Fortinet’s FortiGate firewalls are the target of a large-scale data leak. Data from nearly 74,000 firewalls worldwide has been made public.
Fortinet is dealing with a large-scale data leak affecting its customers. The data of more than 70,000 firewalls has reportedly been exposed by suspected Russian hackers. Fortinet states that the data leak, dubbed ‘FortiBleed’, is not the result of a vulnerability or hack in its own systems.
The U.S. cybersecurity agency CISA has issued an official warning. “Malicious cyber actors are targeting internet-accessible Fortinet devices at government and private organizations, using stolen credentials. This activity involves the exposure of leaked credentials,” the organization writes in a public statement.
FortiBleed
The leaked data was first investigated by security researcher Bob Diachenko, who sounded the alarm via LinkedIn. He discovered a server containing credentials for 21,634 FortiGate devices, including usernames, email addresses, and passwords in plain text. That first batch is just a preview of the scale of the data leak.
Several security experts have launched investigations and are verifying the authenticity of the data. According to security researcher Kevin Beaumont, the majority of the affected firewalls are still online, which would indicate that these are recent credentials that may even still work. This data is normally only available from within the configurations.
74,000 firewalls affected
Security firm Hudson Rock has launched an online tool to map the extent of the leak. Via the ‘FortiBleed tracker’, you can look up whether URLs and domains of firewalls active in your organization have been compromised. The counter currently stands at 73,932 leaked URLs, originating from 21,387 domains and spread across 194 countries. Hudson Rock is already calling it one of the largest firewall leaks ever.
Major names are among the list of affected domains. Spotify, Samsung, Sony, Oracle, Lenovo, Alibaba, Huawei, FedEx, Siemens, and the French parent organization of Orange are reportedly affected. The original discoverer, Diachenko, also mentions a Turkish organization under contract with NATO. The majority of affected companies are located on the American and Asian continents.
No hack
Diachenko points toward an unnamed Russian actor who collects hashed credentials from internet-facing FortiGate devices and cracks them using a GPU cluster. The researcher knows this because the perpetrators unintentionally left some documents behind on the server. If the leaked credentials are indeed still ready for use, hackers could use them to simply log in.
CISA is urging organizations to terminate all active sessions and take firewalls offline. Suspicious activity can be detected through log data to remove unauthorized accounts. Additional advice includes securing passwords with hashing algorithms, resetting VPN and administrative passwords, and enabling MFA where possible.
Fortinet responded via Bleeping Computer that the database was likely compiled during previous incidents and through brute-force attacks. The vendor states with certainty that there is no question of exploited zero-days or a hack of its own systems. Fortinet advises companies to regularly refresh their login details, and preferably as soon as possible if firewalls in your organization are affected. Earlier this week, Fortinet reported three vulnerabilities in its FortiSandbox solution.
This article originally appeared on June 18 and was updated with the latest information.