NATS insecure according to OC3 Networks

[gonzo]

After many MANY emails and VM's I will post what OC3 Networks discovered back in October after routine audit of 2 of our clients security.

We know this issue exist since mid Aug 2007, secured our customers and blocked the intruder IP’s from any access to our network.

We posted the thread {url]http://www.gfy.com/showthread.php?t=779742[/url] and got some lawsuit treat to sue us that we could have care less… BUT when our customers that we tracked the breach on their servers got treats as well and requested us to NOT come out public with it, we honored their request.

Just as a side info, I think NATS is a great product and it's a shame that after the months they had to fix or come clean with their clients it never happened...


Credit for this below info should go to our SUPER SYSADMIN/Security fanatic Dale that has never posted on this board so I'm doing this for him, He wanted to come out with this long ago!
=====
The issue with this "intruder" does not seem to be an exploit of the nats software itself. *Someone* has access to TMM's clients database with your admin logins and passwords. That’s what the issue is. I'm not posting this to bash TMM. I'm posting this because they have had month to fix this issue and have apparently failed. They didn't even let (some of?) their customers know they implemented this "Admin activity log" and installed it behind their backs.

I've been involved with a high number of NATS clients and have found the following to be true:
*) Changing all admin level account passwords stops the intruder. He still attempts to login, but in vain.
*) As soon as TMM has admin access to NATS the intruder is back. Sometimes the same day.
*) Intruder is using an automation script that dumps the NATS members list. In some cases he is doing this every hour on the hour.
*) If you have web logs, look for hits against "admin_reports.php?report=surfer_stats&member=#### ##". You will see a number of those hits in sequential order.
*) NATS was vulnerable to SQL injection attacks. I haven't investigated whether it still is.

I have some suggestions for people using NATS:
*) Change all your admin level passwords.
*) Do not give TMM an admin account they can use anytime they want. Change the pass when they are done.
*) Restrict access to the admin*.php files by IP. This is inconvenient, but if you can do this it will circumvent any future intrusion. There may be other files you want to do this with. You can do this with apache easily (syntax depends on your version. this is for 2.0):

Order deny,allow
Deny from all
Allow from your.ip.addr.here

*) Keep an eye on the ssh user you have given TMM to fix/maintain your NATS install. Change their password every time they need access and as soon as they are done. I have experience with TMM ssh-ing in and making changes to NATS software without permission.
*) Be thankful of many things I'll not get into.


P.S. Im hearing that there is a backdoor that TMM can use to get into your NATS, but I havent investigated so its speculation. Only reason I even mention this is because NATS is encrypted and you dont know. Im not interested in decrypting NATS just to find out. There are other ways. I hope this isn’t true.

http://www.gfy.com/showthread.php?t=794159

[Toby]

Some pretty serious shit.

I'm glad that I'm not a program owner using NATS right now.

I'm NOT at all pleased that my affiliate account info with NATS programs may have been compromised and I wasn't informed.

Looks like it's time to get out the little black book and update some logins.

[RawAlex]

My fear at this point isn't that an admin password might have been comprised, as much as what hidden damage could be done with such access. This could be anything from putting in a back door to allow for future access to modifying the NATS codebase to allow all sorts of potential issues.

I know John will freak at the suggestion, but with this level of access, a smart hacker would do something to make money with their access, such as substituting affiliate codes or otherwise trying to obtain income from the sites in question. With 400 installs, a good hacker would only need to get 1 signup per day per site (at, say $20) to clear almost 3 million a year through purloined signups.

While I am not suggesting that this is the case, I think that NATS people need consider the larger implications beyond a spam scam. One of the IP addresses tossed into the ring traces back to a well known group in Russia. This may be significantly larger than anyone would like.

[gonzo]

John Albright responds...

This issue has been a real eye opener for me.

First, I would like to address the issue. It appears at this point that a number of the non-unique admin usernames & passwords we maintain for support were compromised. All passwords were had changed were charged to a random string and we have destroyed our list and our mechanism of keeping it which resided on a local server in the office. We are still investigating whether or not someone accessed them from there and if so, how someone may have accessed that server. We have implemented a policy change in that we will no longer maintain any NATS admin accounts. We had made this change a while ago regarding SSH information. We are now doing this with all passwords. You will need to grant us access for any level of support. We have also contacted all clients to inform them of the security features in NATS they can utilize to better prevent any security situation from arising in the future.

Whether you are a NATS client or not you are more than welcome to contact us with any questions about these issues.

Second, I would like to talk about our previous handling of the issue. Our security and the security of our clients is of extreme importance to us. We had become aware over the past few months that a few clients were being accessed wrongly using the account we maintain. We believed we had a way of knowing which clients were affected and we contacted them immediately. Apparently we were wrong. I apologize for this. As perfect as I wish we can be we are going to make mistakes from time to time. If we had known that the issue was more widespread we would have without question contacted everyone. We did not believe at the time it was a widespread issue. Again, this was a mistake on our part and I apologize to everyone for it. I was not trying to put blame on our clients for this and I'm sorry if I was taken that way. I was simply trying to point out the various possibilities as to what may have been going on while we were investigating it. This is not our clients fault in any way.

Many people here have brought forth a lot of information and helped greatly with this issue. I am very grateful for that. However, I am sad to see so many people enjoying the problems we and our clients are having because they have some personal agenda. We never have a problem with anyone any stating issues we may have. I appreciate those who brought the issue up and contributed to what we hope is the resolution of it. However, there have been numerous misstatements and false accusations flying around. I assure you there is no backdoor in NATS which we use to access your system and I assure you Fred is not stealing your emails and spamming your members. These are just two of the many untrue things that we have been accused of over the past 72 hours. Due to all of this I will not be continuing a discussion of the issue here. I feel I have addressed what the issue is and I apologize again for our being wrong about it originally. I wish we hadn't been both for our sake and yours.

Again, anyone is free to contact me to discuss this directly

[TheEnforcer]

Hopefully they have the matter under control.

[Toby]

The fact that TMM's internal database of admin passes was even web accessible is shocking. Major fuck-up, on several levels.