FortiOS – buffer overflow – CVE-2023-27997

A critical vulnerability discovered in FortiGate SSL VPN enables hackers to infiltrate vulnerable systems and inject malicious code, even when Multi-Factor Authentication (MFA) is activated.

Following Fortinet product versions are affected and firmware should be updated.

Affected Products
FortiOS version 7.2.0 through 7.2.2
FortiOS version 7.0.0 through 7.0.8
FortiOS version 6.4.0 through 6.4.10
FortiOS version 6.2.0 through 6.2.11
FortiOS version 6.0.0 through 6.0.15
FortiOS version 5.6.0 through 5.6.14
FortiOS version 5.4.0 through 5.4.13
FortiOS version 5.2.0 through 5.2.15
FortiOS version 5.0.0 through 5.0.14
FortiOS-6K7K version 7.0.0 through 7.0.7
FortiOS-6K7K version 6.4.0 through 6.4.9
FortiOS-6K7K version 6.2.0 through 6.2.11
FortiOS-6K7K version 6.0.0 through 6.0.14
FortiProxy version 7.2.0 through 7.2.1
FortiProxy version 7.0.0 through 7.0.7
FortiProxy version 2.0.0 through 2.0.11
FortiProxy version 1.2.0 through 1.2.13
FortiProxy version 1.1.0 through 1.1.6
FortiProxy version 1.0.0 through 1.0.7

CVE-2023-27997 denotes a crucial heap buffer overflow vulnerability within Fortinet’s FortiOS SSL-VPN pre-authentication module.

Its exploitation permits an overflow of data from a designated memory block into adjacent blocks in the heap, enabling the execution of arbitrary code and facilitating malicious program activities.

SSL VPNs are typically relied upon for establishing secure connections to private organizational networks and the vulnerability could grant cybercriminals access to any networks and products assumed to be safeguarded.

This vulnerability exploit pre-authentication without privileged credentials allowing attackers to elude interception and escalate likelihood of successful data breach attempts.

Suggested response actions to mitigate the impact of CVE-2023-27997, is to upgrade to the Latest FortiOS Firmware Release and/or disable SSL-VPN on all impacted devices is it is not actively in use.

To shutoff SSL-VPN access, follow this link.

Follow Fortinet’s best practice on hardening your network devices.

PayNow Possible Info Leak

Getting a call from a long lost “friend” whom you don’t recall knowing?

These are from scammers that are using the name provided on your PayNow-linked mobile number and pretending to be someone you know.

Your name or alias is shown when someone attempts to pay you via your mobile number.

Chances are they know about you as much as the hawker stall you paid your food for using PayNOW/PayLah! method.

You can change your name to Salvatore and chances are scammers will be calling and looking for Salvatore.

Is Microsoft ditching SMS for Multi-Factor Authentication (MFA)?

Microsoft is discontinuing support for SMS in specific sign-in scenarios. This includes sign-ins from new devices and those that need multi-factor authentication (MFA).

The reason behind this move is to step up security and minimize the chances of unauthorized access.

Typically, the concern arises because employees might not want to use their personal mobile devices to verify their access.

Customers have the option to establish a conditional access policy to reduce the frequency of MFA prompts when they’re in trusted locations. To do this, you’ll need at least one Azure AD P1 (Microsoft Enterprise ID P1), Office 365 E3 Plan, or Office 365 Business Premium subscription.

Another choice is to get a FIDO2 key or a FIDO2-compliant pass for each user. If you encounter any difficulties while setting up MFA using these methods, feel free to reach out to us for assistance.

What happen if your email password is compromised?

The typical situation where an email password is compromised is from a successful phishing attempt – password was leaked to a fake Microsoft or Google site after clicking on a suspicious email and authenticating with credentials.

phishing password expiry

First picture shows a typical phishing email. Subsequent picture shows phisher's destination site when hovering mouse over the link.

The perpetrator will then authenticated and maintain a persistent session on web mail, stealthily monitor your email communications and then get information on the correspondence that you have.

