SonicWall suggests people unplug their end-of-life gateways under 'active attack' by ransomware crims SonicWall has warned that its older Secure Mobile Access (SMA) 100 series and Secure Remote Access (SRA) gateways are being attacked in the wild by crooks to spread ransomware – and as some of those devices are end-of-life, don't expect any patches to protect them. In an emergency alert on Wednesday, the networking biz said …
They see it as a marketing opportunity for new stuff. Customers will simply look at the attitude of not protecting their business and go elsewhere.
Bad plan SonicWall.
The right thing to do is to go the extra mile and patch the problem so that customers think hey, they helped us, perhaps we should consider them for our next purchases.
What? They are offering a free workaround until the customers can sort out a supported solution - either from SonicWall or from somewhere else.
At least they are a) informing their customers and b) offering them a virtual solution to replace old kit that is out of support.
I don't know what more they could do? If the kit is so old that it can't be upgraded (and in one case for over half a decade), why are the devices even still in use?
We are talking about front-line security here, not an ancient CNC machine on the production line that can be isolated from the network, once it is out of support.
@big_D
The free option is a trojan horse - with the hope of the longer sale.
Half a decade is also known as 5 years, its very common for people to keep kit for 4 years minimum. The throw away culture needs to stop. The standard EU expectation is that products last for 7 years.
Precisely for the reason you indicated - perimeter security is exactly why the vendors need to stand by their products and ensure that they work for a long period of time. Other vendors manage it quite easily, so can SonicWall.
The kit was end of support in 2015. That meant, it had been supported for however many years and was then end of lifed in 2015, so probably a few years after it went out of production.
They didn't stop selling it in 2015, they stopped selling support and providing updates in 2015, so I'm guessing the kit is at least 8 to 10 years old.
And, at the end of the day, of course they are hoping that the customers will accept the goodwill gesture and buy new equipment from them, but they won't not give it to them or suddenly give them an invoice, if they go elsewhere.
And, if the customers are unhappy with the length of time the kit is supported, they should absolutely go elsewhere and look for kit with better support. But, if it is on the Internet (and doubly so, if it is providing your security perimeter), it needs to be in support and regularly patched! If it isn't in support and it isn't patched, you might as well stick up a sign saying "Fire Sale!" or "all you can eat buffett."
Every product has an end of life, especially in security, where ever more horsepower is required to cope with actual threats.
It is annoying that the kit gets too slow and under-powered to keep up, but that has been the IT way for over 40 years.
The question is, if people know the device that is keeping their network safe hasn't, itself, been safe for over half a decade, why is it still even online?
It is a pain, but a fact of life, that threats keep improving and the security hardware has to constantly play catch-up. I don't like it, but I have to keep my company protected, so I have to calculate in the regular maintenance and replacement of security kit...
Why was it EOL'ed? Was it because:
1) It is no longer capable of doing the job;
2) The manufacturer didn't want to keep supporting it.
Either way, they should be required to fix security vulnerabilities (a.k.a "defects") in products that are EOL where it can reasonably be expected that a significant number are still in service. We need to stop the creation of scrap when it can reasonably be prevented.
Jesus people. All this bashing of SonicWall when these things went EOL *7 Years* ago!
When I have bought things I do not remember seeing something that says "This will EOL in 2022", or similar. But the EOL date is becoming increasingly important.
Maybe the EOL date should be mandated to be big and obvious on the box & web site.
If you read the article it specified the unpatched firmware version (8x) that is no longer supported. To quote SonicWall, "The exploitation targets a known vulnerability that has been patched in newer versions of firmware."
If you had the budget to care about security, you would have already installed the the free firmware updates to version 9x and then to version 10x and you wouldn't be in this mess.
It's not a "marketing opportunity" or "planned obsolescence". It's a red flag that security is not an install and forget business.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
