- N-able took the hosted version of its N-central remote-management software offline after security researcher Sean Bales published code late Sunday to exploit 33 unpatched flaws, American Banker reported. The collection, which Bales called Able2Shell, was posted on GitHub. By Tuesday night the company had shipped a fix and upgraded all of the servers it runs for customers.
- N-central is the console that managed service providers use to monitor, patch and remotely control client machines, a setup widely used by community banks and credit unions. When that console goes dark, the provider loses its view of every client machine; anyone who takes it over inherits the same control. More than 500,000 organizations use N-able’s software, according to the company’s most recent annual report, which does not say how many use N-central specifically.
- N-able took hosted N-central offline in the Americas, Europe and Asia-Pacific on Monday and told customers who run the product on their own servers to take those servers offline. It released a fix at 3:48 p.m. Eastern on Tuesday and said at 8:04 p.m. that all hosted servers “across all global regions have been successfully upgraded.” Hosted environments “are back online,” a spokesperson told American Banker on Wednesday, though the company said it was “observing scanning activity associated with the published proof-of-concept code.”
- This week’s outage is the third security emergency for N-central since August. Attackers began exploiting an earlier flaw on July 31, and the New York State Department of Financial Services later told regulated firms to find out whether any of their providers ran N-central. American Banker reported Wednesday that a ransomware group had apparently exploited that earlier vulnerability and has claimed six victims, two of which have confirmed a data breach, including Sawyer Savings Bank. In September, N-able fixed a flaw rated 10 out of 10 that the federal vulnerability database lists as known to be exploited.
What Happened?
A bank cannot install the Tuesday fix itself. Providers that run N-central on their own servers have to install it, and until they do those servers should “remain offline,” according to the company’s status page. All customers, including those on N-able’s hosted service, also have to upgrade the N-central software on each machine they manage. The built-in remote-control feature “is currently unavailable and will be re-enabled in a future fix.” Huntress, which monitors MSP systems, said Tuesday evening it had not observed evidence of Able2Shell exploitation in its partners’ environments. The fix addresses “the most critical November 9 vulnerabilities,” with a follow-up hotfix still to come.
Why It Matters?
The repeated emergencies matter because N-central sits upstream of hundreds of community banks and credit unions that have outsourced their IT. A single unpatched console is a path into many institutions at once, which is why NYDFS warned firms in August and why a ransomware group’s claims, even if still limited to a handful of confirmed breaches, will keep examiners focused on vendor management. N-able CEO John Pagliuca said claims that the company “ignored responsible disclosure” from Bales are “inaccurate,” and that publishing exploit code before customers can act “hands attackers a head start.” Bales did not immediately respond to a request for comment. Public information does not suggest he works for or is endorsed by Oracle, the software company; he had originally posted under the GitHub name Oracle-Security.
What’s Next?
The near-term watch is whether self-hosted providers install the patch before the scanning activity turns into confirmed Able2Shell exploits, and when N-able ships the follow-up hotfix and restores remote control. Banks whose IT providers still run self-hosted N-central need confirmation that the fix is in and that agent software on each managed machine has been upgraded. Examiners will also look at whether the six claimed ransomware victims, and any additional names, widen beyond the two confirmed breaches.
Affected Tickers and Coins: NABL
Source: American Banker
