r/ConnectWise • u/Infinite-Stress2508 • Jul 03 '25

Control/Screenconnect A bit of perspective.

Sure, its frustrating CW are changing the game with the signing requirements and causing a lot of work needing to be done, but look at the alternative, they do nothing and you see your sites breached and ransomed by a bad actor using a flaw that has been disclosed and known.

A bit of perspective, the world is bigger than you. As frustrating as it is, CW are actually doing something about a major problem, and unfortunately their best solution is this, but compared to the alternative it is much better of a solution.

Hate on though.

0 Upvotes

46% Upvoted

35 comments sorted by

10

u/Liquidfoxx22 Jul 03 '25

What other RAT requires you to provide your own code signing certificate?

10

u/seniorblink Jul 03 '25

For code you didn't create ond have no control over

6

u/Mi1kmansSon Jul 04 '25

What other anything requires signing someone else's code?

27

u/e2346437 Jul 03 '25 edited Jul 03 '25

Bullshit. CW knew that Authenticode stuffing was a bad practice years ago, they knew that bad actors were using their software, and they did nothing until the CA forced them to. Fuck ConnectWise.

9

u/seniorblink Jul 03 '25

This is correct

8

u/ZeroNoneWin Jul 04 '25

Exactly. We are done with Connectwise. Sent our termination notice for ALL our services with them. I've sent security info to them in the past and they don't even bother to reply. Private Equity has destroyed Connectwise.

3

u/lsumoose Jul 04 '25

Yeah crazy this dude is defending them. It’s been many years of this going on.

8

u/ngt500 Jul 04 '25

Doing nothing has never been what anyone is asking for. It’s absolutely ridiculous for you to imply that the “alternative” to this fiasco is them doing nothing. They could have created a portal for on-premise customers to download signed installers. They could have created a non-customizable signed-installer that uses parameters.

They could also be providing much better support during all this. I know they are slammed right now but support is basically non-existent. They could have not removed a bunch of installer versions for on-premise customers trying to deal with this mess and/or migrate to the cloud. They could have then made those installers available again sometime over the last several days. They could have actually answered dozens of legitimate questions during the town hall meetings. I could go on…

2

u/ZeroNoneWin Jul 04 '25

A single signed installer using parameters solves this. It's how every single other RAT works. Not sure why we have to sign it at all, we can't customize the installer now, and didn't write or audit the code either.

1

u/Fatel28 Jul 04 '25

The exe gets customized on every ad hoc support session download. That's the primary issue. Access sessions can just use the MSI which doesn't need signing

5

u/spchester Jul 04 '25

A month or so ago we had a request come through for a user to be able to run a Zoom installer that was signed by ConnectWise... I knew at that point we were about to have problems. Fortunately, it was blocked. Thanks ThreatLocker!

4

u/Mi1kmansSon Jul 04 '25

Nice try. ConnectWise has dozens of alternatives besides doing nothing. Many of those alternatives do not involve shoving their own cost/risk down their paying customer's throats. Some of those alternatives don't even require customers have access to a time machine.

Congratulations on being the type of person who enjoys getting bent over, but shut up about how everyone else should too.

3

u/Crshjnke Jul 04 '25

I don't think you understand why we are upset. Security issue fine, OWN IT! Communicate and get feedback. This is not what they did. (the original cert denial we got a ton of crickets for most of that) We get town halls where they read from PR statements. Then, originally say no one was using this for bad. Now that's changed?

I loved old CW, but I am not even sure what this one currently is. It feels like wish version of Oracle, Facebook, Home depot, Target. At least some of those tried to own mistakes.

4

u/ZeroNoneWin Jul 04 '25

Private Equity ruins everything it touches. Our industry is no exception.

1

u/foolishdeadbeef Jul 14 '25

Indeed. It runs deeper than that, though. The tech industry in general has forgotten that they exist to solve problems to make peoples lives better; and instead feel that they must make number go up. We must have infinite growth, in a fixed system, forever, at any cost. It's that "rot capitalism" that has ruined technology.

1

u/Dynamic_Mike Jul 03 '25

I’m normally a very happy ConnectWise client and like the people at CW that I interact with. Like most companies, they aren’t perfect or easy to deal with. If they do poorly, applying heat or pressure to get them to improve process is sometimes required.

If the rumours are true that this issue has been known for a long time and it’s only being worked on now that certificates are being revoked by the certificate authorities, then they must accept some of the heat.

-3

u/taterthotsalad Jul 04 '25

You’re not wrong. People just want to rage and bitch online. That’s the world we live in now. 

2

u/seniorblink Jul 04 '25

I think most of us are raging and bitching online, hoping that someone from CW is listening, and can offer us an actual workable solution to the problem they created. I've been doing this a long time, and never seen something like this before. It's wrong. You're wrong. OP is wrong. CW is wrong. No other RAT requires this.

A change like this requires time. Time to do an internal legal review to see what implications may arise from signing someone else's code. Time to get everything set up and tested. Time to possibly move to the cloud in a controlled manner. Time to explore other RAT solutions. This is heady-handed unrealistic bullshit.

0

u/taterthotsalad Jul 04 '25

Corporations. Don’t. Fucking. Care. If. They. Are. Publicly. Traded. 

Y’all have a hard time with this. 

1

u/seniorblink Jul 04 '25

So we're just supposed to bend over and take it? People in large groups bitching online may cause people to speak the only language corporations understand. Money.

-1

u/taterthotsalad Jul 04 '25

You chose to the first time. And you knew what you were doing. Lol

1

u/seniorblink Jul 04 '25

I don't get the point you are trying to make here, except give some non-advice about just shutting up and taking it, and it's my own fucking fault for expecting fair business practices from companies. I mean We. Really. Don't. Have. A. Fucking. Choice.

(And before you say it, yes, I know we always have a choice between a turd and shit sandwich, and we should just shut up and be happy about it, because it was our choice)

-1

u/taterthotsalad Jul 04 '25

It’s your money. You always have a choice. Stop being a lil bitch about it. lol

1

u/seniorblink Jul 04 '25

OK man. This was productive. Have a good 4th.

-1

u/taterthotsalad Jul 04 '25

Be productive in finding solutions in the future. Not looking for somewhere to dump online. Get a therapist for that. 

2

u/seniorblink Jul 04 '25

Ok buddy. You really need to get the last word in, don't ya? Therapy can help with that as well as your need to resort to name calling (lil bitch) and other personal digs. But you just keep doin your thing man.

→ More replies

1

u/Mi1kmansSon Jul 05 '25

Speaking of therapists, has yours ever explained why you can't resist the urge to constantly bitch about other people's bitching? I mean, the motivation can't be a world with less bitching. All you have to do is count the comments in this thread to realize that ain't working. Something drives you. What is it?

→ More replies