Hello and welcome to the Wednesday, June 24th,

2006 edition of the Sands Internet Stormsaurus Stormcast.

My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

And this episode is brought you by the Sandsdot edu graduate certificate program in penetration

testing and ethical hacking. Yesterday I talked about 40 bleed, the attack where someone did compromise

40 net firewalls and then used that access to harvest additional credentials. Well, today it's Sonic Wall.

Manuel looked at Sonic Wall firewalls that he worked at as part of his job and such,

and looked not just whether or not they were patched.

They were in 2024 some well-publicized vulnerabilities that allowed credential theft and, well,

the enemy had the same thing happen that happened with Fortinette that attackers came in,

used credentials they had harvested earlier, and recompromised firewalls after they were patched.

Well, so what Manuel looked at was how many of these firewalls were not just patched,

but also reconfigured after the patch was applied.

And one of the saddest part of this of the statistics here is that almost none, like 86% of the

firewalls, did not reconcile their credentials with Active Directory. So there were still

basically legacy credentials on the firewall itself that could have been compromised by an attacker

or maybe even accounts that an attacker

created. Also, 80% of the firewalls did not rotate their passwords. There are a couple

of things here that I think are sort of nice to have, like for example, some additional

filtering of which IP addresses can actually connect to the SL VPN here.

I forgive that for you because sometimes that's why you have the VPN in the first place,

because then you have people that travel all over the place,

...