Skip to main content
AEK
SuperUser
AEK
SuperUser
February 2, 2025
Solved

Determine if FortiOS (OS) is compromised

  • February 2, 2025
  • 6 replies
  • 5357 views

Hi FGT admins

Can FortiOS be compromised? I mean like any other OS by an attacker or a malware.

Have there been any known cases?

Is there any method to check if my FortiOS is compromised?

Does FortiOS checks itself for possible compromise?

Note: here I'm talking about FortiOS itself, not about FortiGate configuration.

Best answer by Dhruvin_patel

Greetings!

 

To check if your FortiOS is compromised, you can periodically perform a hash check on FortiGate files using the command "diagnose sys filesystem hash" to compare hash differences and determine if any files have been tampered with.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practice-Periodically-do-FortiGate-files/ta-p/322502

 

Regards!

6 replies

dingjerry_FTNT
Staff
dingjerry_FTNT
Staff
February 2, 2025

Hi @AEK ,

 

FortiOs is Linux kernel-based.  You may check the Linux OS info first.

AEK
SuperUser
AEKAuthor
SuperUser
February 2, 2025

Hi Jerry

Yes it is Linux based.

Actually when I was Unix/Linux admin I had the opportunity to see few Unix and Linux systems that were compromised by rootkits, viruses, trojans and other malware types.

Thant's why I'm asking the above questions about FortiOS. Are there any known cases in FortiOS history? Does FOS check itself for compromise? Is there a procedure to check if my FortiOS is compromised (since it doesn't have a Linux like shell, like bash, sh, ksh, ...)?

AEK
Dhruvin_patel
Staff
Dhruvin_patelAnswer
Staff
February 2, 2025

Greetings!

 

To check if your FortiOS is compromised, you can periodically perform a hash check on FortiGate files using the command "diagnose sys filesystem hash" to compare hash differences and determine if any files have been tampered with.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practice-Periodically-do-FortiGate-files/ta-p/322502

 

Regards!

    AEK
    SuperUser
    AEKAuthor
    SuperUser
    February 2, 2025

    Thanks to both.

    It seems "diagnose sys filesystem hash" is some of what I'm looking for.

    AEK
    FortiJ
    FortiJ
    New Member
    February 6, 2025

    Hi, you can ask Fortinet to check if you have some doubt. These are two guides to open a ticket for Integrity verification:

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Collect-Indicators-of-Compromise-IoC-debugs-on-a/ta-p/330629

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practice-Periodically-do-FortiGate-files/ta-p/322502

    Regards.

    Carl_Windsor_FTNT
    Staff
    Carl_Windsor_FTNT
    Staff
    February 11, 2025

    FortiOS takes multiple steps to check its integrity including BIOS controlled upgrade and boot-time firmware integrity checking:

    https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/249947/bios-level-signature-and-file-integrity-checking

     

    This is set in the BIOS and has 3 levels:

    0 - Do not check

    1 - Validate with the Fortinet Cert

    2 - Validate with the Fortinet and Public CA Cert (Default)

     

    Recent systems have a dip switch to prevent this setting from being modified unless you have physical access to the device

     

    On recent systems containing the SP5 ASIC we also added this firmware integrity checking into hardware:

    https://www.fortinet.com/corporate/about-us/newsroom/press-releases/2023/fortinet-unveils-new-asic-accelerate-networking-security-convergence-across-network-edges

     

    Post boot we also support real-time filesystem integrity checking whereby the files are validated for integrity on every execution and the execution of unknown files is blocked.

    https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/226732/real-time-file-system-integrity-checking

     

    Any failure of file integrity will trigger a device reboot to a known good state with he following log (others are possible depending on what failed).

     

    fos_ima: fos_process_appraise 110: Executable File(/bin/node) doesn't match previous hash, it has been changed Restarting system.

     

      AEK
      SuperUser
      AEKAuthor
      SuperUser
      February 11, 2025

      Hi Carl

      I appreciate your explanation.

      This is definitely the answer I was looking for.

      (And I notice it was introduced in 7.4.x)

      AEK
      AEK
      SuperUser
      AEKAuthor
      SuperUser
      February 12, 2025

      @Carl_Windsor_FTNT 

      One last question please, from my curiosity and so I can sleep peacefully..

      Do you know if there have been any reported cases in Fortinet history where the FortiOS system has been compromised that way?

      AEK
      Terms & ConditionsAccessibility statement