flaw More

PwC Sends Legal Threats To Researchers Who Found Critical Security Flaw

Comments Filter:

  • first (Score:2, Insightful)

    by Anonymous Coward

    comment!: Typical for incapable companies to threaten with lawsuits because they can't be bothered to actually do thir job!

    • It's a lot cheaper to shoot the messenger than it is to shore up a leaky piece of software.

      Besides ... patching the software is never a permanent solution. Anarchist sympathisers will burrow into the system until they've found another vulnerability. And another. And another.

      Best to attack the problem at its root: sue anyone who publishes a leak out of existence. That will also deter malfeasants, right?

    • Exactly.

      When you can't innovate, litigate!

    • comment!: Typical for incapable companies to threaten with lawsuits because they can't be bothered to actually do thir job!

      I would say that a "They are bothered and concerned and want to fix it but, the author of that module no longer works for them and they can't find the staff with the in-depth knowledge of that particular module. If the analyst person can't understand the module, he will not understand the security flaw. And the search to find the competent individual is at least a three month job. That's my take on this subject.

      • I would say that a "They are bothered and concerned and want to fix it but, the author of that module no longer works for them

        R-arrange these words : "shit" and "tough".

        Surely the minute that the author of that module handed in their notice, his managers should have started the search process (internally and externally) for someone to grok the departed person's work and get up to speed. Oh, and they could try having a lower staff turnover rate by [insert 50 volumes of standard staff retention advice, whic

  • Since when... (Score:2, Interesting)

    by Anonymous Coward

    ...are laywers cheaper than developers?

    Or is the Higher Management unable to think in any other way because they are only laywers themselves??

    • Re:Since when... (Score:4, Informative)

      by Big Hairy Ian ( 1155547 ) on Tuesday December 13, 2016 @09:16AM (#53475189)
      For those of us who remember introducingmonday.co.uk (now sadly no longer there) just remember "We like donkeys"

    • Re:Since when... (Score:5, Interesting)

      by haruchai ( 17472 ) on Tuesday December 13, 2016 @09:38AM (#53475293)

      ...are laywers cheaper than developers?

      Or is the Higher Management unable to think in any other way because they are only laywers themselves??

      I worked for a tech firm that was run by a lawyer; when the shit hit the fan during the dotcom meltdown, we found out the only ass that was covered was his.
      While we were scrambling to find new jobs & pay bills, he went off to head up some board filled with other cunts like himself

      • I worked for a tech firm that was run by a lawyer; when the shit hit the fan during the dotcom meltdown, we found out the only ass that was covered was his.
        While we were scrambling to find new jobs & pay bills, he went off to head up some board filled with other cunts like himself.

        In other words while you were looking for a new job, he did the same, and found one.

        • Re: (Score:3)

          by haruchai ( 17472 )

          "In other words while you were looking for a new job, he did the same, and found one"

          He had this lined up before we knew the sky was falling. And he had quitely negotiated a nice parting gift for himself while 50 of us lost thousands in unpaid salary & benefits.
          That detail only came to light years later when a couple of us finally were able to get our hands on some withheld company documents.

    • Re: (Score:2)

      by Luthair ( 847766 )
      Well, for large companies they're already on staff sitting around trying to justify their position...

  • Streisand effect (Score:5, Interesting)

    by TheReaperD ( 937405 ) on Tuesday December 13, 2016 @09:12AM (#53475165)

    Well this company completely missed the memo regarding the Streisand effect. This company obviously thought that using lawyers and burying the truth was cheaper than fixing the problem. Now, not only will they have to fix the problem, their users will be aware of the fact that the company tried to hide it from the users of the software. Talk about damage of trust. This company may also get hammered in court with anti-SLAPP penalties from the company they were threatening. Hopefully, this ends up being a very costly bout of stupidity making the company think twice about doing it again.

    • Re:Streisand effect (Score:5, Insightful)

      by mwvdlee ( 775178 ) on Tuesday December 13, 2016 @09:22AM (#53475207) Homepage

      Companies like PwC cannot grasp the concept of a earning money and behaving ethically at the same time.
      Many a head must have been scratched in trying to understand why their threats failed. "Did the researchers not understand they were being threatened?". "Why would they do the right thing if it could cost them money?". "It's almost decided to do what would be best for other people instead of themselves.".

      • Re: (Score:3, Informative)

        by Anonymous Coward

        "Companies like PwC cannot grasp the concept of a earning money and behaving ethically at the same time."

        You're not kidding there. I'd never heard of them but pulled up their wiki page. It's quite long. And a good half of it is dedicated to controversies and scandals. Almost all around financial fraud. How are these clowns not in prison?

        • Re:Streisand effect (Score:5, Insightful)

          by TheReaperD ( 937405 ) on Tuesday December 13, 2016 @10:22AM (#53475473)

          Because only the plebs go to prison.

          • Madoff went to prison, and will be there for the rest of his life. He was no "pleb".

            • Re: (Score:2)

              by gnunick ( 701343 )

              Madoff went to prison, and will be there for the rest of his life. He was no "pleb".

              The exception proves the rule, as they say.

              • Re: (Score:2)

                by HiThere ( 15173 )

                The meaning of "prove" in "The exception proves the rule" is tests. Prove has a long history outside of math, and the math meaning is a specialization. You can still consider a "proof" of a conjecture as a test of it, and that meaning works, and that's the origin of the use of proof in that context.

                All that said, you can point to two or three rich and powerful people who ended up in jail, but you won't find many, and you'll find many that should have. So as a statistical measure, you can say rich people

        • That was quite enlightening. I never would have known about this company had it not been for this story.

          These guys run with the big boys, it doesn't surprise me at all that their first response was legal action. As a matter of fact, I wouldn't be surprised if that is their first reaction to any bad news.

          • HA!
            It's their first reaction to *any* news including a curious lack of news.

            "Good news sir!" -> Lawyers
            "Bad news..." -> Lawyers
            "Jeeves! I have not seen any news lately." -"I'll dial up the legal dept. sir."

        • Re: (Score:2)

          by gtall ( 79522 )

          They know where everyone else's skeletons lie.

        • They've made enough money to buy off the politicians who would create laws, and those who would prosecute them.

  • Fair question where the authors got the software if they didn't have a license. Just because you're a security researcher doesn't give you carte blanche to pirate.

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      They need a license to *use* it. Research is fair use, so go suck Walt Disney's mummified cock.

      • Research is fair use

        Citation needed. I'm pretty sure this is not true.

        • Citation needed. I'm pretty sure this is not true.

          It is not easy to determine fair use; however, for most part research is fallen into fair use category. However, most of the time, fair use is a case-by-case basis, so the issue may be tested in court. You can go here [wsu.edu].

          Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use, the factors to be considered shall include:

          1. The purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes;
          2. The nature of the copyrighted work;
          3. The amount and substantiality of the portion used in relation to the copyrighted work as a whole; and
          4. The effect upon the potential market for or value of the copyrighted work.The fact that a work is unpublished shall not by itself bar a finding of fair use if such finding is made upon consideration of all the above factors.

        • From Wikipedia:

          Examples of fair use in United States copyright law include commentary, search engines, criticism, parody, news reporting, research, and scholarship.

          https://en.wikipedia.org/wiki/... [wikipedia.org]

      • Re: (Score:2)

        by tepples ( 727027 )

        The owner of a lawfully made copy of a computer program has the right to load it into RAM as an essential step of using it. (17 USC 117(a)(1))

    • Re: (Score:1)

      by Anonymous Coward
      Like the hackers who would be really exploiting this would give a shit about a valid license.
    • So we gather you have zero experience in the field.

      • Re: (Score:2)

        by Luthair ( 847766 )
        I'm not a security researcher but I've been reviewing open source CVEs for 5-years.

    • Re: (Score:3)

      by Zak3056 ( 69287 )

      Fair question where the authors got the software if they didn't have a license. Just because you're a security researcher doesn't give you carte blanche to pirate.

      The publishers appear to be focused on SAP environments, and the PWC software appears to be implemented as a module in SAP. If I had to guess, I'd say they were auditing one of their customers and found the vulnerability that way. If so, there are no license issues here.

      • Re: (Score:2)

        by Luthair ( 847766 )
        That was my guess also, but the fact they don't seem to immediately respond with it makes me question whether that is the case.

        • Re: (Score:2)

          by Zak3056 ( 69287 )

          It could be that their customers require NDAs (up to and including who they are working for). Of course, it could also be that they have a giant honking vsphere cluster that they run all manner of SAP instances on that are totally unlicensed. :)

  • "PwC" is Price Waterhouse Coopers (Score:5, Informative)

    by 0xdeadbeef ( 28836 ) on Tuesday December 13, 2016 @09:48AM (#53475325) Homepage Journal

    It is apparently some sort of big accounting firm.

    • Thank you. I know of PricewaterhouseCoopers and figured this wasn't about jetskis, but I was unaware of what PwC meant and the summary never actually spelled out the company's name. I don't trade companies like this (their symbol is PwC) and their logo is stylized as pwc, not PwC.

  • Accountability (Score:3)

    by Aethedor ( 973725 ) on Tuesday December 13, 2016 @10:03AM (#53475399)
    For an accountant firm, they have a lot to learn about accountability.

    • Re: (Score:2)

      by HiThere ( 15173 )

      This isn't the first, or worst, time Price-Waterhouse have featured in the news. I thought (and hoped) they had gone out of business after the time they hit national news for fraudulent work. I just wasn't aware the PwC was Price-Waterhouse or I wouldn't have been at all surprised ... and would have suspected that the bug was intentional.

  • The cost of doing the right thing (Score:5, Insightful)

    by sinij ( 911942 ) on Tuesday December 13, 2016 @10:23AM (#53475483)
    This will likely going to be very expensive for the security researchers, as PricewaterhouseCoopers have deep pockets and a history of shady litigations [wikipedia.org].