This is particularly damaging if the email account is a business account. It does not matter if you are a trade creditor or trade debtor. Once these details are available to them, they can construct another email engineered to trick either you (posing as your supplier) or to your supplier (posing as you) and request a pending payment to be paid to another bank account due to some banking issues.

A misspelled domain (1 as l or vice versa) or a similar sounding domain will be registered and a fake email account created. It will be so similar to such an extend that other than the domain name, the sender’s name (even case sensitively similar), signature, message content and sentence construct will be exactly the same.

The victim will then be instructed to pay to the scammer’s bank account and may realize only when supplier start asking them for payment.

Some steps that IT administrators can take are:

  1. Enforce Multi-factor authentication for email access using mobile OTP or authenticator apps.
  2. Train users to identify phishing email through phishing simulator (Microsoft or third party) and conduct constant training for new and existing users.
  3. Enforce modern authentication, password strength, complexity and set a password expiry period.
  4. Force sign-out all sessions for each password change to prevent session using cached credential.
  5. For users not accessing email externally, disable Outlook Web Access (webmail), insecure protocol, POP3 and IMAP access.
  6. Monitor Azure AD sign-in logs for suspicious failed or successful sign-ins outside of your geographic location as it may indicate successful phish attempts. If necessary, force password reset and sign-out all sessions.
  7. Tag external emails with warning message and educate users on why an email is tagged as external when it seems to be from someone within the organization and to be cautious of attachments/links within such emails. Explain to users that emails tagged as external are sent from external parties even though it may appears to be from someone within the organization. All such emails especially the later should be handled with caution.

Disable App Install from External Sources – Android

Mobile OS’s default app store like Apple Playstore, Android’s Google Play or Huawei App Gallery published only approved apps that are checked for malicious or suspicious code and it is the safest way to install mobile apps.

Scammers utilizes ads to entice unknowing users to install malicious remote access/control tool through directly downloading to your device, disable security checks, installing and running it.

Enabling 3rd party APK installation permission on an app in android (e.g. Chrome) also risks allowing future drive-by installation of unknown apps that may be contains malicious code as it does not require intervention to download and install malicious program files.

Here are steps to check if any of your installed apps is allowing APK installation from unknown sources on your Android device. My device is a Huawei and it may varies slightly from your mobile brand.

1. Click Settings

2. Scroll through the list for Security option and click on it.

3. Look for More Settings. On some version, there may be an App option which can allow you to toggle and disable install permission directly on each of the installed apps in the list.

3. Click install apps from external sources

4. Scroll through your list of installed apps and look for any that has “Allowed” instead of “No”.

5. Toggle the button off (grey out) to disable it.

Stealing passwords and impersonation are some of their key agendas and with present day’s powerful smartphones, there are no telltale signs of your device being compromised.

To minimize malicious apps from capturing passwords using keylogger programs, you should enable biometric login to your important apps (e.g. bank, government, even SMS) if it is available. Also, turn off data and wifi access when your are charging at night. (reducing availability to unauthorized call home or remote access)

Consider getting a robust antivirus and security tool to protect and actively monitor for suspicious activities on your device.

Consider getting an antivirus program for your PCs and portable devices to monitoring and block any malicious activities.

Dr Web Security Space consist a suite of security tool to protect both your PC and your mobile device using on a single license.

Actively preventing is better than reacting only after suffering financial loss due to compromised account from malwares.

Contact us if you require assessment on business licensing for your environment.

What causes data loss?

Some common scenarios would be – two disks failure in a RAID 5 system, disk controller failure in any type of setup, ransomware (delete shadow, encrypt and delete), mechanical failure, accidental or malicious deletion.

Well planned backup is important. Poorly planned backup may fill your disks with stale data or old data while denying any additional new data from being backed up. Data that has not been accessed for a long time should be archived and moved to offsite facility for long term retention e.g. Iron Mountain.

Other option would be cheaper cold-tier cloud storage e.g. Azure Cloud or Google Cloud. There is also BackBlaze B2 that is reasonably cheap but offers hot storage. These are generally cheap to archive but expensive to restore.

