JetBrains denies involvement in SolarWinds hack

By

Chief executive speculates misconfigured TeamCity could have been exploited.

Developer tools maker JetBrains has refuted a story in The New York Times that suggested a vulnerability in its TeamCity software was recently exploited by hackers to deploy backdoors into SolarWinds' software and other applications.

JetBrains denies involvement in SolarWinds hack

TeamCity is a continuous integration and deployment system for code, and JetBrains counts network monitoring company SolarWinds as a customer of the product, along with 79 Fortune 100 enterprises, and 300,000 developers around the world.

In Australia, TeamCity is used by the likes of Nine Entertainment, Woodside Energy and Bankwest, among others.

JetBrains chief executive and co-founder Maxim Shafirov denied his company is under investigation by United States authorities and that it played any role in the SolarWinds breach.

However, Shafirov added that the TeamCity is a complex product that requires proper configuration.

"If TeamCity has somehow been used in this process, it could very well be due to misconfiguration, and not a specific vulnerability," Shafirov said.

The development tool company is based in the Czech Republic and was set up by three Russian engineers. 

Noted security researcher The Grugq did not discount the possibility that CI/CD systems might be targeted by hackers as a vector for injecting malicious code.

The SolarWinds supply chain hack may have affected close to 18,000 customers, but government and security expertes disagree on how many were eventually compromised, with Amazon Web Services' researchers estimating some 250 organisations were hacked.

Russian state actors are believed to be behind the hack, which compromised the US Treasury and other government agencies for nine months or more.

Microsoft, Cisco and security vendor FireEye were also compromised in the SolarWinds attack.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © iTnews.com.au . All rights reserved.
Tags:

Most Read Articles

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

The Northern Beaches Women's Shelter hones focus on tech-enabled abuse

Log In

  |  Forgot your password?