Wake-Up Call: What the ConnectWise Control Security Vulnerabilities Mean for MSPs

Last week, multiple security flaws were found in ConnectWise Control, a remote control software product in the MSP software community, according to cybersecurity consulting firm Bishop Fox and validated by Huntress Labs. The software was found to contain eight security vulnerabilities that could give hackers the ability to create an “attack chain” that would allow cybercriminals to hijack an MSP’s systems and compromise their customers’ devices.

Individually, the vulnerabilities were not deemed not severe, according to Bishop Fox. Only one, a cross-site request forgery (CSRF) flaw, was flagged as critical. All together, however, the eight issues could have been combined to create an attack chain that, by its very definition, could have snowballed to the point where it compromised a ConnectWise Control server and, from there, any connected clients.

“An attacker that exploits the full attack chain can achieve unauthenticated remote code execution, resulting in compromise of the ConnectWise Control Server and ultimately the endpoint it has been installed on,” said Daniel Wood, the associate vice president of consulting for Bishop Fox. “This would provide full control over the vulnerable endpoint.”

This is undoubtedly the tip of the iceberg for MSPs using remote monitoring and management (RMM) tools. There is no question that hackers are increasingly targeting MSPs, and that they are targeting those who use RMM tools — a scary reality for those woefully behind the curve in terms of having plans in place to fix problems by patching their systems, or by requiring their software vendor to patch their systems if they’re cloud-provided.  

Jason Ingalls, founder and CEO of Ingalls Information Security, says there doesn’t seem to be the necessary sense of urgency with regard to handling security issues among MSPs. Ingalls, who has worked in Fortune 50 company breach response for over a decade and small-to-midsize business breaches (including MSP breaches) for the last five years, stresses the serious nature of these vulnerabilities, and the potential havoc they can wreak on businesses. 

Ingalls Infosec’s Jason Ingalls

“These are very serious problems that must be addressed,” said Ingalls. “We’ve seen breaches that are devastating to the point where they will put organizations out of business. RMM essentially has the potential to hand cybercriminals the keys to the kingdom.”

Ingalls says that this is just the start, and that he expects the industry will see similar vulnerabilities crop up across the RMM marketplace. 

“MSPs need to look at this as a warning and a learning opportunity,” he adds. “Any software can have serious vulnerabilities. MSPs need mechanisms in place to be able to identify intrusions and respond to them, as well as a security process to cover them in the event of loss. This is a chance for MSPs, and vendors, to do the right thing. The ones that don’t are going to wind up costing themselves, and possibly their clients and their business.”

Juan Fernandez, vice president for managed IT services at ImageNet Consulting, echoes Ingalls, saying that MSP’s must take caution in this new era of attacks.

“First and foremost, MSP’s must implement security best practices within their own companies,” says Fernandez. “This includes internal and external security controls, making sure you take nothing for granted and audit controls from every angle, even from places you wouldn’t expect. It is critical that as IT service providers, we make sure we are working diligently to ensure our customers are protected even from ourselves.”

Bishop Fox indicated that it is also looking for potential security flaws in other remote monitoring and management tools for MSPs, meaning that if RMM tools are not architected or configured properly, MSPs can expose themselves and their customers to a “whole bunch of different security concerns.”

Of course, any technology that makes it easier for organizations to share/manage resources inherently carries with it …

… additional risk. Bob Coppedge, owner and CEO of Simplex-IT, says that just like any other aspect of cybersecurity, the need for a constant layered approach to maintain the integrity of these technologies falls first on the provider. But it also falls on the part of the consumer of the technologies (in this case, the MSP), and organizations dedicated to working with MSPs in the cybersecurity world. 

“Cybersecurity is an “infinite game,” in that there will never be a time where a solution, technology, client or offering is 100% secure, said Coppedge.”

This is undoubtedly an important event in the MSP world. The industry has frequently been in the news the last year and a half as a prime target for ransomware, with an increase in both the size and scale of MSPs hit. According to Mike Burgard, chief information security officer for Marco Technologies, this highlights the need for MSPs to take interest in supply-chain, vendor and risk management. 

Marco Technologies’ Mike Burgard

“As an unregulated industry, there are no forced checks on software providers and supply chain — it falls on MSPs to do it,” said Burgard. “This is not a novel concept; other verticals such as banking, energy, and health care have done this for years — we should now be doing it too. You should be asking your core solution providers tough questions, ensuring they are conducting business securely, and developing software securely.”

Burgard points out that one incident, or even several critical vulnerabilities, is not a reason in itself to drop a vendor, but that businesses should know and trust how a vendor responds when a vulnerability is detected.  

“At risk of sounding like [New England Patriots head coach] Bill Belichick, it all comes down to the fundamentals. We need to ensure we are doing block-and-tackle things like restricting systems to geographical areas used (firewall geo blocking), using proper access controls, strong, complex passwords, multifactor authentication, patch and vulnerability management, etc. Those are the fundamentals that are too often missing,” added Burgard.

ConnectWise says six of the vulnerabilities have been resolved; a seventh vulnerability will soon be resolved; and the eighth vulnerability poses no threat to partners and customers.