Hacking

Fortinet VPN with default certificate exposes 200,000 businesses to hack

According to SAM Seamless Network, over 200,000 businesses are using Fortigate VPN with default settings, exposing them to the risk of a hack.

In response to the spreading of Coronavirus across the world, many organizations deployed VPN solutions, including Fortigate VPN, to allow their employers to work from their homes.

The configuration of the VPN solutions is important to keep organizations secure and to avoid dangerous surprises.

According to network security platform provider SAM Seamless Network, over 200,000 businesses that have deployed the Fortigate VPN solution with default settings. This choice could allow an attacker to present a valid SSL certificate and carry out man-in-the-middle (MitM) attacks on employees’ connections.

“Surprisingly (or not?), we quickly found that under default configuration the SSL VPN is not as protected as it should be, and is vulnerable to MITM attacks quite easily.” reads the analysis published by SAM Seamless Network. “The Fortigate SSL-VPN client only verifies that the CA was issued by Fortigate (or another trusted CA), therefore an attacker can easily present a certificate issued to a different Fortigate router without raising any flags, and implement a Man-In-The-Middle attack. We’ve searched and found over 200k vulnerable businesses in a matter of minutes.”

Experts pointed out that the Fortigate SSL-VPN client only verifies that the CA was issued by Fortigate or by another trusted CA, this allows an attacker to present a certificate issued to a different Fortigate router to carry out a man-in-the-middle attack.

The researchers set up a compromised IoT device that initiates MITM attack using ARP Poisoning, then Forticlient initiates VPN connection. The compromised IoT device serves a signed Fortinet certificate extracted from legacy credentials and forwards the credentials to the original server while stealing them in the middle and spoofs the authentication process.

A digital certificate includes several values such as:

  • Server name – The name of the server this certificate was issued to
  • Public key – The public key used to encrypt the traffic to this server
  • Digital Signature – A digital signature that verifies this certificate was issued by a legitimate authority.
  • Validity – A date this certificate is valid through
  • Issuer information – Information about the issuer of the certificate (the same entity that signed the certificate)

Every time a client connects to a server, the client verifies the following information:

  • The certificate’s Server Name matches the server that the client attempted to connect to
  • The certificate validity date has not passed
  • The certificate’s digital signature is correct
  • The certificate was issued by an authority that this client trusts

The main problem is related to the use of default self-signed SSL certificates by organizations. 

The Fortigate router comes with a default SSL certificate that is signed by Fortinet, which is a self-signed certificate that includes the router’s serial number as the server name for the certificate.

Experts highlight that Fortinet’s client does not verify the Server Name at all, this means that any certificate will be accepted issued either by Fortinet or any other trusted CA. An attacker can re-route the traffic to his server, display his own certificate, and then decrypt the traffic, below a video PoC of the attack.

“In this video you can how we decrypt the traffic of the Fortinet SSL-VPN client and extract the user’s password and OTP. An attacker can actually use this to inject his own traffic, and essentially communicate with any internal device in the business, including point of sales, sensitive data centers, etc. This is a major security breach, that can lead to severe data exposure.” continues the report.

Unfortunately, Fortinet has no plans to address the vulnerability, it recommends users to manually replace the default certificate and make sure that the connections are protected from MitM attacks.

Currently, Fortinet provides a warning when the users are using the default certificate.

“You are using a default built-in certificate, which will not be able to verify your server’s domain name (your users will see a warning). It is recommended to purchase a certificate for your domain and upload it for use.” reads the warning.

Update September 28, 2020

This is the statement issued by Fortinet:

The security of our customers is our first priority. This is not a vulnerability. Fortinet VPN appliances are designed to work out-of-the-box for customers so that organizations are enabled to set up their appliance customized to their own unique deployment.  Each VPN appliance and the set up process provides multiple clear warnings in the GUI with documentation offering guidance on certificate authentication and sample certificate authentication and configuration examples.  Fortinet strongly recommends adhering to its provided installation documentation and process, paying close attention to warnings throughout that process to avoid exposing the organization to risk.  

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Fortigate VPN)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Cisco warns of password-spraying attacks targeting Secure Firewall devices

Cisco warns customers of password-spraying attacks that have been targeting Remote Access VPN (RAVPN) services…

2 hours ago

American fast-fashion firm Hot Topic hit by credential stuffing attacks

Hot Topic suffered credential stuffing attacks that exposed customers' personal information and partial payment data.…

5 hours ago

Cisco addressed high-severity flaws in IOS and IOS XE software

Cisco addressed multiple vulnerabilities in IOS and IOS XE software that can be exploited to…

19 hours ago

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…

1 day ago

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

2 days ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

2 days ago

This website uses cookies.