Carbon Black Denies Its IT Security Guard System Leaks Customer Info

R

rgMekanic

[H]ard|News
Joined
May 13, 2013
Messages
6,943
Carbon Black's Cb Defense Software may be sending your companies private information to third parties. In a blog post today, DirectDefense, a security consultancy claims Carbon Black's Cb Response protection software would, once installed for a customer, spew sensitive data to third parties. This included customers' AWS, Azure and Google Compute private keys, internal usernames and passwords, proprietary internal applications, and two-factor authentication secrets.

Carbon Black has since replies in a blog post of their own claiming DirectDefence has it's facts wrong. Them sending private dats to third parties isn't a bug - it's a feature. Michael Viscuso, cofounder of Carbon Black stated "This is an optional feature, turned off by default, to allow customers to share information with external sources for additional ability to detect threats."

So very sensitive data from passwords to cloud keys being transmitted offsite to a 3rd part where it can be intercepted is a "feature." That is an interesting defense to say the least.

When a new file appears on a protected endpoint, a cryptographic hash is calculated. This hash is then used to look the file up in Carbon Black’s cloud. If Carbon Black has a score for this file, it gives the existing score, but if no entry exists, it requests an upload of the file. Since Carbon Black doesn’t know if this previously unseen file is good or bad, it then sends the file to a secondary cloud-based multiscanner for scoring. This means that all new files are uploaded to Carbon Black at least once.
 
airbags that deploy while driving isn't a danger it's in case you want a nap.

see that's how stupid they sound.
 
That feature kind of defeats the point of defense software in the first place.
 
They do have a point, that it defaults to off and people are warned, so I don't see the problem. Enable it if you don't care.
 
yea... not saying it's a great feature, and maybe it should come with two keys you turn simultaneously, but breaking into encryption is a market these days. SSL break/inspect, SSH break/inspect, SFTP break/inspect, even SSL optimization all require you give your devices your private keys or allow them effectively be voluntarily man in the middle attacked.

BUT, that said... a 3rd damn party? thats where they crossed the line. if it was shipping it back to them, then ok maaaaybe. but a 3rd party that you have no legal contracts with? i guess you can call that a feature. i guess i can also call my ex wife dry raping my finances a "relationship feature" from now, too.
 
You must log in or register to reply here.
Back
Top