On Windows servers or desktops, a forfiles command from command prompt will give you an indication of what are the files that have not been modified for the period you specify.

e.g. ForFiles /p “D:\LogFiles” /s /d -365
shows modified files 1 year before

Keep your initial disk array information in your documentation if it is not the default as it will make your data recovery from a RAID setup less painful. Create multiple images of varying setup will be stressful in situation where the disks are already failing.

Backup is a specialized area in IT and it requires proper planning, sizing, managing of duplicate / stale data, and ultimately to achieve your recovery point objective and recovery time objective. A unified backup strategy has to cover an array of different data structures – hypervisors, virtual machines, containers, databases and cloud. We provide solutions for backup and data recovery.

Tired of managing IT daily operation, security, malwares, backups, system updates and patches? Talk to us on our IT managed service and let us take care of your office’s IT needs.

What is Zero Day Threat?

A zero-day threat refers to a security vulnerability or software flaw that is discovered by cyber attackers before the software vendor becomes aware of it. As a result, there is no patch or fix available to defend against the threat, making it particularly dangerous.

Zero-day threat protection is a cybersecurity strategy designed to defend against threats that exploit previously unknown vulnerabilities in software or hardware. These vulnerabilities are called “zero-day vulnerabilities” because they are discovered by attackers before the software vendor is aware of them, leaving zero days for the vendor to develop and release a patch.

Zero-day threat protection typically involves a combination of proactive and reactive measures to detect and mitigate zero-day attacks. Here’s how it generally works:

  1. Behavior-based Analysis: One approach to zero-day threat protection is behavior-based analysis. Security solutions monitor the behavior of files, applications, and network traffic in real-time. If an unknown file exhibits suspicious or malicious behavior, the security system may quarantine or block it to prevent potential harm.
  2. Heuristics and Machine Learning: Security tools use heuristics and machine learning algorithms to identify patterns and behaviors associated with malware and exploits. They compare files and code against known threat profiles to identify potential zero-day threats.
  3. Sandboxing: Some security solutions use sandboxing to analyze potentially malicious files or code in a controlled environment. Sandboxing isolates suspicious files from the main system, allowing security experts to observe their behavior without risking the host system’s security.
  4. Threat Intelligence Sharing: Companies and organizations often share threat intelligence and information about zero-day threats with each other and security vendors. This collaboration helps identify and respond to new threats more effectively.
  5. Rapid Patching and Updates: When zero-day vulnerabilities are discovered, software vendors work swiftly to develop patches and updates to fix the vulnerabilities. Users are urged to apply these patches as soon as they become available to protect their systems.
  6. Security Policies and Access Controls: Implementing robust security policies and access controls can limit the attack surface and reduce the impact of zero-day threats. By restricting unnecessary privileges and controlling access to critical systems, organizations can minimize the potential damage.
  7. User Education and Awareness: Educating users about the risks of social engineering attacks, phishing emails, and malicious downloads can help prevent zero-day exploits. Encouraging users to be cautious and vigilant can reduce the likelihood of successful attacks.

While zero-day threat protection strategies can significantly reduce the risk of zero-day attacks, no security measure is foolproof. The cybersecurity landscape is constantly evolving, and attackers are continually developing new techniques. A multi-layered security approach that includes regular updates, strong access controls, user education, and threat intelligence sharing is crucial for a comprehensive defense against zero-day threats.

Check File for Virus

Suspicious about a file? Check file for virus using Doctor Web’s updated virus database.

 Review
 Scan

Worry about insufficient IT security? Protect your corporate network with Dr Web Security Suite now.

Identifying Phishing and Mitigating It

Most phish attempts start from obtaining users’ passwords then proceed to downloading of payloads so that the end systems can be controlled remotely.

Attacker subsequently gathers info to propagate infection, disables security and attempts privilege escalation (eg. dumping payloads to vulnerabilities within the network). It may also includes encrypting of critical data (typical ransomware attack) then requesting payment to decrypt them.

The result of a successful phishing attack is usually targetted at causing financial losses but its impact entails far more damage.

Impersonating colleagues

One scenario may be a junior staff receiving instruction from their manager claiming to be overseas and instructing his/her staff to urgently remit money to a bank account due to a last minute agreement/purchase.

