SonicWall suggests people unplug their end-of-life gateways under 'active attack' by ransomware crims
(2021/07/15)
- Reference: 1626319870
- News link: https://www.theregister.co.uk/2021/07/15/sonicwall_secure_access/
- Source link:
SonicWall has warned that its older Secure Mobile Access (SMA) 100 series and Secure Remote Access (SRA) gateways are being attacked in the wild by crooks to spread ransomware – and as some of those devices are end-of-life, don't expect any patches to protect them.
In an [1]emergency alert on Wednesday, the networking biz said miscreants are "actively targeting" the equipment to, as we understand it, steal credentials from them to compromise networks for "an imminent ransomware campaign."
The SRA 4600/1600 (which went end-of-life in 2019), the SRA 4200/1200 (2016), and SSL-VPN 200/2000/400 (2013-2014) running firmware version 8.x are too out of date for SonicWall to patch, so users are told to unplug the gear and reset any account passwords that share the same credentials as the details may have been stolen.
[2]
The SMA 400/200, which is just about still supported, can be updated to firmware versions 10.2.0.7-34 or 9.0.0.10, which are said to be safe from the attacks, though you should still reset any associated passwords that may have been stolen, and enable multi-factor authentication where you can.
[3]
[4]
The SMA 210/410/500v, which is still supported, should be upgraded to version 10.2.0.7-34sv or 9.0.0.10-28sv to mitigate the vulnerabilities, though we're told they are not under active attack.
"Organizations that fail to take appropriate actions to mitigate these vulnerabilities on their SRA and SMA 100 series products are at imminent risk of a targeted ransomware attack," SonicWall advised.
[5]
"If your organization is using a legacy SRA appliance that is past end-of life status and cannot update to 9.x firmware, continued use may result in ransomware exploitation."
[6]If you want to practice writing exploits and worms, there's a big hijacking hole in SonicWall firewall VPNs
[7]As the world secures itself, so do crims: Encrypted malware on the rise, warns Sonicwall
[8]Microsoft warns of serious vulnerabilities in Netgear's DGN2200v1 router
[9]Un-Delled SonicWall beefs up firewall to wrestle ransomware
Funnily enough, for customers with gear that can't be fixed, SonicWall is offering "a complimentary virtual SMA 500v until October 31, 2021. This should provide sufficient time to transition to a product that is actively maintained." See the above advisory for details.
"SonicWall would like to thank Mandiant and their team of threat researchers for collaboration on this subject," it added. ®
Get our [10]Tech Resources
[1] https://www.sonicwall.com/support/product-notification/urgent-security-notice-critical-risk-to-unpatched-end-of-life-sra-sma-8-x-remote-access-devices/210713105333210/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YO@y5Xml@IiM3bH5Qw107AAAAMg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YO@y5Xml@IiM3bH5Qw107AAAAMg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YO@y5Xml@IiM3bH5Qw107AAAAMg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YO@y5Xml@IiM3bH5Qw107AAAAMg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2020/10/16/sonicwall_firewall_vuln/
[7] https://www.theregister.com/2019/07/29/sonicwall_threat_report/
[8] https://www.theregister.com/2021/07/01/microsoft_netgear_security_advisory_dgn2200v1/
[9] https://www.theregister.com/2017/10/03/sonicwall_product_revamp/
[10] https://whitepapers.theregister.com/
In an [1]emergency alert on Wednesday, the networking biz said miscreants are "actively targeting" the equipment to, as we understand it, steal credentials from them to compromise networks for "an imminent ransomware campaign."
The SRA 4600/1600 (which went end-of-life in 2019), the SRA 4200/1200 (2016), and SSL-VPN 200/2000/400 (2013-2014) running firmware version 8.x are too out of date for SonicWall to patch, so users are told to unplug the gear and reset any account passwords that share the same credentials as the details may have been stolen.
[2]
The SMA 400/200, which is just about still supported, can be updated to firmware versions 10.2.0.7-34 or 9.0.0.10, which are said to be safe from the attacks, though you should still reset any associated passwords that may have been stolen, and enable multi-factor authentication where you can.
[3]
[4]
The SMA 210/410/500v, which is still supported, should be upgraded to version 10.2.0.7-34sv or 9.0.0.10-28sv to mitigate the vulnerabilities, though we're told they are not under active attack.
"Organizations that fail to take appropriate actions to mitigate these vulnerabilities on their SRA and SMA 100 series products are at imminent risk of a targeted ransomware attack," SonicWall advised.
[5]
"If your organization is using a legacy SRA appliance that is past end-of life status and cannot update to 9.x firmware, continued use may result in ransomware exploitation."
[6]If you want to practice writing exploits and worms, there's a big hijacking hole in SonicWall firewall VPNs
[7]As the world secures itself, so do crims: Encrypted malware on the rise, warns Sonicwall
[8]Microsoft warns of serious vulnerabilities in Netgear's DGN2200v1 router
[9]Un-Delled SonicWall beefs up firewall to wrestle ransomware
Funnily enough, for customers with gear that can't be fixed, SonicWall is offering "a complimentary virtual SMA 500v until October 31, 2021. This should provide sufficient time to transition to a product that is actively maintained." See the above advisory for details.
"SonicWall would like to thank Mandiant and their team of threat researchers for collaboration on this subject," it added. ®
Get our [10]Tech Resources
[1] https://www.sonicwall.com/support/product-notification/urgent-security-notice-critical-risk-to-unpatched-end-of-life-sra-sma-8-x-remote-access-devices/210713105333210/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YO@y5Xml@IiM3bH5Qw107AAAAMg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YO@y5Xml@IiM3bH5Qw107AAAAMg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YO@y5Xml@IiM3bH5Qw107AAAAMg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/networks&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YO@y5Xml@IiM3bH5Qw107AAAAMg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2020/10/16/sonicwall_firewall_vuln/
[7] https://www.theregister.com/2019/07/29/sonicwall_threat_report/
[8] https://www.theregister.com/2021/07/01/microsoft_netgear_security_advisory_dgn2200v1/
[9] https://www.theregister.com/2017/10/03/sonicwall_product_revamp/
[10] https://whitepapers.theregister.com/