KBA 135412 - What does Compromised mean in this fix

Hi Antonvan Duin 

At this time, there is no indication that the attack accessed anything on the local networks behind any impacted XG Firewall. It appears the attack was designed to download payloads intended to exfiltrate XG Firewall-resident data.

The data for any specific firewall depends upon the specific configuration and may include usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access.

Passwords associated with external authentication systems such as AD or LDAP are unaffected. We are continuing to investigate and expect to release more details of the attack.  Please follow https://community.sophos.com/kb/en-us/135412 for further updates.

Hi Antonvan Duin 

At this time, there is no indication that the attack accessed anything on the local networks behind any impacted XG Firewall. It appears the attack was designed to download payloads intended to exfiltrate XG Firewall-resident data.

The data for any specific firewall depends upon the specific configuration and may include usernames and hashed passwords for the local device admin(s), portal admins, and user accounts used for remote access.

Passwords associated with external authentication systems such as AD or LDAP are unaffected. We are continuing to investigate and expect to release more details of the attack.  Please follow https://community.sophos.com/kb/en-us/135412 for further updates.

Hi Keyur,

I understand that, but what makes the hotfix decide if a XF is compromised, or not-compromised (the message on the dashboard of the XG). Is this because the Admin Access and / or User Portal was allowed on the WAN interface(s) or did Sophos investigate on the XG appliance and found evidence that the vulnerability was exploided?

Hi Antonvan Duin 

Thanks for reaching out to us! More information on this shall be made available on the following KBA: https://community.sophos.com/kb/en-us/135412. We really appreciate your patience and cooperation. 

Does anybody know, how to get rid of the Message? I changed my PWs, rebooted Firewall and disabled UserPortal Access (Which ran on a non-standard port, but was compromised anyways), but the ErrorMessage remains.

Christian Huber3 said:

Does anybody know, how to get rid of the Message? I changed my PWs, rebooted Firewall and disabled UserPortal Access (Which ran on a non-standard port, but was compromised anyways), but the ErrorMessage remains.

 

The KB article below states that the message will not go away even after you restart. Don't know why but i guess thats what Sophos has decided

https://community.sophos.com/kb/en-us/135412