https://www.channelfutures.com/wp-content/themes/channelfutures_child/assets/images/logo/footer-new-logo.png
  • Home
  • Technologies
    • Back
    • SDN/SD-WAN
    • Cloud
    • RMM/PSA
    • Security
    • Telephony/UC/Collaboration
    • Cable
    • Mobility & Wireless
    • Fiber/Ethernet
    • Data Centers
    • Backup & Disaster Recovery
    • IoT
    • Desktop
    • Artificial Intelligence
    • Analytics
  • Strategy
    • Back
    • Mergers and Acquisitions
    • Channel Research
    • Business Models
    • Distribution
    • Technology Solutions Brokerages
    • Sales & Marketing
    • Best Practices
    • Vertical Markets
    • Regulation & Compliance
  • MSP 501
    • Back
    • 2022 MSP 501 Rankings
    • 2022 NextGen 101 Rankings
  • Intelligence
    • Back
    • Galleries
    • Podcasts
    • From the Industry
    • Reports/Digital Issues
    • Webinars
    • White Papers
  • Channel Futures TV
  • EMEA
  • Channel Chatter
    • Back
    • People on the Move
    • New/Changing Channel Programs
    • New Products & Services
    • Industry Honors
  • Resources
    • Back
    • Advisory Boards
    • Industry Organizations
    • Our Sponsors
    • Advertise
    • 2022 Editorial Calendar
  • Awards
    • Back
    • 2022 MSP 501
    • Channel Influencers
    • Circle of Excellence
    • DE&I 101
    • Channel Partners 101 (CP 101)
  • Events
    • Back
    • CP Conference & Expo
    • MSP Summit
    • Channel Partners Europe
    • Channel Partners Event Coverage
    • Webinars
    • Industry Events
  • About Us
  • DE&I
Channel Futures
  • NEWSLETTER
  • Home
  • Technologies
    • Back
    • SDN/SD-WAN
    • Cloud
    • RMM/PSA
    • Security
    • Telephony/UC/Collaboration
    • Cable
    • Mobility & Wireless
    • Fiber/Ethernet
    • Data Centers
    • Backup & Disaster Recovery
    • IoT
    • Desktop
    • Artificial Intelligence
    • Analytics
  • Strategy
    • Back
    • Mergers and Acquisitions
    • Channel Research
    • Business Models
    • Distribution
    • Technology Solutions Brokerages
    • Sales & Marketing
    • Best Practices
    • Vertical Markets
    • Regulation & Compliance
  • MSP 501
    • Back
    • 2022 MSP 501 Rankings
    • 2022 NextGen 101 Rankings
  • Intelligence
    • Back
    • Galleries
    • Podcasts
    • From the Industry
    • Reports/Digital Issues
    • Webinars
    • White Papers
  • Channel Futures TV
  • EMEA
  • Channel Chatter
    • Back
    • People on the Move
    • New/Changing Channel Programs
    • New Products & Services
    • Industry Honors
  • Resources
    • Back
    • Advisory Boards
    • Industry Organizations
    • Our Sponsors
    • Advertise
    • 2022 Editorial Calendar
  • Awards
    • Back
    • 2022 MSP 501
    • Channel Influencers
    • Circle of Excellence
    • DE&I 101
    • Channel Partners 101 (CP 101)
  • Events
    • Back
    • CP Conference & Expo
    • MSP Summit
    • Channel Partners Europe
    • Channel Partners Event Coverage
    • Webinars
    • Industry Events
  • About Us
  • DE&I
    • Newsletter
  • REGISTER
  • MSPs
  • VARs / SIs
  • Agents
  • Cloud Service Providers
  • Channel Partners Events
 Channel Futures

RMM/PSA


Shutterstock

Rooster Crowing

Wake-Up Call: What the ConnectWise Control Security Vulnerabilities Mean for MSPs

  • Written by Allison Francis
  • January 27, 2020
The vulnerabilities highlight the gaps in security for MSPs using RMM tools, and the urgent need to patch systems.

Last week, multiple security flaws were found in ConnectWise Control, a remote control software product in the MSP software community, according to cybersecurity consulting firm Bishop Fox and validated by Huntress Labs. The software was found to contain eight security vulnerabilities that could give hackers the ability to create an “attack chain” that would allow cybercriminals to hijack an MSP’s systems and compromise their customers’ devices.

Individually, the vulnerabilities were not deemed not severe, according to Bishop Fox. Only one, a cross-site request forgery (CSRF) flaw, was flagged as critical. All together, however, the eight issues could have been combined to create an attack chain that, by its very definition, could have snowballed to the point where it compromised a ConnectWise Control server and, from there, any connected clients.

“An attacker that exploits the full attack chain can achieve unauthenticated remote code execution, resulting in compromise of the ConnectWise Control Server and ultimately the endpoint it has been installed on,” said Daniel Wood, the associate vice president of consulting for Bishop Fox. “This would provide full control over the vulnerable endpoint.”

