FortiBleed: the FBI says attackers are locking firms out of their own Fortinet firewalls

The FBI and the US Secret Service published a joint advisory on 6 October about FortiBleed, which they describe as "an active, global credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways". Citing the threat intelligence firm SOCRadar, the advisory says more than 86,644 devices have been compromised across 194 countries. Infosecurity Magazine reports that the campaign first came to light in June, when a security researcher found a trove of Fortinet usernames and plaintext passwords.

How the attack works

The advisory says the attackers scan the internet for exposed FortiGate SSL VPN portals, then try usernames and passwords from earlier Fortinet leaks and from infostealer logs, the data harvested by malware on infected computers. Password hashes taken from compromised devices are cracked offline on a cluster of graphics cards, helped by what the advisory calls legacy SHA-256 password storage. Targets are sorted by revenue and network structure, new administrator accounts are created on the firewall to keep a foothold, and the attackers then move into the network behind it, looking for privileged accounts. The advisory says the operation ends with access being packaged and sold to other criminals.

Why the lockouts matter

Based on initial responses, the advisory says, some victims may be locked out of their Fortinet devices if the attackers delete or change the passwords of the original accounts, which would require "remediation steps beyond standard patching and password resets". It also says FortiBleed has been an entry point for ransomware affiliates. The Register reports that the current evidence points to affiliates of the INC/Lynx and Payload ransomware groups using the credentials, and that SOCRadar said in July it had seen at least 12 confirmed ransomware attacks stemming from FortiBleed. John Strand, owner of Black Hills Information Security, said in comments reported by Infosecurity Magazine that the quiet persistence worries him most: "I'm terrified of the attacker who wants to quietly live inside that organization for as long as possible."

What the advisory says to do

The advisory comes from US agencies, but the campaign it describes is global and its key actions apply to any FortiGate owner. Lock down management access, by restricting it to trusted hosts (which it calls good), using a local-in policy (better) or removing internet administration altogether (best). Terminate all active admin and VPN sessions, and reset all Fortinet VPN and administrative passwords, especially on internet facing systems. Require phishing resistant multi-factor authentication on all remote access and administrative accounts. For organisations that find signs of compromise, Infosecurity Magazine lists further steps from the advisory, including reviewing firewall and VPN users and configuration for unauthorised changes, and reviewing firewall, VPN, authentication and domain controller logs for signs of an attacker moving around the network.