Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

zdnet.com

Post reply on HN
Print view View original

161–170 of 344 posts

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#161

Post by nwatson »

nicoburns wrote: post #152
hirako2000 wrote: post #136

Earlier quoted context omitted.

No it's not easy to switch. Engineeting Organisations have invested a lot in the Jira eco system, that includes custom workflows that are understood only by a few to be able to alter them, users are productive right now with jira and nobody wants them less productive even just for a while learning another task manager. Here again the integration effort to migrate would scare any leader who would be blame for the impa…

> "Just embed a confluence page into a task" Except that confluence and JIRA are both so slow that you'll still be there 2 minutes later waiting for it to load. Perhaps not everybody's experience is so bad? I don't understand how anyone could consider these products convenient given how ridiculously slow they were. We used to do refinement meetings over video call (I guess everyone is these days) inputting into JIRA,…

We use the cloud version, I've edited huge Confluence pages and it's typically very snappy. Jira likewise. Could be an under-resourced on-premise deployment?

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#162

Post by nerdponx »

cogman10 wrote: post #78
pletnes wrote: post #74

Earlier quoted context omitted.

There are many jira alternatives out there, from what I can tell. Why are they not disrupted already, if it’s such a low hanging fruit? (Honest question - I don’t have any personal preference)

Atlassian products are vast, integrated, and support all the crazy draconian processes that every insane project manager wants to implement. You can't easily dump Jira if you are using Jira, confluence, bitbucket, and whatever their CI/CD product is called (bamboo?)

How many PMs actually use those features? In my organization, for example, I don't see any reason why we should prefer Atlassian over Taiga, other than familiarity and inertia.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#163

Post by skinkestek »

detaro wrote: post #86
skinkestek wrote: post #81

Earlier quoted context omitted.

Maybe. But I have a hunch that we are severely underestimating huge parts of the workforce. I mean: ux discussions often feels like they assume users are a separate species somewhere between ordinary humans and chimps when it comes to intelligence. I have some experience with training users and I have only given up once.

I fully agree that you can train users for a lot. But the question is if it's worth doing so in the specific case. And wikis often already have trouble with people not using them enough, making them seemingly hard to use doesn't help.

Don't forget that in many ways some real wikis like Dokuwiki are simpler and more user-friendly than Confluence:

- you can edit a paragraph without locking or creating conflicts for the whole page

- it is much faster, and as far as I can see the observe–orient–decide–act loop is a real thing and should be taken into account

- much better wiki syntax (compared to old Confluence)

- trivially extensible so you can create forms and other helpers to make it simpler for users to do the right thing

- if one absolutely need it I think there exist at least one wysiwyg extension for Dokuwiki

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#164

Post by Galanwe »

Lndlrd wrote: post #126
dijit wrote: post #87

> The vulnerability only affects on-premise servers, not those hosted in the cloud. This is a dangerous statement to make and should be revised to say: > The vulnerability only affects standalone versions of the software, not the managed service of confluence provided directly by Atlassian. The problem with the former is that lesser technical people, especially directors, might assume they're fine because their stand…

99% agreed. Reserving 1% because I'd strike "lesser technical" from your final sentence. The misleading quote is simply not correct. It is misleading because it's not true. It says Confluence hosted in the cloud is not vulnerable. False statement that can mislead anyone regardless of how technical they are.

Let's say 99.5%, because Atlassian hosted offering is called "Atlassian Cloud"

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#165

Post by thatsamonad »

miken123 wrote: post #23

Atlassian was so kind to update their mailing lists somewhere over the last year or so. Previously, they would email the 'technical contact' of the license about any vulnerabilities. They quietly switched to some other notification system and never informed us about it. Hence we missed the update and got a free Bitcoin miner. Thanks Atlassian, I'll make sure to get your products out of the door as soon as possible. […

Another issue is that they sent out the initial communication on August 25th (which I did receive), but the original wording indicated that it only affected servers that allowed user self-registration. We didn’t have that enabled, so I held off for a bit because the risk seemed lower and our upgrade process is a bit arduous (we have quite a few customizations on the server and need to perform all upgrades on a test instance and validate first) and our instance requires authentication through a load balancer before it’s even accessible.

Then, Atlassian updated the ticket a day later to state the issue affected all servers on the affected versions regardless of user authentication or registration but didn’t send out a follow up communication when they did so. Instead they waited until Friday afternoon before a US holiday weekend to send out another update. So if you weren’t watching the source ticket directly and thought you could wait due to the setting distinction you wouldn’t have known for over a week and you were left vulnerable.

