IT software vendor banks use hit with third security threat

• What’s at stake: Anyone who takes over an IT provider’s N-central console inherits control of every client machine on it, including those at banks and credit unions.
• Forward look: N-central’s built-in remote-control feature is unavailable and will be re-enabled in a future fix, according to N-able’s release notes.

Overview bullets generated by AI with editorial review.

Processing Content

Late Sunday, a security researcher published code to exploit 33 unpatched flaws in a product many small banks’ IT providers use to manage and access bank systems.

N-able, the company that owns and operates N-central, the product, took the hosted version of the product offline shortly after the vulnerabilities became public. By Tuesday night, it had shipped a fix and upgraded all of the servers it runs for customers.

N-central is software that IT providers use to monitor, patch and remotely control their clients’ computers. Community banks and credit unions commonly hire such providers, known as managed service providers, or MSPs, to run their IT.

When an IT provider’s N-central console (the dashboard it uses to manage client machines) goes dark, the provider loses its view of every client machine it manages. Anyone who takes over that console inherits the same control.

The New York State Department of Financial Services, or NYDFS, told the firms it regulates in an August letter to find out whether any provider supporting their systems runs N-central.

The letter portended trouble; American Banker reported Wednesday that a ransomware group had apparently exploited the very vulnerability about which NYDFS had warned.

So far, the group has claimed six victims, two of which have confirmed a data breach. One of those two is Sawyer Savings Bank, which American Banker identified in August as a potential victim of the initial N-central vulnerability.

More than 500,000 organizations use N-able’s software, according to the company’s most recent annual report. The report does not say how many use N-central.

The researcher who published the 33 vulnerabilities, Sean Bales, published the code and descriptions of the flaws on GitHub late Sunday, calling the collection Able2Shell.

N-able took the hosted version of N-central offline in the Americas, Europe and Asia-Pacific on Monday and told customers that run N-central on their own servers to take those servers offline, according to its status page.

The company released the fix at 3:48 p.m. Eastern time Tuesday. At 8:04 p.m., it said on the status page that all hosted servers “across all global regions have been successfully upgraded.”

Hosted environments “are back online,” an N-able spokesperson told American Banker on Wednesday.

N-able is “observing scanning activity associated with the published proof-of-concept code,” according to N-able’s status page. In other words, someone (potentially an attacker) is searching the internet for servers against which Bales’ exploit code could work.

Huntress, a security firm that monitors MSPs’ systems and calls them its partners, “has not observed evidence of Able2Shell exploitation in our partners’ environments,” according to a Tuesday evening update to its blog post on the flaws.

What the fix leaves for IT providers

The fix addresses “the most critical November 9 vulnerabilities,” and “a follow-up hotfix will be released to provide further security updates,” N-able said on the status page.

A bank can’t install the fix itself. Providers that run N-central on their own servers have to install it. Until they do, those servers should “remain offline,” according to the status page.

All customers, including those on N-able’s hosted service, also have to upgrade the N-central software installed on each machine they manage, according to the fix’s release notes.

N-central’s built-in remote-control feature “is currently unavailable and will be re-enabled in a future fix,” according to the notes.

As such, any bank whose IT provider uses a self-hosted instance of N-central (as opposed to an instance that N-able hosts) must make sure its provider installs the fix.

The third emergency since August

This week’s outage is the third security emergency N-central has had since August.

Attackers began exploiting an earlier N-central flaw July 31, and N-able released a fix Aug. 2. The New York department issued its letter Aug. 11 and later said the flaw had affected a “limited number” of the firms it regulates.

A ransomware group Microsoft tracks as Storm-1175 was likely exploiting that August flaw, Microsoft said in an Aug. 7 post.

In September, N-able fixed a flaw that let attackers run code on an N-central server without logging in. The federal government’s vulnerability database lists the flaw as known to be exploited and shows N-able’s own severity rating for it: 10 out of 10.

When it released that fix, N-able said it had “no confirmations that this vulnerability has been exploited in production environments,” according to the release notes.

Three days later, the company said it had “observed a handful of successful exploits against N-central customers,” according to an update to its blog.

The researcher who published new vulnerabilities on Sunday

Bales originally posted his research under the GitHub name Oracle-Security, where a disclosure policy said he publishes when vendors “were unresponsive or took too long in previous responsible disclosures.” On Wednesday, he renamed the account and deleted the policy.

Public information does not suggest Bales works for or is endorsed by Oracle, a multinational IT company that produces database software and other products. (A spokesperson for Oracle did not immediately respond to a request for comment.)

N-able said in a statement that claims it “ignored responsible disclosure” from Bales are “inaccurate.” Publishing exploit code before customers can act “hands attackers a head start,” John Pagliuca, N-able’s CEO, told American Banker in a statement.

Bales did not immediately respond to a request for comment.