Kevin Beaumont
An ecrime group has somehow gained access to 75k Fortinet firewall devices - dubbed Fortibleed
Check if your domain is impacted: https://www.hudsonrock.com/fortinet
I’ve verified the data is real. They’ve been dumping the Fortinet config - not sure how yet - and then cracking the passwords it appears. Data is being resold online. #fortibleed
Kevin Beaumont
Data looks like this, appears they validated creds too.
Greem (Graeme. Not Graham!)
@GossiTheDog Squarely in "YIKES" territory, this one.
Kevin Beaumont
It’s similar to the Belsen Group thing, although that was a smaller collection of devices - prior thread
Kevin Beaumont
So there are definitely devices which weren't in the Belsen Group post back last year, in fact almost all of them weren't.
On how they got the passwords - until about a year ago, FortiOS (Fortinet firewall OS) stored admin passwords SHA-256 salted, which can be bruteforced.
In an update about a year ago, if installed and admins log in, passwords are stored much more securely - but most orgs won't be that condition yet.
Kevin Beaumont
Wrote a blog about the #FortiBleed situation https://doublepulsar.com/fortibleed-75k-fortinet-firewalls-have-admin-passwords-cracked-60299faa65f8?postPublishedType=initial
Kevin Beaumont
Lol, the #FortiBleed data was found in an opendir on a webserver 🤣 truly GenAI is going to take over 😜
"They accidentally left an open directory with artefacts, connection strings, tooling, scripts and data online. Analytics obtained via their cron jobs, bash histories, logs etc,"
Kevin Beaumont
#GAYINT list of impacted #FortiBleed domains (this is basically email addresses of admin accounts on the device btw) https://blog.gayint.org/intel/fortibleed.txt
Kevin Beaumont
#GAYINT list of impacted #FortiBleed IPs. Not all as I couldn't write the parser properly. http://owned.lab6.com/~gossi/research/public/fortibleed/some-fortibleed-ips.txt
Kevin Beaumont
Fortinet appear to be telling press the #Fortibleed breach is made up of prior breaches and brute forcing.. but I’ve seen the breach data and it includes many passwords not in prior dumps, and I’ve worked with impacted orgs and they report no brute forcing of impacted accounts.
I think there may be some confusion about this one - the brute forcing is the cracking of the passwords by the threat actor, which is done locally.
Watch this space on this one anyhoo.
Kevin Beaumont
NCSC UK advice on Fortibleed: https://www.ncsc.gov.uk/news/advice-following-global-targeting-of-fortinet-firewalls-and-vpn-gateways
Kevin Beaumont
To be transparent about this, a threat actor has been claiming they have an exploit to get FortiOS device password hashes remotely from config for the past month. It’s currently unclear how. They claim it’s an exploit of an unpatched vuln. Their claims predate the discovery of this dump.
If I end up having to set up another FortiGate firewall honeypot to figure out what’s going on.. I’ll British tut and get on with it.
Kevin Beaumont
Some kind #FortiBleed victims got me to look at their situations. Some IOCs performing remote config dumps:
193.8.186.7
80.75.212.113
213.21.239.65
Look for inbound TCP traffic to Fortigate devices. If seen log into the devices and look for config dump events from those IPs.
Config dumps (including crackable password hashes) have been going on for around a month.
If you have IPsec site to site VPN tunnels on the impacted Fortinets you need to rebuild the tunnels with new keys both ends.
Kevin Beaumont
Canadian Centre for Cyber Security on #FortiBleed
V4N4D1S
@GossiTheDog Did some IR on a box in the leak.
Multiple IPs from 193.8.186.0/24. 213.21.239.65 found as well. No sign of 80.75.212.113.
Kevin Beaumont
CloudSEK look at the open directory that had all the #FortiBleed tooling and data in it. It's a good report, although I disagree with their conclusion - it's still an absolutely truck load of creds, even if that particular opendir only had internal network details for a few thousand orgs. https://www.cloudsek.com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-attacker-left-behind
Kevin Beaumont
Fortinet have put out a blog about FortiBleed finally - where they don’t mention configuration exports (which is definitely happening at scale, I have receipts) or password hash cracking (we have the bash history of the user doing it).. but instead link Fortibleed to a prior marketing blog called “Attacks at the speed of AI” 🤦♀️
kjpax
@GossiTheDog Maybe they are meaning using the AI infrastructure to crack passwords at scale. Is that the speed of AI 😂
System Adminihater
@GossiTheDog someone needs to stop these people and F5
Kevin Beaumont
There's some more analysis of the #FortiBleed attack infrastructure here:
https://zenox.ai/en/fortibleed-anatomy-of-the-fortibleed-campaign-based-on-the-server-that-the-attackers-themselves-left-exposed/
It's not mentioned but they cracked around 170k AD account passwords. Also all the comments on the custom source is written in Russian.
Also, there is a GenAI angle I missed - they used an open source pentesting AI agent framework to try to automate attacks. It doesn't look like that bit worked very well.
Kevin Beaumont
SOC Radar have a good write up for #FortiBleed too
https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/
And a free checker - includes downstream credential checker (e.g. cracked AD passwords etc) https://socradar.io/free-tools/fortibleed
Kevin Beaumont
The FBI and US secret service have discovered #FortiBleed
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.