WEBVTT

1
00:00:03.200 --> 00:00:06.240
This is Decrypted. Saturday, the third of October.

2
00:00:06.240 --> 00:00:11.360
FortiMail's encryption portal let attackers write files without logging in.

3
00:00:11.360 --> 00:00:16.680
The mail gateway is meant to check the post before it reaches your staff.

4
00:00:16.680 --> 00:00:23.493
This week, Fortinet confirmed that attackers are using a flaw in its FortiMail product to write their own fil

5
00:00:23.493 --> 00:00:25.840
es onto that gateway without logging in.

6
00:00:25.840 --> 00:00:30.000
Fortinet published its advisory on 1 October.

7
00:00:30.000 --> 00:00:39.662
Sisa added the flaw, C V E twenty twenty-six, one zero four two eight six, to its Known Exploited Vulnerabili

8
00:00:39.662 --> 00:00:41.200
ties catalogue the same day.

9
00:00:41.200 --> 00:00:45.680
US federal agencies have a deadline of 4 October.

10
00:00:45.680 --> 00:00:49.920
Next.

What the flaw does.

11
00:00:49.920 --> 00:00:53.520
The bug scores 9.8 out of 10.

12
00:00:53.520 --> 00:00:58.800
It sits in the web component for Identity-Based Encryption, or I B E.

13
00:00:58.800 --> 00:01:05.410
That's the feature that lets FortiMail send encrypted messages to outside recipients, who collect them throug

14
00:01:05.410 --> 00:01:13.280
h a web portal. Fortinet describes a path traversal combined with improper handling of N U L L characters.

15
00:01:13.280 --> 00:01:16.639
Those are two classic input-handling mistakes.

16
00:01:16.639 --> 00:01:20.960
Think of a hotel porter told to deliver parcels only to the post room.

17
00:01:20.960 --> 00:01:28.720
The flaw lets a stranger hand over a note reading "post room, then up three floors and along the corridor".

18
00:01:28.720 --> 00:01:32.160
The porter simply follows it, never asking who the stranger is.

19
00:01:32.160 --> 00:01:39.710
In technical terms, an unauthenticated attacker can write arbitrary files to the underlying system using craf

20
00:01:39.710 --> 00:01:43.360
ted H T T P or H T T P S requests.

21
00:01:43.360 --> 00:01:46.640
And also.

What defenders will see.

22
00:01:46.640 --> 00:01:53.200
Fortinet's indicators of compromise include newly added files named liblog.

23
00:01:53.200 --> 00:01:56.560
so, webconsole and mailservice.

24
00:01:56.560 --> 00:02:05.024
There's also a ld.so.preload file, and modified configuration files such as httpd.

25
00:02:05.024 --> 00:02:12.240
conf. A preload file is a Linux mechanism for loading a chosen library into every program that starts.

26
00:02:12.240 --> 00:02:15.480
That's exactly what you'd want if you planned to stay hidden.

27
00:02:15.480 --> 00:02:19.520
Two I P addresses are listed: 79.

28
00:02:19.520 --> 00:02:25.840
141.169 dot 187, and 45.129.

29
00:02:25.840 --> 00:02:31.840
0 dot 192. Reporting says the actor behind the attacks hasn't been identified.

30
00:02:31.840 --> 00:02:36.160
One caution. Sources disagree on patch status.

31
00:02:36.160 --> 00:02:38.960
Fortinet's advisory lists 8.

32
00:02:38.960 --> 00:02:45.760
0.2, 7.6.7 and 7.4.9 as fixed releases.

33
00:02:45.760 --> 00:02:49.600
It tells 7.2 users to move to the 7.

34
00:02:49.600 --> 00:02:53.920
4 branch. But some write-ups describe the fixes as forthcoming.

35
00:02:53.920 --> 00:02:59.600
Check the advisory against your own appliance rather than trusting a summary, including this one.

36
00:02:59.600 --> 00:03:03.360
And also.

The Secure by Design lesson.

37
00:03:03.360 --> 00:03:07.600
An email gateway sees the contents of an organisation's correspondence.

38
00:03:07.600 --> 00:03:10.640
So it should present the smallest surface possible.

39
00:03:10.640 --> 00:03:17.560
Here, an optional feature exposed a web interface, and one weak check turned it into a foothold.

40
00:03:17.560 --> 00:03:21.720
Secure by Design asks the vendor for three things.

41
00:03:21.720 --> 00:03:24.400
Optional features should be off until chosen.

42
00:03:24.400 --> 00:03:29.520
Input that contains path characters should be rejected rather than tidied up.

43
00:03:29.520 --> 00:03:34.640
And portals and management interfaces shouldn't be reachable from the open internet by default.

44
00:03:34.640 --> 00:03:37.840
Fortinet's own workarounds point the same way.

45
00:03:37.840 --> 00:03:42.480
Disable I B E. Restrict access to trusted networks.

46
00:03:42.480 --> 00:03:49.333
Or use a web application firewall to block P O S T requests to /ibe containing ".

47
00:03:49.333 --> 00:03:54.320
./".

And finally.

What UK organisations should do.

48
00:03:54.320 --> 00:04:01.120
First, find out whether you run FortiMail, including through a managed provider, and which version.

49
00:04:01.120 --> 00:04:06.320
Then disable I B E if you don't need it, and apply the fixed release if you do.

50
00:04:06.320 --> 00:04:10.160
Next, hunt for the listed files and addresses.

51
00:04:10.160 --> 00:04:14.920
A patch closes the door, but it doesn't evict someone already inside.

52
00:04:14.920 --> 00:04:22.120
Finally, ask your supplier in writing which features are enabled by default and reachable from the internet.

53
00:04:22.120 --> 00:04:25.160
That last question costs an afternoon.

54
00:04:25.160 --> 00:04:31.000
It's far cheaper than explaining to a regulator, or your board, why your mail gateway was open.

55
00:04:31.000 --> 00:04:37.040
That was Decrypted. The written version and every source are linked in the show notes.

56
00:04:37.040 --> 00:04:38.160
Thanks for listening.