How was the SQL injection done? We blocked off admin login

Both the admin and USER portals were vulnerable.  Either one would be able to be used to exfiltrate the LOCAL accounts (not AD/LDAP) including users and admins.

Both the admin and USER portals were vulnerable.  Either one would be able to be used to exfiltrate the LOCAL accounts (not AD/LDAP) including users and admins.

right. so we need to reset all local vpn users? god damm.

Yep.  Most of ours were AD auth, but we had a few that used local accounts.  We reset them anyway even though the users also used MFA.  

Hi Hayden Kirk 

We sincerely regret any inconvenience this has caused.

We’ve created this KBA for our customers that provides the recommended actions to fully remediate this issue: https://community.sophos.com/kb/en-us/135412 

We will continue to update this KBA as new information becomes available.

Hi Flo,

what are the IOCs? we have one or two XGs, where the exploit was successful. Are there any more informations at the moment? In the KB for this issue are to less informations about the attack and the impacts.

Hi 4ng3er

We will soon release more details of the attack and its payloads. Please follow our https://community.sophos.com/kb/en-us/135412 for further updates. 

Appears that our XG firewall hit sophosfirewallupdate.com on April 22 twice, then April 23 four times.

After analyzing the components and intent of the attack, Sophos published a SophosLabs Uncut article, “Asnarok” Trojan targets firewalls, to share its current understanding of the malware.

I want to know if the VPN connection pre-shared keys have also been copied? If so, then the security of Sophos Connect users has also been compromised...

Hi Michal,

I've investigated how IPsec secrets (PSK) are stored in the XG firewall and found out they are stored in plain text. For more details you can contact me via PM.

According to the Sophos report the hackers exfiltrated SQL-data for VPN users & policies, but they don't exactly describe what entries, so in my opinion all secrets on the firewall are compromised.

Holy Cow ...

Passwords stored in clear text ?!?!?!?  Really !?!?!?!

But ... They write this on their KB:

1. Reset device administrator accounts
   • See: https://community.sophos.com/kb/en-us/123732
   • Sophos is enforcing a password reset for the XG administrator and all other local administrator accounts that have not reset their password since 2200 UTC on April 25, 2020.
2. Reset passwords for all local user accounts
   • See: https://community.sophos.com/kb/en-us/135419
3. Although the passwords were hashed, it is recommended that passwords are reset for any accounts where the XG credentials might have been reused.

Paul Jr