A SonicWall cloud bug exposed corporate networks to hackers

guest · Sep 2, 2020

A SonicWall cloud bug exposed corporate networks to hackers
September 2, 2020
https://techcrunch.com/2020/09/02/sonicwall-bug-exposed-networks/

A newly discovered bug in a cloud system used to manage SonicWall firewalls could have allowed hackers to break into thousands of corporate networks.

Vangelis Stykas, a researcher at security firm Pen Test Partners, found the new bug in SonicWall’s Global Management System (GMS), a web app that lets IT departments remotely configure their SonicWall devices across the network.
But the bug, if exploited, meant any existing user with access to SonicWall’s GMS could create a user account with access to any other company’s network without permission.
Click to expand...

In a blog post shared with TechCrunch, Stykas said there were two barriers to entry. Firstly, a would-be attacker would need an existing SonicWall GMS user account. The easiest way — and what Stykas did to independently test the bug — was to buy a SonicWall device.

The second issue was that the would-be attacker would also need to guess a unique seven-digit number associated with another company’s network. But Stykas said that this number appeared to be sequential and could be easily enumerated, one after the other.
Click to expand...

SonicWall confirmed the bug is now fixed. But Stykas criticized the company for taking more than two weeks to patch the vulnerability, which he described as “trivial” to exploit.

“Even car alarm vendors have fixed similar issues inside three days of us reporting,” he wrote.
A SonicWall spokesperson defended the decision to subject the fix to a “full” quality check before it was rolled out, and said it is “not aware” of any exploitation of the vulnerability.
Click to expand...

Pen Test Partners: Cloud firewall management API SNAFU put 500k SonicWall customers at risk

Ken reached out to message the CEO Bill Conner privately on LinkedIn. He replied within two hours, which was impressive given the time difference.
The head of global support was introduced to us and we were then passed to a VP of support who took our report and assured us that it would be raised urgently.

It was a shame that we had to go around the PSIRT team to get the priority raised, but good that it did accelerate the fix.
Click to expand...

In our opinion SonicWall didn’t deal with this well and then knowingly exposed every single one of their cloud-connected customers to remote pwnage for 14 days.
Click to expand...

Log in or Sign up

A SonicWall cloud bug exposed corporate networks to hackers

guest Guest

Log in or Sign up

A SonicWall cloud bug exposed corporate networks to hackers

guest Guest

Useful Searches