JetBrains denies involvement in SolarWinds hack

Developer tools maker JetBrains has refuted a story in The New York Times that suggested a vulnerability in its TeamCity software was recently exploited by hackers to deploy backdoors into SolarWinds' software and other applications.

TeamCity is a continuous integration and deployment system for code, and JetBrains counts network monitoring company SolarWinds as a customer of the product, along with 79 Fortune 100 enterprises, and 300,000 developers around the world.

In Australia, TeamCity is used by the likes of Nine Entertainment, Woodside Energy and Bankwest, among others.

JetBrains chief executive and co-founder Maxim Shafirov denied his company is under investigation by United States authorities and that it played any role in the SolarWinds breach.

However, Shafirov added that the TeamCity is a complex product that requires proper configuration.

"If TeamCity has somehow been used in this process, it could very well be due to misconfiguration, and not a specific vulnerability," Shafirov said.

The development tool company is based in the Czech Republic and was set up by three Russian engineers. 

Noted security researcher The Grugq did not discount the possibility that CI/CD systems might be targeted by hackers as a vector for injecting malicious code.

How many people audit their CI pipelines to ensure they aren’t compromised? Once they’re working, they get left alone... but it’s the perfect place to insert a supply chain backdoor.

— thaddeus e. grugq (@thegrugq) January 6, 2021

The SolarWinds supply chain hack may have affected close to 18,000 customers, but government and security expertes disagree on how many were eventually compromised, with Amazon Web Services' researchers estimating some 250 organisations were hacked.

Russian state actors are believed to be behind the hack, which compromised the US Treasury and other government agencies for nine months or more.

Microsoft, Cisco and security vendor FireEye were also compromised in the SolarWinds attack.