In this scenario, the manager account is compromised and the pepertrator is monitoring the account and send the phishing email using similar signature and writing style to trick the recipient to pay an unknown party.

The attempt would be for a amount that is large enough but yet not trigger a phone call to the manager.

Impersonating suppliers

Another scenario would be, when a customer’s email account is compromised, it is monitored for correspondence between the compromised account and his/her suppliers.

The perpetrator then registers a misspelled domain (1 as L or I, I as L) that is similar to domain of one of the suppliers that has bigger transactions with the customer.

Subsequently, a phishing email is then sent to the compromised account claiming to be from the supplier using the mispelled domain registered. The phisher the impersonate as the supplier, requesting any upcoming payments to be sent to a different bank account (under a different name) citing issues with their bank.

If successful, both customer and supplier will suffer financial loss (one from not getting paid and the other from paying to an unknown party).

Mitigation

In above scenarios, enabling MFA – where logins are challenged with a code sent to registered mobile number or via authenticator, may alleviate the issue.

MFA may be also be configured to be required only when users are signing in from unfamiliar IP addresses outside of their corporate network.

It would be ideal to prevent getting compromised from the start by implementing firewall web filters preventing users from reaching a phish site.

There are also phishing simulation (Defender for Business for Microsoft 365) that will simulate attacks to train users detect emails that looks like phishing attempts. (For users that fail the simulation, they may be requested to go for a friendly coffee session – aka retraining on how to detect phishing.)

IT department may also geo-target the authentications to be allowed only from within a fixed number of geolocations and monitor audit logs for malicious attempts and react accordingly.

Phishing attempts usually start with a forged email with a link for users to authenticate and then initiates an install of malware to the system.

Phishing/malware links can be blocked/prevented using a mix of firewall web-filtering and application layer control.

Don’t have MFA/2FA? Synchronization of emails taking too long? – contact us to sign up for Office 365.

If you require reviewing or securing your network, feel free to contact us. We will be happy to assist you.

A Microsoft-based phish simulation tool is available with Microsoft Defender Plan 2. It is ideal for administrators that would like to run simulations prior to conducting training to users.

Microsoft Cloud Services

New setup – getting it right the first time

Don’t lose emails when your PC crashes! Use Microsoft Exchange Online instead of cheaper email providers which give very limited features and space.

We provide Microsoft 365 for Business Standard as an all-in-one platform for your business needs. New startup email system covering also full Office desktop apps and cloud storage solution.

The subscription covers mailbox, Office apps, share, data protection and collaboration as follows.

Email services                                                –              Microsoft Exchange mailboxes integrated with Teams and calendar. Mail retention, deleted item recovery, distribution list and shared mailboxes.
Email and desktop apps                               –              included up to 5 installs for Office applications like Outlook, Word, Excel, Powerpoint & Access.
Endpoint Backup to cloud                             –              OneDrive for Business up to 1TB cloud storage
Files and folder sharing                                 –              Microsoft Sharepoint site, document co-authoring, file versioning and rights management.
Meetings and remote management             –               Teams for Business


Subscription options:

Exchange Online – Email mailbox only @ ~$6.00/user monthly
Microsoft 365 Apps – Desktop apps only @ ~$12.00/user monthly
Microsoft 365 Apps Business Std – Email mailbox, desktop apps, Sharepoint Online + Teams – @ $18/00/user monthly.

Don’t lose emails when your PC crashes, use Microsoft Exchange and sync your data to cloud.

Scale up/down when needed with just minimum of just 1 license.


We support on-prem or cloud hosted Exchange server,
provide email setup full email support for whole process,
provide POP3/IMAP/G-Suite to Office 365 migration using 3rd party tools like Bittitan,
Corporate IT desktop/network support service,
Domain registration/transfer, DNS setup, client migration,
IT support service (Onsite),
Remote IT setup/support – QuickAssist/Anydesk/RDP.
Managed wireless system with Ubiquiti + Unifi Network (VM/cloud) + Guest Portal

Get EV Multi-domain SSL if your company requires wildcard SAN on subdomains using a single cert.