From TechCrunch · Zack Whittaker · · 1m 20s
N-able takes remote access service offline after zero-day bugs published
Remote access company N-able shut down its cloud service after a researcher publicly disclosed dozens of security vulnerabilities without warning the company first.
In brief
Remote access company N-able shut down its cloud service after a researcher publicly disclosed dozens of security vulnerabilities without warning the company first. N-able took its N-Central remote access service offline after researcher Ben Bales published dozens of zero-day bugs on GitHub without advance notice…
Researcher publishes dozens of zero-day bugs
Security researcher Ben Bales released zero-day bugs on GitHub on Sunday, dubbed Able2Shell. The vulnerabilities can steal credentials, create administrative accounts, and gain root access to N-able systems.
“Able2Shell”
N-able takes N-Central service offline
N-able confirmed it took down its cloud-hosted N-Central offering to fix security vulnerabilities published online this week. The company gave customers no advance notice to patch the flaws before disclosure.
Company urges customers to take action
N-able urged customers to take down their own self-hosted N-Central deployments, fearing attackers could use the publicly disclosed exploits to hack into customer networks. Customers cannot use the service during remediation.
No evidence of successful attacks yet
N-able said it has no evidence of successful exploitation against any customer environments. A company spokesperson did not respond to questions about whether it can check server logs or verify this claim.
The short version
N-able took its N-Central remote access service offline after researcher Ben Bales published dozens of zero-day bugs on GitHub without advance notice, forcing the company to secure its systems.