This is undoubtedly the tip of the iceberg for MSPs using remote monitoring and management (RMM) tools. There is no question that hackers are increasingly targeting MSPs, and that they are targeting those who use RMM tools — a scary reality for those woefully behind the curve in terms of having plans in place to fix problems by patching their systems, or by requiring their software vendor to patch their systems if they’re cloud-provided.  

Jason Ingalls, founder and CEO of Ingalls Information Security, says there doesn’t seem to be the necessary sense of urgency with regard to handling security issues among MSPs. Ingalls, who has worked in Fortune 50 company breach response for over a decade and small-to-midsize business breaches (including MSP breaches) for the last five years, stresses the serious nature of these vulnerabilities, and the potential havoc they can wreak on businesses. 

Ingalls Infosec's Jason Ingalls

Ingalls Infosec’s Jason Ingalls

“These are very serious problems that must be addressed,” said Ingalls. “We’ve seen breaches that are devastating to the point where they will put organizations out of business. RMM essentially has the potential to hand cybercriminals the keys to the kingdom.”

Ingalls says that this is just the start, and that he expects the industry will see similar vulnerabilities crop up across the RMM marketplace. 

“MSPs need to look at this as a warning and a learning opportunity,” he adds. “Any software can have serious vulnerabilities. MSPs need mechanisms in place to be able to identify intrusions and respond to them, as well as a security process to cover them in the event of loss. This is a chance for MSPs, and vendors, to do the right thing. The ones that don’t are going to wind up costing themselves, and possibly their clients and their business.”

Juan Fernandez, vice president for managed IT services at ImageNet Consulting, echoes Ingalls, saying that MSP’s must take caution in this new era of attacks.

“First and foremost, MSP’s must implement security best practices within their own companies,” says Fernandez. “This includes internal and external security controls, making sure you take nothing for granted and audit controls from every angle, even from places you wouldn’t expect. It is critical that as IT service providers, we make sure we are working diligently to ensure our customers are protected even from ourselves.”

Bishop Fox indicated that it is also looking for potential security flaws in other remote monitoring and management tools for MSPs, meaning that if RMM tools are not architected or configured properly, MSPs can expose themselves and their customers to a “whole bunch of different security concerns.”

Of course, any technology that makes it easier for organizations to share/manage resources inherently carries with it …

  • Page 1
  • Page 2
Tags: MSPs Best Practices Cloud RMM/PSA Security Technologies

Most Recent


  • Hired
    Former CenturyLink, Spearhead Channel Leader Joins Equinix
    Equinix conducted about 30% of its business through partners a year ago and has vowed to increase that number.
  • Cloud Roundup
    Oracle Cloud & AT&T, AWS Lead Cloud News Roundup
    Find out what’s happening with each company and how it all ties to the channel.
  • Mergers acquisitions m&a goldfish crackers
    Latest M&A: IBM, Vonage, Nokia, GoTo, Nitel, Ensono, Huntress, More
    One cybersecurity company's $22 million July acquisition was its largest to date.
  • Why DevOps Teams Need Security Skills and How Shift Left Tools Help
    Developers need cloud-native security skills and tools to build secure code from the start to mitigate risks.

One comment

  1. Avatar Thomas fox January 28, 2020 @ 7:06 am
    Reply

    Excellent reporting Allison, and I think Jason Ingalls has summed it up perfectly: There is a lack of urgency and not nearly enough transparency from the leading RMM vendors.

    Two points for two different vendors:

    ConnectWise was aware of the vulnerabilities in late September and patched most of them in early October, 2019. This is exactly how it should be handled. Where ConnectWise failed was in communication. They made no public disclosures about these potential vulnerabilities until after Bishop Fox made their announcement. What should have happened was vulnerability discovery, remediation, and then an alert sent out to their customer base that said, “Hey, we are aware of some potential issues, here is the information on it and here is the link to the patch that addresses them.”

    Similarly, SolarWinds was aware of a SERIOUS vulnerability in their N-Central product that leaked plain-text credentials in October, 2019, yet failed to make any kind of disclosure or alert to their client base until after information on the vulnerability was announced by a third party. The credential compromise was easy to exploit (it took me less than ten minutes to verify the leak independently) and was easily mitigated by removing the credentials from certain areas of N-Central. In the case of N-Central, perhaps full remediation would take some time, but an immediate alert that said “There’s an issue with N-Central leaking credentials, immediately remove them from these areas of the product until we can release a patch” was not only appropriate, but really required. They failed us miserably.

    I think ConnectWise and Jason Magee are headed in the right direction with the new security center, and I hope Solarwinds does something similar. I understand they have a fine line to walk when it comes to disclosing vulnerabilities – do they hold the information close until a patch is released, or do they immediately notify customers so temporary steps can be taken until a patch is ready? Each situation will require a judgment call, but in all cases they should err on the side of caution and disclosure.

    When responsible researchers notify these companies of an issue, there should never be a case where we find out about them from a third party rather than the RMM vendor themselves. Regardless of the intent, when we find out from a third party, the optics are that they don’t value our partnership and take our security seriously. They have to do better.

