Warning to FortiGate admins: You need to run a compromise assessment now – Source: www.csoonline.com

Network administrators with Fortinet’s FortiGate next generation firewall in their IT environments are being warned to thoroughly scrutinize systems for possible compromise, following last week’s dump of stolen configuration and VPN credentials by a threat actor.

“Patching is not enough,” tweeted cybersecurity researcher Florian Roth on Thursday. “If you take security seriously, you must run a compromise assessment to check whether the device and other systems in your network have already been breached.”

“Treat this like the security incident it is,” he added.

The warning comes after Roth did an analysis of stolen FortiGate device configuration data released earlier this month by a threat actor calling itself the Belsen Group. That data, claimed to be config settings for 15,000 firewalls, would be of great value to hackers.

After the gang posted the data, it was initially examined by researcher Kevin Beaumont, who found it included IP addresses, plaintext device passwords, and some email addresses of users or their organizations. Among other questions this data dump raises is why admins allowed plaintext passwords to be stored in a config file.

Roth grouped the email addresses by top level domain to help CISOs and their equivalents to see if their organizations are impacted. However, he cautioned that some of the domains may just be those of free email services or service providers working for the actual victims.

Beaumont said the data was stolen by a threat actor exploiting CVE-2022-40684, a zero day authentication bypass using an alternate path in FortiOS. It could allow an unauthenticated attacker to perform operations through an administrator interface through specially crafted HTTP or HTTPS requests.

According to Beaumont, last week’s dump of data included usernames, passwords — some in plaintext — device management digital certificates, and all firewall rules.

For its part, after the Belsen Group posted the stolen data last week, Fortinet said the exposed data was captured from a 2022 vulnerability and aggregated to look like a new disclosure. “Our analysis of the devices in question show that the majority have long since upgraded to newer versions,” the company said.

The list does not include any configurations for FortiOS 7.6 or 7.4 (the most recent versions of Fortinet’s operating system), it noted, “nor any recent configurations for 7.2 and 7.0.” 

“If your organization has consistently adhered to routine best practices in regularly refreshing security credentials and taken the recommended actions in the preceding years, the risk of the organization’s current config or credential details being in the threat actor’s disclosure is small,” Fortinet said. “We continue to strongly recommend that organizations take the recommended actions, if they have not already, to improve their security posture.

“We can also confirm that devices purchased since December 2022 or devices which have only run FortiOS 7.2.2 or above are not impacted by the information disclosed by this threat actor.”

But, the manufacturer added, “If you were running an impacted version (7.0.6 and lower or 7.2.1 and lower) prior to November 2022 and did not already take the actions recommended in the [October 2022] advisory, we strongly recommend reviewing the recommended actions to improve your security posture.”

Researchers at Censys think just over 5,000 of the 15,000 compromised FortiGate devices are still exposing their web login interfaces.

“Even if you patched back in 2022,” Beaumont wrote, “you may still have been exploited as the configs were dumped years ago and only just released — you probably want to find out when you patched this vuln. Having a full device config including all firewall rules is… a lot of information.”

While the data was apparently collected just over two years ago, it is unknown why it’s being released now. In a post last week analyzing the dump, researchers at Censys noted that the Belsen Group is new. It’s possible that this threat actor recently bought or assembled the data now for sale from the original hacker(s).

Censys also believes that, while action may have been taken by FortiGate admins two years ago, after the vulnerability was discovered, “it is still relevant and capable of causing damage. Firewall configuration rules in particular tend to remain unchanged unless a specific security incident prompts an update. It’s also fully possible, of course, that some of these firewalls have changed ownership in the interim, but such cases are also uncommon.”

The publication of this data means that threat actors have more material to work with for social engineering and account takeover, Randy Pargman, senior director of threat detection at Proofpoint, told CSO. “They can take the leaked passwords and, even assuming all have been changed, use the fact that people often use variations of the same password to guess probable passwords. Threat actors can also target email lures to people whose email addresses appear in the leak, using FortiGate themed lures leading to malware or phishing pages.”