Over 75,000 Fortinet device administrator credentials compromised (50% of the Fortinets facing the Internet per Shodan) via Hunt Intelligence, Inc, Volodymyr Diachenko, Hudson Rock and Kevin Beaumont.
Source Reddit Cybersecurity
Discussion
A large-scale compromise of over 75,000 Fortinet device administrator credentials has been reported. The compromised credentials appear to be recent and include devices that are still online. The data was reportedly obtained from device configuration exports, containing sensitive information visible only from the devices themselves. This incident affects a significant portion of Fortinet firewall devices exposed to the internet, estimated at around 15% based on Shodan polling. The compromised devices include many with fairly recent patches. The source of this information is a Reddit post linking to a LinkedIn profile of a security researcher involved in the discovery.
r/cybersecurity (opens in a new tab)u/Candid-Molasses-62040 points0 comments
Credit to Volodymyr Diachenko, Hunt.io, Hudson Rock and Kevin Beaumont. I am not associated with any of these companies/people. I'm just spreading the gospel of these awesome people/companies.
This data is not from 2022, this appears to be new. Most of which are appear to still be online. I would run your company's domain through this awesome website Hudson rock setup located here. If you're on this list, I would consider rotating your admin credentials and restricting your Fortinet Admin portal from being accessible via the Internet and reviewing your environments logs.
More details here on massive credential compromise here.
Noteworthy takeaways below.
- The data is legit. It is around 75k devices. Almost all are still online, and Fortinet devices. It appears to be recent data.
- The data appears to have come from exports of config from the devices, as it includes things which are only visible from the device itself.
- The IP addresses are largely different to the Belsen Group leak, which was 15k devices. It includes mostly devices not in the Belsen Group leak, and in this case most of the devices are still online — this isn’t data from 2022.
- I have worked with several orgs listed, and can confirm the logins and passwords are real. Many of the devices sampled are on fairly recent patches.
- The data comprises of roughly 15% of all Fortinet firewall devices facing the internet, based on polling from Shodan. *Previous claim was 50% per the article. I'm seeing closer to 15%.