Leave a comment Cancel reply

-or-

Log in with your Channel Futures account

Alternatively, post a comment by completing the form below:

Your email address will not be published. Required fields are marked *

Related Content

  • Fortune 500 2021 logo
    AT&T, Microsoft, Verizon, More Tech, Telco Companies Make Latest Fortune 500
  • Database
    New Gradient MSP Tool Combats 'Dirty Data' Frustrating Vendor Sales Processes
  • IPO
    iboss Could Join KnowBe4, Darktrace, Datto, Others in Tech IPO Onslaught
  • Surprised Businessman
    SolarWinds Hack: More Surprises, Plus Why Heads Didn't Roll

Upcoming Events

View all

MSP Summit

September 13, 2022 - September 16, 2022

Channel Partners Conference & Expo

May 1, 2023 - May 4, 2023

Galleries

View all

Oracle Cloud & AT&T, AWS Lead Cloud News Roundup

August 12, 2022

Latest M&A: IBM, Vonage, Nokia, GoTo, Nitel, Ensono, Huntress, More

August 12, 2022

Partner Program Updates: Microsoft, TD Synnex, AppSmart, Cisco, Verizon

August 11, 2022

Industry Perspectives

View all

How to Take Shared Responsibility for Securing Cloud

August 11, 2022

Seize the Application Modernization Opportunity

August 2, 2022

A Growth Mindset: Your Organization’s Strategic Differentiator

August 1, 2022

Webinars

View all

Outsmarting RaaS: Implementation Strategies To Help Your Clients Before, During, and After a Ransomware Attack

August 23, 2022

Why it is Important to Upgrade Aging Servers and How to use Live Optics to Upgrade Efficiently

August 25, 2022

Executives at Home are Not Alright: An Intro to Digital Executive Protection

September 8, 2022

White Papers

View all

Work Goes Remote – (and Other Top ITOps Trends)

May 25, 2022

The New Bottom Line: How MSPs Can Meet the Healthcare Crisis While Evolving Their Businesses

April 19, 2022

How to build a Security Operations Center (on a budget)

April 4, 2022

Channel Futures TV

View all

ThreatLocker Preaches Zero Trust, Addresses Industry Competition

ScienceLogic Debuts New Partner Portal

August 9, 2022

Vonage a ‘Single Communications Stack Provider’ for Partners, Customers

June 27, 2022

IBM, Partners and the $1 Trillion Hybrid Cloud Opportunity

June 26, 2022

Twitter

ChannelFutures

Nancy Henriquez, VP of Sales & Marketing at MSP 501 award-winning @synetek, touches on the importance of gathering… twitter.com/i/web/status/1…

August 12, 2022
ChannelFutures

.@Equinix's new hire is a familiar face in the telco channel. dlvr.it/SWXV6v https://t.co/jIg0LrZ4DO

August 12, 2022
ChannelFutures

Missed the news this week from @OracleCloud and @ATTBusiness? We've got it here. Plus, news from @AWSCloud and… twitter.com/i/web/status/1…

August 12, 2022
ChannelFutures

Huge channel-impacting acquisitions in the past month. We've got details on @IBM, @nokia, @GoTo, @EnsonoIT,… twitter.com/i/web/status/1…

August 12, 2022
ChannelFutures

Boost privacy by design with #shiftleft mindset and add #security to cloud deployments from start, says… twitter.com/i/web/status/1…

August 12, 2022
ChannelFutures

Say sayonara to contract renewals - @KaseyaCorp responds to mounting customer concerns with significant changes.… twitter.com/i/web/status/1…

August 11, 2022
ChannelFutures

.@Kyndryl, @Five9 partnership will focus on cloud-based #contactcenter solutions. dlvr.it/SWTFPx https://t.co/WGQedUjSB1

August 11, 2022
ChannelFutures

How cloud providers and customers can work together to safely share and secure responsibility in the cloud. @Cisco… twitter.com/i/web/status/1…

August 11, 2022

MSP 501

The industry's largest and most comprehensive partner awards program.

Newsletters and Updates

Sign up for The Channel Report, Channel Futures Update, MSP 501 Newsletter and more.

Live Channel Events

Get the latest information on the next industry-leading Channel Partners event.

Galleries

Educational slide shows and images from live events.

Media Kit And Advertising

Want to reach our audience? Access our media kit.

DISCOVER MORE FROM INFORMA TECH

  • Channel Partners Events
  • Telecoms.com
  • MSP 501
  • Black Hat
  • IoT World Today
  • Omdia

WORKING WITH US

  • Contact
  • About Us
  • Advertise
  • Newsletter

FOLLOW Channel Futures ON SOCIAL

  • Privacy
  • CCPA: “Do Not Sell My Data”
  • Cookie Policy
  • Terms
Copyright © 2022 Informa PLC. Informa PLC is registered in England and Wales with company number 8860726 whose registered and Head office is 5 Howick Place, London, SW1P 1WG.
This website uses cookies, including third party ones, to allow for analysis of how people use our website in order to improve your experience and our services. By continuing to use our website, you agree to the use of such cookies. Click here for more information on our Cookie Policy and Privacy Policy.
X