Atlassian should have sent out another communication to all customers as soon as they knew the scope was broader than they had initially thought.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#166

Post by hn_throwaway_99 »

SV_BubbleTime wrote: post #159
daniaal wrote: post #2

Twitter link to a case of the vulnerability being exploited: https://twitter.com/th3_protoCOL/status/1433414685299142660 NIST Link to issue: https://nvd.nist.gov/vuln/detail/CVE-2021-26084 Tweet from USCYBERCOM urging users to patch: https://twitter.com/CNMF_CyberAlert/status/14337876717851852... Tweet from BadPackets showing where the bad actors are originating from: https://twitter.com/bad_packets/status/1433157632…

Helpful links, looks like failure to sanitize input. Classic. But on the “attacks coming from”, I’ve never understood putting stock in these. Aren’t these all going to be proxies and botnets?

Failure to sanitize input is one thing, but the bigger issue to me is that, with so many of these Java server installations, that a simple injection can immediately lead to "game over" from a server takeover perspective.

For the bug in question, I bet the vast majority of webservers never need the ability to call unrestricted Runtime.exec(), yet access to that is just one unsanitized input away from complete control over your server.

OS vendors have made leaps and bounds in the past decade making it much harder for code vulnerabilities to lead to system takeover. I'd argue it's time for server code and language runtimes to make it easier to write secure code.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#167

Post by nonameiguess »

polote wrote: post #29
m_eiman wrote: post #6

Earlier quoted context omitted.

Any suggestions on what to use instead of Confluence? Need to run on-prem, it's mostly the wiki-like features I'm interested in.

Biased but I'm actually building a competitor (V1 is almost ready) to Confluence for medium to big organizations. But I don't understand your requirement for on-prem. That's clearly not an advantage from the security point of view. Apart from Quip, Sharepoint and Confluence (soon stopped) I'm not sure there is any commercial knowledge base tool that are available on-prem. The only thing that you can hope for, is "bri…

PII, PHI, classified data, controlled unclassified information, proprietary trade secrets, a requirement to host user data in the country the user lives, a company is massive enough to own data centers and may as well use them. There are so many reasons to self-host. Unless your service is as big as AWS/Azure and can afford to build a private cloud in a location of the customer's choosing for sufficiently large customers, "only cloud" isn't good enough for many use cases. You're putting your own convenience as a developer ahead of the needs of certain users. Which is fine, I guess. You don't need to serve everyone. But you shouldn't be out there acting like self-hosting never makes sense. You may as well ask why some facilities have their own generators and their own wells and don't just universally hook into the public grids. Some applications have requirements for hard perimeters and self-reliance.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#168

Post by marcinzm »

Cederfjard wrote: post #106
marcinzm wrote: post #95

Earlier quoted context omitted.

Jira is as complex as you make it and you can't solve people issues with technology. So another solution won't solve your manager problem. That said, the UI is an abomination that will one day summon the elder gods to reap us all.

I mean, if the problem you have is that Jira lets you set up overly complex workflows, then a more limited solution that forces a simpler way of working could have a positive effect? I do agree that you don’t HAVE to make things more complicated than necessary in Jira, but obviously some do that anyway.

If the manager wants a complex workflow then they will make one outside the project management software if needed. Except now you'll need to manually track everything as a developer.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#169

Post by marcinzm »

da39a3ee wrote: post #120
marcinzm wrote: post #95

Earlier quoted context omitted.

Jira is as complex as you make it and you can't solve people issues with technology. So another solution won't solve your manager problem. That said, the UI is an abomination that will one day summon the elder gods to reap us all.

Taking away configuration options from most Jira project managers I’ve come across would be a very helpful first step.

Then they'll just have the same requirements outside the software and it'll be on the developers to manually track it. Then communicate it in hour long standup meetings or something. Or bother engineers every few hours to communicate them directly. Complex corporate processes predate Jira and exist in places where the only tracking is Excel documents.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#170

Post by edoceo »

nickspicer1993 wrote: post #104
pletnes wrote: post #74

Earlier quoted context omitted.

There are many jira alternatives out there, from what I can tell. Why are they not disrupted already, if it’s such a low hanging fruit? (Honest question - I don’t have any personal preference)

I think it already has been disrupted but no company is going to switch task management software without a really good reason. But I can't imagine and fresh companies are choosing Jira over Clubhouse, Asana, Trello or what I hope to be my company at some point! https://tahsk.com

My new companies aren't. Gitlab is the new hotness
Post reply on HN