FBI Warns of Ongoing FortiBleed Attacks Locking Out FortiGate VPN Admins

Overview

The FBI is actively warning organizations about persistent ‘FortiBleed’ attacks. These attacks specifically target internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways, resulting in legitimate administrators being locked out of their accounts. This threat is critical due to the potential for complete loss of control over VPN infrastructure and subsequent network compromise.

Technical Analysis

Attackers are exploiting vulnerabilities, collectively referred to as ‘FortiBleed,’ in Fortinet FortiGate firewalls and SSL VPN gateways. The specific vulnerabilities leveraged are not detailed in the provided source, but the attacks focus on gaining unauthorized access to these devices. Once access is achieved, threat actors are observed to manipulate administrative accounts, leading to the lockout of legitimate administrators. This prevents defenders from accessing and managing their VPN infrastructure, potentially facilitating further malicious activities within the compromised network.

Detection

• Monitor FortiGate logs for unusual or unauthorized login attempts to administrative accounts.
• Look for successful administrative logins originating from unexpected or external IP addresses.
• Detect events indicating changes to administrative account configurations, such as password resets, account disablement, or new administrator account creation.
• Implement continuous monitoring for any configuration changes on FortiGate devices that are not part of a planned change management process.
• Review VPN connection logs for anomalous user activity, connection times, or data transfer patterns immediately following any suspicious administrative events.

Sigma Detection Rules

FortiGate Admin Account Modification Detection

title: FortiGate Admin Account Modification Detection
id: 92834c83-11e2-4f3b-8d1e-8a7b6c5d4e3f
status: experimental
description: Detects suspicious modifications to FortiGate admin accounts, potentially indicating compromise or lockout attempts.
logsource:
  product: fortigate
  service: system
detection:
  selection:
    msg|contains:
      - 'admin password changed'
      - 'admin account disabled'
      - 'admin account locked'
      - 'admin account modified'
  condition: selection
level: critical

FortiGate VPN Admin Login from Unusual Source

title: FortiGate VPN Admin Login from Unusual Source
id: 7e2d1f0a-5c3b-4a9e-9f8c-7b6a5d4e3c2b
status: experimental
description: Identifies successful FortiGate admin logins originating from IP addresses not typically associated with administrative access, indicating potential unauthorized access.
logsource:
  product: fortigate
  service: vpn
detection:
  selection:
    action: 'user_login'
    status: 'success'
    user: 'admin'
    src_ip|!startswith: ['10.', '172.16.', '192.168.'] # Example exclusions, to be refined by analysts
  condition: selection
level: high

Mitigations

1. Patch Immediately: Ensure all FortiGate firewalls and SSL VPN gateways are updated to the latest stable firmware versions, addressing known vulnerabilities. Prioritize patches for critical security updates.
2. Enforce Multi-Factor Authentication (MFA): Implement and enforce MFA for all administrative and VPN user accounts to prevent unauthorized access even if credentials are compromised.
3. Restrict Administrative Access: Limit administrative access to FortiGate devices to trusted, internal networks and specific IP addresses. Avoid exposing management interfaces directly to the internet.
4. Strong Password Policies: Enforce complex and unique passwords for all administrative accounts.
5. Regular Log Review: Establish a routine for reviewing FortiGate system and VPN logs for suspicious activity, failed login attempts, and configuration changes.
6. Incident Response Plan: Have a well-defined incident response plan for network device compromise, including steps for regaining control, forensic analysis, and recovery.

References

• https://www.bleepingcomputer.com/news/security/fbi-ongoing-fortibleed-attacks-lock-out-fortigate-vpn-admins/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1133 — External Remote Services
• T1531 — Account Access Removal