N-able switched off its hosted IT management service after a researcher posted attack code for more than 30 alleged flaws. Businesses that rely on IT providers should pay attention.
N-able, a software company whose tools let IT firms manage other businesses' computers, has taken its hosted N-central service offline. A researcher posted working attack code for more than 30 alleged security flaws. N-able also told customers who run N-central on their own servers to shut them down until further notice.
Security researcher Sean Bales published the details late Sunday, November 8, in a GitHub repository called Able2Shell. It holds proof-of-concept exploits, which are working demonstrations of how to break in. On November 9, N-able took its hosted N-central offline across the Americas, Europe and Asia-Pacific. Bales told BleepingComputer that AI helped him find the flaws.
N-central is a remote monitoring and management tool. IT providers use it to watch and control their customers' devices and networks from afar. Whoever takes over that tool could reach many machines at once.
The most serious exploit needs no login. It steals a trusted session, resets an account password and runs commands on the server. It can also create an administrator account with credentials the attacker chooses. The researcher tested a pre-release version, but he believes most, if not all, of the flaws affect earlier versions too.
These are called zero-days, meaning flaws the vendor had no chance to fix before they became public. BleepingComputer has not verified every claim. N-able is building a hotfix, which suggests at least some of the flaws are real.
N-able says it has seen no active exploitation and no unauthorized data access. Its Ecoverse services, reached through N-able Login, are still running. If neither you nor your IT provider uses N-central, this story does not touch you directly.
Bales says he skipped warning N-able because he reported two unrelated remote code execution flaws and a privilege-escalation flaw in a different N-able product five or six months ago. He says they are still unpatched, that follow-up emails went unanswered and that he was not paid through the bug bounty. N-able did not answer questions about those claims. It called the release non-responsible communication.
N-able's CEO and CTO contacted Bales and asked him to remove the repository and work with the company. He said they did not threaten him.
N-able has given no timeline for bringing N-central back. It plans status updates every four hours, or sooner if there is news. The steps in the alert box above cover what to do in the meantime. Expect some disruption if your IT provider depends on this tool.
If an IT provider manages your devices, ask whether they use N-central and how they are protecting you while the service is down.
Deputies in the Upstate area say scammers are calling while posing as police officers, and a scary call can cost you money or personal details.
Read more: Sheriff's deputies warn of scam calls from fake police officersA breach at SEGA's email provider exposed 2.2 million newsletter addresses. The bigger risk is fake credit card emails, so it pays to know what to watch for.
Read more: SEGA says 2.2 million newsletter email addresses were exposedA hacker stole data from forms on 14 York University websites, going back to 2007. Contact details and student ID numbers could fuel convincing scam messages.
Read more: York University says hackers stole data from website forms back to 2007
