Determine if FortiOS (OS) is compromised

[AEK]

Hi FGT admins

Can FortiOS be compromised? I mean like any other OS by an attacker or a malware.

Have there been any known cases?

Is there any method to check if my FortiOS is compromised?

Does FortiOS checks itself for possible compromise?

Note: here I'm talking about FortiOS itself, not about FortiGate configuration.

[Dhruvin_patel · Accepted solution]

Greetings!

To check if your FortiOS is compromised, you can periodically perform a hash check on FortiGate files using the command "diagnose sys filesystem hash" to compare hash differences and determine if any files have been tampered with.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practice-Periodically-do-FortiGate-fi...

Regards!

[dingjerry_FTNT]

Hi @AEK ,

FortiOs is Linux kernel-based.  You may check the Linux OS info first.

[AEK]

Hi Jerry

Yes it is Linux based.

Actually when I was Unix/Linux admin I had the opportunity to see few Unix and Linux systems that were compromised by rootkits, viruses, trojans and other malware types.

Thant's why I'm asking the above questions about FortiOS. Are there any known cases in FortiOS history? Does FOS check itself for compromise? Is there a procedure to check if my FortiOS is compromised (since it doesn't have a Linux like shell, like bash, sh, ksh, ...)?

[Dhruvin_patel · Accepted solution]

Greetings!

To check if your FortiOS is compromised, you can periodically perform a hash check on FortiGate files using the command "diagnose sys filesystem hash" to compare hash differences and determine if any files have been tampered with.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practice-Periodically-do-FortiGate-fi...

Regards!

[AEK]

Thanks to both.

It seems "diagnose sys filesystem hash" is some of what I'm looking for.

[FortiJ]

Hi, you can ask Fortinet to check if you have some doubt. These are two guides to open a ticket for Integrity verification:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Collect-Indicators-of-Compromise-IoC-debug...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Best-practice-Periodically-do-FortiGate-fi...

Regards.

[Carl_Windsor_FTNT · Accepted solution]

FortiOS takes multiple steps to check its integrity including BIOS controlled upgrade and boot-time firmware integrity checking:

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/249947/bios-level-signature-...

This is set in the BIOS and has 3 levels:

0 - Do not check

1 - Validate with the Fortinet Cert

2 - Validate with the Fortinet and Public CA Cert (Default)

Recent systems have a dip switch to prevent this setting from being modified unless you have physical access to the device

On recent systems containing the SP5 ASIC we also added this firmware integrity checking into hardware:

https://www.fortinet.com/corporate/about-us/newsroom/press-releases/2023/fortinet-unveils-new-asic-a...

Post boot we also support real-time filesystem integrity checking whereby the files are validated for integrity on every execution and the execution of unknown files is blocked.

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/226732/real-time-file-system...

Any failure of file integrity will trigger a device reboot to a known good state with he following log (others are possible depending on what failed).

fos_ima: fos_process_appraise 110: Executable File(/bin/node) doesn't match previous hash, it has been changed
Restarting system.

[AEK]

Hi Carl

I appreciate your explanation.

This is definitely the answer I was looking for.

(And I notice it was introduced in 7.4.x)

[AEK]

@Carl_Windsor_FTNT 

One last question please, from my curiosity and so I can sleep peacefully..

Do you know if there have been any reported cases in Fortinet history where the FortiOS system has been compromised that way?