Fortinet VPN with default certificate exposes 200,000 businesses to hack

guest · Sep 26, 2020

Fortinet VPN with default certificate exposes 200,000 businesses to hack
September 25, 2020
https://securityaffairs.co/wordpress/108737/hacking/fortigate-vpn-attacks.html

The configuration of the VPN solutions is important to keep organizations secure and to avoid dangerous surprises.

According to network security platform provider SAM Seamless Network, over 200,000 businesses that have deployed the Fortigate VPN solution with default settings. This choice could allow an attacker to present a valid SSL certificate and carry out man-in-the-middle (MitM) attacks on employees’ connections.

“Surprisingly (or not?), we quickly found that under default configuration the SSL VPN is not as protected as it should be, and is vulnerable to MITM attacks quite easily.” reads the analysis published by SAM Seamless Network.
Experts pointed out that the Fortigate SSL-VPN client only verifies that the CA was issued by Fortigate or by another trusted CA, this allows an attacker to present a certificate issued to a different Fortigate router to carry out a man-in-the-middle attack.
Click to expand...

SAM Seamless Network: 200K Businesses are Exposed to WFH Attack Scenario

Fortinet’s Response
We reached out to Fortinet to portray this issue (and offered an easy solution), they responded that they are well aware of it, but are not going to change it. They claim that since the user has the ability to manually replace the certificate, it is the user’s responsibility to make sure the connection is protected.

Although Fortinet’s claim may be reasonable for the enterprise space, smaller businesses (for example a small law firm) may not have the knowledge or time to configure it.
Click to expand...

stapp · Nov 23, 2020

A hacker has posted a list of one-line exploits to steal VPN credentials from almost 50,000 Fortinet VPN devices.

Present on the list of vulnerable targets are domains belonging to high street banks and government organizations from around the world.
Click to expand...

https://www.bleepingcomputer.com/ne...its-for-over-49-000-vulnerable-fortinet-vpns/

Log in or Sign up

Fortinet VPN with default certificate exposes 200,000 businesses to hack

guest Guest

stapp Global Moderator

Log in or Sign up

Fortinet VPN with default certificate exposes 200,000 businesses to hack

guest Guest

stapp Global Moderator

Useful Searches