Major maritime, port and energy companies have been identified by cyber security company Cydome as having Fortinet Firewall passwords and login details leaked in the recent FortiBleed incident.
More than 86,000 administrator credentials for Fortinet Firewalls and other network protection devices across 194 countries have been breached. The leak could enable hackers to gain unauthorised access to devices, allowing them to compromise target networks and data.
Research by Cydome indicates that the data breach included 703 satellite-linked internet protocol (IP) addresses associated with maritime satellite communications service providers.
Of the more than 250 maritime firms found to be impacted by the incident, most were shipowner or ship management companies.
“Consistent with FortiBleed hitting the operational core of maritime trade, not just back-office IT,” said Nir Ayalon, Founder and CEO of Cydome.
“Although we are still monitoring the extent of FortiBleed on the industry, of all maritime-related logins leaked, 41.5% were shipping and freight companies, 31.2% were offshore contractors and service companies, 10.7% newbuild and repair yards, and 6.7% were Port Authorities and logistics firms.”
“The team found that 87% of Fortinet devices exposed to the internet still had internet-facing management interfaces available, while 63% of harvested credentials related to default or built-in administrator accounts that had never been renamed. This suggests that many organisations have not yet taken the steps needed to fully secure affected systems… probably because they don’t know they have been hacked, yet!”
The FortiBleed incident exploits older administrator credentials that remained vulnerable after software upgrades. In many cases, organisations updated their systems but did not take the necessary steps to completely replace and discard legacy passwords, allowing attackers to recover valid credentials and test them against live devices even after a software patch was issued by Fortinet.
The seriousness of the situation has already prompted a response from the US Cybersecurity and Infrastructure Security Agency (CISA), which recommends terminating active administrator and VPN sessions, resetting passwords, enabling multi-factor authentication and investigating systems for signs of unauthorised access.
Cydome notes that appearing in the FortiBleed dataset does not automatically mean an organisation has been fully compromised, however it does indicate that credentials associated with the company’s network security infrastructure have been exposed and should be treated as a potential vulnerability.
“Shipping is one of the world’s most connected industries, and that connectivity is essential for efficient operations,” said Alon Ayalon, Co-founder and VP R&D of Cydome.
“If attackers obtain trusted administrator access, they can move through networks unnoticed, gain control over operational systems or sell the information to ransomware groups and other cybercriminals. Protecting digital identities is just as important as protecting the IT and OT systems themselves.”
