Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

zdnet.com

Post reply on HN
Print view View original

51–60 of 344 posts

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#51

Post by fnord77 »

CodeGlitch wrote: post #9
Closi wrote: post #7

Earlier quoted context omitted.

So that users can be at home or on a mobile device without requiring them to have VPN. But so that you still can ensure data-locality or run a customised instance e.t.c. if you have requirements around that. Plus licensing is approx. 40% of the full SaaS cost at scale so may be cheaper to deploy that way.

But why are they not using VPN?

our VPN is a PITA to connect to.

being connected all the time sucks for zoom meetings as the vpn server is on the other side of the continent.

I love having access to most of my work tools outside the vpn - github, confluence, jira, aws console.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#52

Post by cheschire »

PaulWaldman wrote: post #44
ev1 wrote: post #14

Earlier quoted context omitted.

They are generally exposed through a proxy that sits in between. If you don't authenticate, you can't send a request to it at all. (This is opposed to the lazy model, where your aplication is fully exposed to the web and you click log in and it redirects to SSO - if there is a vulnerability that doesn't require authentication you're already compromised) The proxy will handle sign in and passes traffic to/from the web…

Do these proxies encrypt the traffic? Since they would handle authentication, I am guessing encryption is used. We may be getting into semantics, but at that point, is there much of a difference between a proxy and a VPN? I had the impression that in a zero trust environment all apps are required to be hardened to the point that they are deemed safe to be exposed to the publc internet.

VPNs are a very different technology. The amount of network traffic alone is a huge difference.

You may be confusing inbound and outbound proxies. If an inbound proxy is put in front of a server, it is able to be extremely hardened without exposing the webserver, and only allows traffic in extremely limited ways. This frees up the webserver to be more open to the internal network, obfuscates information about the webserver to outsiders, etc.

You may be thinking of an outbound proxy where all of your web requests travel through it in order to provide web filtering, protected DNS, and other protective services to internal endpoints and clients that are already on your network.

A VPN is a much deeper connection than an inbound proxy. It typically requires the external endpoint to be trusted, which is the complete opposite state of an endpoint connecting through an inbound proxy. It then allows the endpoint to operate from a position of trust within the whole internal network. Patches can be updated, endpoints can communicate with each other, and the full network traffic of the endpoint routes through the network. With a VPN you even wind up going through the outbound proxy typically!

YMMV though, not every org is setup exactly like this. I’m making gross generalizations about things. Definitely do some web searches on the differences.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#54

Post by Mandatum »

miken123 wrote: post #37
angry_octet wrote: post #33

Earlier quoted context omitted.

Well, I got it. Maybe you specifically didn't get it, or maybe there is something filtering it.

I only got the 'update' from last Saturday, by then it was too late already. Their original advisory was from the 25th, they should have mailed me back then.

How big is your organisation? I know it shouldn’t matter but your CS person would likely have reached out if they’re anything like Amazon, Microsoft, Salesforce, etc.

I’ve always found government, sensitive customers (banks, payment processors, healthcare) and big spenders get prioritised with phone call notifications.

However with a deprecated product, the financial impact is so minuscule - leadership won’t prioritise this one unless you’re big fish.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#55

Post by [deleted] »

miken123 wrote: post #23

Atlassian was so kind to update their mailing lists somewhere over the last year or so. Previously, they would email the 'technical contact' of the license about any vulnerabilities. They quietly switched to some other notification system and never informed us about it. Hence we missed the update and got a free Bitcoin miner. Thanks Atlassian, I'll make sure to get your products out of the door as soon as possible. […

[deleted]

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#56

Post by chrisseaton »

mrweasel wrote: post #18
spullara wrote: post #5

Why are internally hosted instances even available on the public internet?

Because you might need it to share documentation with customers. Confluence isn't just for external documentation. Confluence, at it's core, is just a wiki. Sometimes it needs to be available online, sometimes it really doesn't.

If you’re ok sharing things externally why self-host at all?

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#57

Post by galangalalgol »

jordanbeiber wrote: post #49
marcus_holmes wrote: post #46

Earlier quoted context omitted.

I have no idea why you're being downvoted - this is true. Atlassian produce some of the worst tech on the planet. Trying to administer this crap is horrible. And don't get me started on how many project managers spend all day staring at Jira tickets instead of actually talking to their teams. Management-by-Jira is a disease, a symptom of bad organisational culture.

But jira is only a tool right? Blaming Atlassian for a poorly led organization seems slightly misguided. At some project size, measured either by software complexity/interoperability or user base, you will need a tool to manage issues and tasks. What you're talking about is an organization where developers are not empowered - but even empowered developers need an issue tracker or a board of some description. A "manag…

A good tool cannot guarantee good results, but a bad tool can shape its user's behavior in bad ways. The same individual without that tool might have behaved differently. I have seen this in what I call design-by-ticket where all the why and how for a design decision, including design by committee meeting notes, get put in jira tickets.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#58

Post by plasma »

m_eiman wrote: post #6
echelon wrote: post #4

I am not in the least bit shocked. Atlassian products are some of the worst glued-together garbage in the industry. The entire product surface area is probably rife with exploits. Using Confluence or Jira will show you just how much Atlassian cares about its own products. I'd love for this to be the straw that breaks the camel's back and makes IT/infosec orgs move away from this bilge.

Any suggestions on what to use instead of Confluence? Need to run on-prem, it's mostly the wiki-like features I'm interested in.

You could put Cloudflare Access (with Tunnel) in front to shield against exposing the instance directly, I’ve used it in the past for other products that has been good.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#59

Post by macksd »

polote wrote: post #47
macksd wrote: post #40

Earlier quoted context omitted.

Any time a SaaS gets compromised there's a similar comment here about how obviously this is going to happen when you give someone else your data, and it should have just all been within your own firewall, unexposed directly to the Internet. I mean right this minute there's a privacy-focused SaaS on the front page for not being as private as everyone thinks. There's also a network hardware vendor on the front page for…

If you can afford to not expose it to the internet obviously you are going to have better security. But this is not always desirable talking about wiki software. I can't disagree with you. But you can either deny that the average Saas is more secure than a forgot Confluence internal servers exposed to the internet

Well yes, public wikis are one thing. But before you were talking about protecting internal secrets.

Re: US Cybercom says mass exploitation of Atlassian Confluence vulnerability ongoing

#60

Post by chrisseaton »

CodeGlitch wrote: post #9
Closi wrote: post #7

Earlier quoted context omitted.

So that users can be at home or on a mobile device without requiring them to have VPN. But so that you still can ensure data-locality or run a customised instance e.t.c. if you have requirements around that. Plus licensing is approx. 40% of the full SaaS cost at scale so may be cheaper to deploy that way.

But why are they not using VPN?

Some people think VPNs are harmful - see the Google BeyondCorp model.
Post reply on HN