#Teamcity security software#
#Teamcity security code#

And let’s be clear it is not just CI/CD tools, plenty of software is vulnerable to being badly configured and insecure such as Amazon S3 buckets. There is a reasonable amount of knowledge and security awareness needed to set up tools in such a way that they are secure. We sometimes talk about CI/CD systems being sharp knives which if not handled properly can cut the user. Configuration of a system can leave it vulnerable, at the most simplistic level it is like creating the login account to be ‘admin’ with password ‘admin’.

Jetbrains point to misconfiguration as one possibility. Misconfigured or Badly Configured Software For now, the question we need to ask ourselves is how conceivable is it that a CI/CD tool could be implicated in such a hack? It remains to be seen the role TeamCity, a closed source CI/CD tool, plays in this intrusion and if so what the nature of the exploitation was. If TeamCity has somehow been used in this process, it could very well be due to misconfiguration, and not a specific vulnerability.” “It’s important to stress that TeamCity is a complex product that requires proper configuration. JetBrains the company behind TeamCity provided a response to correctly distance themselves from the attack and follow up by commenting on TeamCity’s potential role in the attack: Because TeamCity is so widely deployed, experts said, it is imperative to determine whether its software contains a vulnerability, or if attackers exploited TeamCity customers via stolen passwords or gaps in unpatched, outdated software.” By compromising TeamCity, or exploiting gaps in how customers use the tool, cybersecurity experts say the Russian hackers could have inconspicuously planted back doors in an untold number of JetBrains’ clients.

#Teamcity security code#

“The exact software that investigators are examining is a JetBrains product called TeamCity, which allows developers to test and exchange software code before its release. Yesterday the New York Times ran a story stating that TeamCity, a CI/CD tool from JetBrains, was implicated in the US hacking of 10 federal agencies that in turn affected 250+ organization networks.