    Assholes like PwC is why most security researchers don't bother with responsbile disclosure. It is by far much safer to anonymously dump it to pastebin.

  • What really sucks is... (Score:5, Interesting)

    by Last_Available_Usern ( 756093 ) on Tuesday December 13, 2016 @10:39AM (#53475591)
    There is probably a conscientious developer that wanted to work on this the day it was discovered but the company thought the cheaper track was to bury it, and now he's probably going to be fired and implicated as the reason the bug existed, or worse, wasn't patched.

  • The security firm provides a competing product (Score:3)

    by bongk ( 251028 ) on Tuesday December 13, 2016 @10:49AM (#53475657)

    It looks like the vulnerability is in a PwC product called ACE, which analyzes SAP security settings.
    The flagship product of the security firm that produced the disclosure appears to be "ESNC Security Suite", which from what I could tell appears to be a competing product.

    While I definitely support security research and responsible disclosure, it makes me a little uncomfortable that it appears this security firm could have chosen to target and test the PwC software because it is a competitor to software they produce.

    • Re:The security firm provides a competing product (Score:4, Insightful)

      by Ed Tice ( 3732157 ) on Tuesday December 13, 2016 @12:55PM (#53476401)
      There's a strong motivation to test a competing security company's products and find defects. Certainly something great to point out in a sales call. But I don't see why this is bad. If you're a security company, you should expect this. It's not just your competitors who are going to be looking hard. It's everybody. In this case a competitor disclosed responsibly. I don't think you can get a better outcome. Don't like it? Well first fix your flaw and then return the favor by helping audit your competitor's product!

    • Re: (Score:2)

      by tlhIngan ( 30335 )

      While I definitely support security research and responsible disclosure, it makes me a little uncomfortable that it appears this security firm could have chosen to target and test the PwC software because it is a competitor to software they produce.

      This is standard in any competitive market - the competitors ALWAYS purchase and evaluate their competitor's products. Ford, GM and Chevy all buy each other's cars and trucks to evaluate and figure out what works, what doesn't work, what can be improved and that

  • Sued for telling the truth and giving fair warning...

  • From the article:

    " an attacker could "manipulate accounting documents and financial results, bypass change management controls, and bypass segregation of duties restrictions," which could result in "fraud, theft or manipulation of sensitive data," as well as the "unauthorized payment transactions and transfer of money." An attacker could also add a backdoor to the affected server, the advisory said."

    Then legal threats

    Perhaps we could use a little deductive reasoning to conclude that this was not a f

  • It should be made a criminal offence, worded such that it can't be offloaded on the shareholders' pockets by means of a fine or settlement, to deter any security firm or white hat hacker that gives proper notification of a security flaw from publishing a security advisory after 90 days have expired from the moment of notification. That means responsible executives (or lawyers) will go to federal prison if this can be proven, whether they "knew about it" or not (to protect "junior staffers"). The public need

  • In an email, a spokesperson for PwC acknowledged the existence of the vulnerability and confirmed that it had been fixed.

    The spokesperson also said in separate prepared statement: "The code referenced in this bulletin is not included in the current version of the software which is available to all of our clients."

    It seems the article does a poor job of being impartial. Despite the above quotes, they continue with:

    It's far from the first time that a security firm or its researchers have faced the wrath from a company that fights instead of fixes.

    I am not sure what to make of this since there is still too much information being withheld from both PwC and the article and ESNC.

  • I love PwC's responses (Score:4, Insightful)

    by Blue23 ( 197186 ) on Tuesday December 13, 2016 @05:05PM (#53478697) Homepage

    I love the responses PWC gave.

    "ESNC did not receive authorized access or a license to use this software. The software is not publicly available and was only properly accessed by those with licenses, such as PwC clients working with trained PwC staff,"

    In other words trying t discredit them. There is nothing in that about the flaw not being real.

    But the one that had me laughing at the spin was:

    "The code referenced in this bulletin is not included in the current version of the software which is available to all of our clients."

    Makes it sounds like it's an old version that wasn't in use much anymore. But it was announced AFTER the fix. So publish the fix, which is now the "current version of the software" and since it's published "is available to all of our clients.". But really, that doesn't mean that most of your clients are running the patch, it silently sidesteps the whole thing.

    And the final one:

    "The bulletin describes a hypothetical and unlikely scenario -- we are not aware of any situation in which it has materialized,"

    Yes, I would expect access to an admin account not to be listed on the main menu, I can believe it's an unlikely scenario. It's not actually hypothetical if it's been done by the security firm, so that part is a lie. The "we are not aware of any situation in which it has materialized" just means "we didn't catch it".

  • You know, a simple "Thank you for finding this flaw in our product. Here is a $check as our thank you for finding this and reporting it before the $BadGuys exploited it."

Slashdot Top Deals

Beware of Programmers who carry screwdrivers. -- Leonard Brandwein

Close