Maximize your protection, eliminate business risks.
Optimize and modernize with cloud transformation.
Empower your people to work securely from anywhere.
What it takes to convince leadership that migrating to the cloud is the right move.
Let us handle IT so you can focus on growing your business.
Get multichannel 24/7/365 expert end-user support.
Stay ahead of attacks with 24/7 protection and monitoring.
Maximize uptime with with industry-leading DRaaS.
Improve efficiency, productivity and outcomes with cloud.
Ensure all mobile devices, everywhere, are secure.
Gain a competitive edge with strategic IT solutions.
This battle-tested checklist enables your team to swiftly initiate a ransomware response.
IT for businesses of all sizes, in any industry.
Empower institution growth with custom IT solutions.
Ensure your firm is always in compliance.
Improve patient care and staff morale.
Deal with pressing legal matters, not IT.
Keep up with the evolving digital landscape.
Focus on your mission by outsourcing IT.
Accelerate PE client deals and secure data.
Leverage your technology as a strategic asset.
Execute initiatives and develop IT strategies.
Get the latest industry insights and trends.
Join us at events in person and online.
Hear from clients and learn more about strategic IT.
See how Dataprise can make IT your greatest asset.
Get informative technical resources from IT experts.
Stay on stop of emerging cybersecurity threats.
Discover the key areas of DR your organization needs to address to ensure downtime is minimized.
Gain a strategic asset by bringing harmony to IT.
Ensure 24/7 support and security with dedicated teams.
Drive business forward by partnering with Dataprise.
Meet our one-of-a-kind leadership team.
Discover the recognition Dataprise has earned.
Help us help businesses with strategic IT.
Embracing different perspectives and backgrounds.
Find a Dataprise location near you.
Dataprise is committed to empowering more women to consider a career in technology.
Defense Digests
Table of content
Dataprise Defense Digest
ID: D3-2023-0005-1
Severity: 6.7 (Medium)
Published: March, 14th 2023
Government entities and large organizations have recently been targeted by an unknown threat actor exploiting a zero-day flaw in the Fortinet FortiOS software, resulting in data loss as well as the operating system and file corruption. Fortinet researchers confirmed that the exploit is highly targeted at government or government-related targets, and suggests an advanced threat actor. This vulnerability is a path traversal bug, being tracked as CVE-2022-41328, that could lead to arbitrary code execution in Fortinet FortiOS software.
Fortinet has confirmed that the patches for the most recent CVE-2023-25610 FortiOS Buffer Underflow vulnerability also patch this path traversal bug. If you have already patched the previous vulnerability then you are no longer vulnerable to this exploit.
Dataprise is aware of the critical nature of this vulnerability and has completed a review of all available analyses of these vulnerabilities and the potential impact on our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions. If your organization’s Fortinet appliance is covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on our mitigation efforts.
The impact of the attack is significant, leading to data loss and operating system and file corruption on Fortigate firewalls. The threat actors have modified the firmware image to include malware, which grants them persistent access and control, enabling them to exfiltrate data and disable firmware verification at startup. The exploit is highly targeted at government or government-related targets, suggesting that sensitive data may have been compromised. The vulnerability impacts FortiOS versions 6.0, 6.2, 6.4.0 through 6.4.11, 7.0.0 through 7.0.9, and 7.2.0 through 7.2.3.
The vulnerability in question is a medium security path traversal bug, CVE-2022-41328, that could lead to arbitrary code execution in Fortinet FortiOS software. Further analysis of the incident revealed that the attackers modified the firmware image of multiple FortiGate devices belonging to an unnamed customer. The modifications contained malware which provided the attackers with persistent access and control. This allowed them to exfiltrate data and disable firmware verification at startup.
Analysis of the incident demonstrated that the attackers modified the device’s original firmware image to include a new payload called “/bin/fgfm” and ensure that it is launched before the boot process begins. This malware will then establish contact with a remote server to download files, exfiltrate data from the compromised host, and grant remote shell access.
Fortinet researchers confirmed that the exploit is highly targeted and suggests an advanced actor with a deep understanding of FortiOS and the underlying hardware.
To mitigate the impact of the attack, organizations should update their FortiOS software to versions 6.4.12, 7.0.10, and 7.2.4, which contain fixes for the CVE-2022-41328 vulnerability. Please see the official Fortiguard advisory here for a complete list of affected products: FG-IR-22-369
Organizations should also implement security best practices, including regular security updates, network segmentation, and user access control. Network segmentation helps to prevent attackers from moving laterally within the network, and user access control helps to limit access to sensitive data.
Additionally, organizations should implement a comprehensive security program that includes regular security training for employees, incident response planning, and network security monitoring. These measures can help organizations detect and respond to attacks quickly, minimizing the impact on sensitive data and critical systems.
View all Dataprise Defense Digests here.
INSIGHTS
Subscribe to get real-time notifications when a new Dataprise Defense Digest is published.