PWC issues 'cease and desist' to security experts

[JerryMungo]

http://www.zdnet.com/article/pwc-se...esist-letter-instead-of-fixing-security-flaw/

A security research firm has released details of a "critical" flaw in a security tool, despite being threatened with legal action.

Munich-based ESNC published a security advisory last week detailing how a remotely exploitable bug in a security tool, developed by auditing and tax giant PwC, could allow an attacker to gain unauthorized access to an affected SAP system.
US government pushed tech firms to hand over source code

US government pushed tech firms to hand over source code

If source code gets into the wrong hands, the damage would be incalculable.

Read More

The advisory said that an attacker could "manipulate accounting documents and financial results, bypass change management controls, and bypass segregation of duties restrictions," which could result in "fraud, theft or manipulation of sensitive data," as well as the "unauthorized payment transactions and transfer of money."

An attacker could also add a backdoor to the affected server, it read.

The researchers contacted and met with PwC in August to discuss the scope of the flaw. As part of its responsible disclosure policy, the researchers gave PwC three months to fix the flaw before a public advisory would be published.

Three days later, the corporate giant responded with legal threats.

"We believe in responsible disclosure," said Ertunga Arsal, chief executive of ESNC, in an email on Monday.

"We are security company, which is publicly credited by SAP and other companies for discovery of over 100 security vulnerabilities to date," he said.

Arsal said that this was the first time his company had submitted a vulnerability report to PwC, but it was also the first time that his company received a legal threat.

A portion of the cease-and-desist letter, seen by ZDNet, said that PwC demanded the researchers "not release a security advisory or similar information" relating to the buggy software. The legal threat also said that the researchers are not to "make any public statements or statements to users" of the software.

The researchers told PwC that they would publicly disclose their findings once the three-month window expires, which is in line with industry standard disclosure practices.

That was when PwC hit the security firm with a second cease-and-desist letter.

Undeterred, the researchers released a security advisory a little over two weeks later.

In an email, a spokesperson for PwC acknowledged the existence of the vulnerability and confirmed that it had been fixed.

The corporate giant argued that ESNC shouldn't have had access to the software in the first place, as it wasn't a licensed partner.

"ESNC did not receive authorized access or a license to use this software. The software is not publicly available and was only properly accessed by those with licenses, such as PwC clients working with trained PwC staff," said the spokesperson.
More security news

Serious Ubuntu Linux desktop bugs found and fixed
​LinkedIn's Lynda.com suffers database breach
Vodafone builds cybersecurity centre for enterprise customers
Australian data re-identification defendants will need to prove their innocence

The spokesperson also said in separate prepared statement: "The code referenced in this bulletin is not included in the current version of the software which is available to all of our clients."

"The bulletin describes a hypothetical and unlikely scenario -- we are not aware of any situation in which it has materialized," the spokespersons said.

It's far from the first time that a security firm or its researchers have faced the wrath from a company that fights instead of fixes.

Earlier this year, Justin Shafer, a Texas-based dental computer technician, made headlines when the FBI conducted a raid on his home after he found a security flaw.

Only a year earlier, security researcher Mike Davis was on the receiving end of legal threats after discovering a series of vulnerabilities in electronic locks made by Oregon-based Cyberlock.

"We informed PwC about the vulnerability and how it can be used to add a backdoor SAP admin account on the system during a meeting with their experts," said Arsal. "We gave them sufficient time to patch the vulnerability and to inform their customers."

Realizing the severity of the flaw, Arsal said that he "offered [PwC] our help during this process."

Given the hostility that some researchers face, it makes you wonder why some people bother to report vulnerabilities in the first place.

When we asked, Arsal said, simply, "because it is the right thing to do."

 

[ponder]

Standard bastard tactics of corporates.

 

[crackersa]

Standard bastard tactics of corporates.

agree, but something here was telling me they were trying to angle for a business deal.

Realizing the severity of the flaw, Arsal said that he "offered [PwC] our help during this process."

 

[HavocXphere]

Seems to me that the security co is trying to conflate two issues here:

1) The security vulnerability they found
2) Them getting caught using pirated software

 

[sajunky]

If you look for the offender first:

auditing and tax giant PwC, could allow an attacker to gain unauthorized access to an affected SAP system.

Then what their tool can do:

The advisory said that an attacker could "manipulate accounting documents and financial results, bypass change management controls, and bypass segregation of duties restrictions," which could result in "fraud, theft or manipulation of sensitive data," as well as the "unauthorized payment transactions and transfer of money."

It it obvious that tool's vulnerability is in line with PwC main business. A complete tool: manipulate auditing data, then illegaly transfer money, so the money is received as a payment for a job.

It is what PwC is affraid of. When tax authorities smell fraud they can invalidate each-and-every audit made by PwC and procede with manual validation of financial records of PwC customers.

 

[HavocXphere]

Found the actual report:

http://seclists.org/fulldisclosure/2016/Dec/33

When tax authorities smell fraud they can invalidate each-and-every audit

That's not how things work...not even close.

 

[JerryMungo]

If you look for the offender first:

Then what their tool can do:

It it obvious that tool's vulnerability is in line with PwC main business. A complete tool: manipulate auditing data, then illegaly transfer money, so the money is received as a payment for a job.

It is what PwC is affraid of. When tax authorities smell fraud they can invalidate each-and-every audit made by PwC and procede with manual validation of financial records of PwC customers.

 

[sajunky]

Yeh, scaring.

 

[ponder]

agree, but something here was telling me they were trying to angle for a business deal.

Sounds like you are saying they blackmailed PwC, if that was the case it would have been a criminal issue and charges would have been laid. There is nothing wrong with warning someone of a security threat and offering to provide a solution. They gave them 3 months to fix the issue which is more than fair before revealing the vulnerability. PwC was under no obligation to get their help and could have fixed the issue in the allotted time and warned their clients to migrate to a later version of software which is not affected. Instead they chose to try and silence ESNC with legal action.

This is not the first time this has happened, many a big corporate has sued people before for publishing security threats and even pushed for criminal hacking charges against "whistle blowers". It's downright disgusting and in this case even uncle sam is requiring access to the source code.

Sorry but PwC fscked up and deliberately so.