securityaffairs.com Open in urlscan Pro
2606:4700:3031::ac43:8cd3  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.com/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.com/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MUST READ

Headlines
 * PayPal notifies 34942 users of data breach over credential stuffing attack
 * Chinese hackers used recently patched FortiOS SSL-VPN flaw as a zero-day in
   October
 * Cisco fixes SQL Injection flaw in Unified CM
 * Experts released PoC exploit for critical Zoho ManageEngine RCE flaw
 * Critical Microsoft Azure RCE flaw impacted multiple services
 * Mailchimp discloses a new security breach, the second one in 6 months



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


CHINESE HACKERS USED RECENTLY PATCHED FORTIOS SSL-VPN FLAW AS A ZERO-DAY IN
OCTOBER

January 20, 2023  By Pierluigi Paganini




AN ALLEGED CHINESE THREAT ACTOR WAS OBSERVED EXPLOITING THE RECENTLY PATCHED
CVE-2022-42475 VULNERABILITY IN FORTIOS SSL-VPN.

Researchers from Mandiant reported that suspected Chinese threat actors
exploited the recently patched CVE-2022-42475 vulnerability in FortiOS SSL-VPN
as a zero-day.

According to the security firm, the vulnerability was exploited in attacks
against a series of targets, including a European government entity and a
managed service provider located in Africa.

The attacks took place as early as October 2022 (the issue was addressed by
Fortinet in December) and evidence gathered by the experts suggest that they are
part of Chinese cyber espionage operations.

In December, Fortinet urged its customers to update their installs to address an
actively exploited FortiOS SSL-VPN vulnerability (CVE-2022-42475), that could be
exploited by an unauthenticated, remote attacker to execute arbitrary code on
devices.

The flaw is a heap-based buffer overflow that that resides in FortiOS sslvpnd.
The vulnerability allowed unauthenticated attackers to crash targeted devices
remotely or gain remote code execution.



“A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may
allow a remote unauthenticated attacker to execute arbitrary code or commands
via specifically crafted requests.” reads the advisory published by the security
vendor. “Fortinet is aware of an instance where this vulnerability was exploited
in the wild,”

Fortinet addressed the issue with the release of FortiOS 7.2.3.

Mandiant announced to have identified a new strain of malware, tracked as
‘BOLDMOVE.’ The experts discovered a Windows and a Linux variant of BOLDMOVE,
the latter was specifically designed to target FortiGate Firewalls.

“This incident continues China’s pattern of exploiting internet facing devices,
specifically those used for managed security purposes (e.g., firewalls, IPS\IDS
appliances etc.). These devices are attractive targets for multiple reasons.
First, they are accessible to the internet, and if the attacker has an exploit,
they can gain access to a network without requiring any victim interaction.”
reads the report published by Mandiant. “This allows the attacker to control the
timing of the operation and can decrease the chances of detection.”



The threat actors demonstrated to have that an in-depth understanding of devices
and undocumented proprietary formats to develop the zero-day exploit.

BOLDMOVE is written in C, the researchers pointed out that they have not
directly observed exploitation of the vulnerability, however, they noticed that
samples of the BOLDMOVE Linux variant was designed to contact C2 IP addresses
listed by Fortinet as being involved in the exploitation.

BOLDMOVE is able to gather system info on the infected device and execute
commands sent by the C2 server. An extended version of BOLDMOVE malware supports
a command to modify proprietary Fortinet logs on the system. 

“We assess with low confidence that this operation has a nexus to the People’s
Republic of China. China-nexus clusters have historically shown significant
interest in targeting networking devices and manipulating the operating system
or underlying software which supports these devices. In addition, the
geographical and sector targeting is consistent with previous Chinese
operations.” concludes Mandiant. “The exploitation of zero-day vulnerabilities
in networking devices, followed by the installation of custom implants, is
consistent with previous Chinese exploitation of networking devices.”



Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″][adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, FortiOS SSL-VPN)

[adrotate banner=”5″]

[adrotate banner=”13″]


SHARE THIS:

 * Email
 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 
 * 


BOLDMOVEChinaFortiOS SSL-VPNHackinghacking newsinformation security newsIT
Information SecuritymalwarePierluigi PaganiniSecurity AffairsSecurity News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

Cisco fixes SQL Injection flaw in Unified CM

NEXT ARTICLE

PayPal notifies 34942 users of data breach over credential stuffing attack

--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


PAYPAL NOTIFIES 34942 USERS OF DATA BREACH OVER CREDENTIAL STUFFING ATTACK

January 20, 2023  By Pierluigi Paganini

CISCO FIXES SQL INJECTION FLAW IN UNIFIED CM

January 20, 2023  By Pierluigi Paganini






 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES
   
   


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

CISCO FIXES SQL INJECTION FLAW IN UNIFIED CM

A high-severity flaw (CVE-2023-20010) was found in Cisco Unified Communications
Manager and Unified Communications Manager...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me

We use cookies on our website to give you the most relevant experience by
remembering your preferences and repeat visits. By clicking “Accept All”, you
consent to the use of ALL the cookies. However, you may visit "Cookie Settings"
to provide a controlled consent.
Cookie SettingsAccept All
Manage consent
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT