SonicWall breach hits every cloud backup customer after 5% claim goes up in smoke

SonicWall has admitted that all customers who used its cloud backup service to store firewall configuration files were affected by a cybersecurity incident first disclosed in mid-September, walking back earlier assurances that only a small fraction of users were impacted. In an updated statement published on Wednesday, the …

[ParlezVousFranglais]

Maybe a silly question but can't they just encrypt by default BEFORE sending security-critical information off to sit on a website somewhere? Have they now implemented such encryption? The files are then useless to anyone but the original owner regardless of whether SonicWall's own security and "encryption" is breached (not a great look for a security company anyway tbh...)

[Stevie]

Silly Question

Exactly what my first thought was.

[FILE_ID.DIZ]

Re: Silly Question

While I am no expert nor anything beyond a layperson - a big problem with config files like these is that the encryption has to be reversible. So, how do you do that at-scale?

A client-managed password is always a solid option. However I'm sure there's a non-zero number of SonicWall Cloud Backup users who wouldn't want to do that. Think about AWS S3 encryption-at-rest. I wonder what portion of companies use the server-managed encryption key vs using their own key?

So now the service provider has to manage the encryption key(s). KEK can be used here, but still at the end of the day, if the KEK key(s) is/are compromised, then everything encrypted by that DEK can be decrypted.

Basically it is hard to handle encryption safely at scale.

[Glennda37]

This doesn't work when you need to restore a backup to a different set of hardware in the event of hardware failure.

[ParlezVousFranglais]

Why not? If you want to use the service, you tick the box on the firewall config to say so and you provide an encryption key (if you don't keep it safe somewhere, then that's on you..) - as long as you know the encryption key used, you can retrieve the config with no problem either to the original hardware or to a replacement, and if someone hacks Sonicwall's own service, then your encrypted data is protected with a key only you know.

[razorfishsl]

I'm just waiting for MS top go completely tits up on this ......

Their "ENTRA" records the security key of every harddrive that the system connects to.

nice for the US government.... .. oh we have a "bitlocked" hard drive..... just contact MS for the keys they extricated....

now you know why they are insisting for win 11 to have a MS account..

it's so they have an ENTRA security login & a place to keep the bitlocker drive keys....

[Slow Joe Crow]

That's exactly what Sophos does with Sophos Central. When you deploy a firewall you set a master encryption key, and then a separate backup encryption password which Sophos requires you to store elsewhere. I work for an MSP so we have dozens of firewalls and we store the encryption keys in a documentation system. It seems to work fine and we can easily pull a saved configuration to apply to replacement firewalls

[nonpc]

...and the pessimist in me says that when the documention system is borked and you want to recover it from the backup, you need the encryption key which is stored in...

Analagous to the story of the key to the fireproof safe which was stored on the premises and melted in the fire.

[Anonymous Coward]

We've now got some devices reported as needing remediation. After the initial report (with the 5% claim) I even contacted Sonicwall support to confirm that our devices weren't affected (no warnings were shown in the portal) and they assured me that no, none of our devices were affected so we didn't need to do anything.

Useless tossers! Giving assurances like that when they clearly hadn't finished investigating is really not a good look for a security company.

[Anonymous Coward]

You simply weren't sufficiently paranoid. If a service provider where I have an account is hacked, the first thing i'm going to do is change my password, keys, etc, even if I have to change them again later. Only then will I decide whether to continue the relationship.

[JHD]

If they were actually taking actions out of an "abundance of caution" (a phrase I have grown to hate), the actions would have included telling users to change all saved passwords and trash the existing config backups.

"Abundance" my ass. It is PR minimization. Such statements should never be trusted.

[Rich 2]

Mind blown!!!

Why on Earth would you dump your firewall details onto some random (and apparently vulnerable) server???

Some people are just asking for it

[Anonymous Coward]

Re: Mind blown!!!

It's part of the Sonicwall management portal. If they can't keep this secure then they really are fucking useless!

[Rich 2]

Re: Mind blown!!!

I guess they’re fucking useless then

Maybe, eventually (yea, right!), people will realise that saving stuff on someone else’s computer is not compatible with any notion of security. You may as well post your security credentials up on the nearest public toilet wall

[JHD]

Re: Mind blown!!!

Toilet wall, being analog, is perhaps a nit more secure initially.

[sitta_europea]

Backups - everything that you value - in The Cloud. What a great idea.

[tip pc]

doesn't really matter where your backups are stored if they are not protected somehow.

strongly encrypted backups in the cloud should be as well protected as in your physical safe place.

if your cloud provider isn't using strong encryption & controls for your precious data then its not protected.

This is why governments mandating back doors in cloud providers is a recipe for disaster for us all.

[Gerhard den Hollander]

Remember

The cloud is just someone else's computer.

[t0m5k1]

With a Gov. sanction backdoor!

[Roland6]

In this instance the issue is Device Management and thus security configurations in the Cloud.

Remember it was only a few years back when cloud managers for network configuration were all the rage…

[Decay]

Just to be the pedant in the room, encrypting your backups will stop or slow reading the data but will not stop your encrypted backups being encrypted for ransomware. Thats not what happened here but just in case someone assumes encryption is the magic charm that fixes all evils.

End PSA

[John Brown (no body)]

every customer who had ever used the cloud backup service

Wait...what? Is that just poor wording or are there people who no longer use Sonicwall who should now be worried that their previous firewall configs are still on SonicWall servers and have now been leaked too? If so, that's even more worrying. People may change their firewall provider, but odds are their network won't change all that much so even year old data could give an attacker an extra boost.

[JamesTGrant]

I wouldn’t go to a restaurant to get my car fixed, even if the food was excellent. Quite why people think that a firewall company would make a good cloud storage provider is… odd to me.

[Anonymous Coward]

They aren't a cloud storage provider - there is a small amount of storage attached to the management portal where the config backups are stored. That's literally it! If they they are going to offer this service then they need to keep it secure. Keeping things secure is after all supposed to be their business!

[Homo.Sapien.Floridanus]

Famous Quotes

“We’re out of helium? Fill her up with hydrogen.”

“That little old iceberg is no match for this ship”

“Let’s put it in the cloud”

[Kevin McMurtrie]

Best backups

Extreme redundancy, globally distributed backups. Rest assured that your data can never be accidentally deleted.

[K555]

VPN creds

Whilst the login details are no doubt hashed in the config, will these have VPN keys / certificates for remote workers/sites that could be leveraged?

[Anonymous Coward]

And yet they'll survive and post record share prices very soon.

How are companies in business after disasters like this? Like what was their name that blue screened everyone's computers a few months ago - for some unfathomable reason they're still in business.

[Anonymous Coward]

not just in businesss.. but share price is Higher

almost 2.5 x higher... unfathomable....

what was funny is that someone registered the domain "clownstrike.com" and has it pointing to...

[Tim Kemp]

Re: not just in businesss.. but share price is Higher

[checks availability for chronicwall.com]

[razorfishsl]

The irony is that the config files are "encrypted"

the stupidity has more folds than a kilt....

1. the key is a simple XOR (takes about 2 min to crack it.)

2. the key is the SAME for EVERY firewall.

3. All the passwords for every account appear to be in plain text , not salted strongly.

not only is the config file blown wide open on SONICWALL ,but every other firewall brand you want to VPN connect to with a secret.

4. 4th level of stupidity & incompetence ,that i won't get into because it is potentially a huge security issue that is currently out in the open,

it gives an insight into just how little thought the people in charge have and is a direct result of mitigating this initial problem.