Kiteworks tells every customer to switch off over a zero-day warning

Kiteworks, the secure file-transfer vendor, told every customer on 25 September to shut down self-managed systems for nine hours over the weekend, in a precautionary shutdown advisory prompted by what it called credible threat intelligence from federal intelligence authorities that a threat actor might target some of its systems. It switched off the systems it hosts for customers itself.

The instruction covered on-premises, Amazon Web Services and Microsoft Azure deployments. Kiteworks-hosted customers had nothing to do. Frank Balonis, chief information security officer, said the company had no indication that its systems or its customers’ systems were compromised, and that release 9.5.1 accounts for all known vulnerabilities.

TechCrunch reported on 25 September that Kiteworks’s email to customers warned of potential zero-day attacks, that security researcher Kevin Beaumont pointed to a Shodan listing of at least 1,000 internet-facing Kiteworks systems, likely an overcount, and that one healthcare customer took its server down as soon as the alert arrived.

What the shutdown found

Kiteworks lifted the recommendation on 27 September. In a second statement on 28 September it said the threat window had passed without incident, and that during the shutdown its engineers found a previously unknown critical vulnerability in a capability enabled for less than 1% of its customer base. A fix was built and deployed inside the window, and the company says it has no indication the flaw was ever exploited. SecurityWeek reported, citing a customer email shared online, that the capability is Advanced Forms.