When Patching Isn’t Enough – Gigaom

Executive Briefing

What Happened:

A stealthy, persistent backdoor was discovered in over 16,000 Fortinet firewalls. This wasn’t a new vulnerability – it was a case of attackers exploiting a subtle part of the system (language folders) to maintain unauthorized access even after the original vulnerabilities had been patched.

What It Means:

Devices that were considered “safe” may still be compromised. Attackers had read-only access to sensitive system files via symbolic links placed on the file system – completely bypassing traditional authentication and detection. Even if a device was patched months ago, the attacker could still be in place.

Business Risk:

• Exposure of sensitive configuration files (including VPN, admin, and user data)
• Reputational risk if customer-facing infrastructure is compromised
• Compliance concerns depending on industry (HIPAA, PCI, etc.)
• Loss of control over device configurations and trust boundaries

What We’re Doing About It:

We’ve implemented a targeted remediation plan that includes firmware patching, credential resets, file system audits, and access control updates. We’ve also embedded long-term controls to monitor for persistence tactics like this in the future.

Key Takeaway For Leadership:

This isn’t about one vendor or one CVE. This is a reminder that patching is only one step in a secure operations model. We’re updating our process to include persistent threat detection on all network appliances – because attackers aren’t waiting around for the next CVE to strike.

What Happened

Attackers exploited Fortinet firewalls by planting symbolic links in language file folders. These links pointed to sensitive root-level files, which were then accessible through the SSL-VPN web interface.

The result: attackers gained read-only access to system data with no credentials and no alerts. This backdoor remained even after firmware patches – unless you knew to remove it.

FortiOS Versions That Remove the Backdoor:

• 7.6.2
• 7.4.7
• 7.2.11
• 7.0.17
• 6.4.16

If you’re running anything older, assume compromise and act accordingly.

The Real Lesson

We tend to think of patching as a full reset. It’s not. Attackers today are persistent. They don’t just get in and move laterally – they burrow in quietly, and stay.

The real problem here wasn’t a technical flaw. It was a blind spot in operational trust: the assumption that once we patch, we’re done. That assumption is no longer safe.

Ops Resolution Plan: One-Click Runbook

Playbook: Fortinet Symlink Backdoor Remediation

Purpose:
Remediate the symlink backdoor vulnerability affecting FortiGate appliances. This includes patching, auditing, credential hygiene, and confirming removal of any persistent unauthorized access.

1. Scope Your Environment

• Identify all Fortinet devices in use (physical or virtual).
•  Inventory all firmware versions.
•  Check which devices have SSL-VPN enabled.

2. Patch Firmware

Patch to the following minimum versions:

• FortiOS 7.6.2
• FortiOS 7.4.7
• FortiOS 7.2.11
• FortiOS 7.0.17
• FortiOS 6.4.16

Steps:

•  Download firmware from Fortinet support portal.
•  Schedule downtime or a rolling upgrade window.
•  Backup configuration before applying updates.
•  Apply firmware update via GUI or CLI.

3. Post-Patch Validation

After updating:

•  Confirm version using get system status.
•  Verify SSL-VPN is operational if in use.
•  Run diagnose sys flash list to confirm removal of unauthorized symlinks (Fortinet script included in new firmware should clean it up automatically).

4. Credential & Session Hygiene

•  Force password reset for all admin accounts.
•  Revoke and re-issue any local user credentials stored in FortiGate.
•  Invalidate all current VPN sessions.

5. System & Config Audit

•  Review admin account list for unknown users.
•  Validate current config files (show full-configuration) for unexpected changes.
•  Search filesystem for remaining symbolic links (optional):

find / -type l -ls | grep -v "/usr"

6. Monitoring and Detection

•  Enable full logging on SSL-VPN and admin interfaces.
•  Export logs for analysis and retention.
•  Integrate with SIEM to alert on:
  • Unusual admin logins
  • Access to unusual web resources
  • VPN access outside expected geos

7. Harden SSL-VPN

•  Limit external exposure (use IP allowlists or geo-fencing).
•  Require MFA on all VPN access.
•  Disable web-mode access unless absolutely needed.
•  Turn off unused web components (e.g., themes, language packs).

Change Control Summary

Change Type: Security hotfix
Systems Affected: FortiGate appliances running SSL-VPN
Impact: Short interruption during firmware upgrade
Risk Level: Medium
Change Owner: [Insert name/contact]
Change Window: [Insert time]
Backout Plan: See below
Test Plan: Confirm firmware version, validate VPN access, and run post-patch audits

Rollback Plan

If upgrade causes failure:

1. Reboot into previous firmware partition using console access.
   • Run: exec set-next-reboot primary or secondary depending on which was upgraded.
2. Restore backed-up config (pre-patch).
3. Disable SSL-VPN temporarily to prevent exposure while issue is investigated.
4. Notify infosec and escalate through Fortinet support.

Final Thought

This wasn’t a missed patch. It was a failure to assume attackers would play fair.

If you’re only validating whether something is “vulnerable,” you’re missing the bigger picture. You need to ask: Could someone already be here?

Security today means shrinking the space where attackers can operate – and assuming they’re clever enough to use the edges of your system against you.