NIFCLOUD and FJcloud-V: its load balancers were accessed without authorization and customer credentials may have been stolen

1. 2022-05-04

   The maker of the load balancers published a vulnerability. [1]

2. 2022-05-07

   From about 15:13, traces of access apparently exploiting the published vulnerability were left. [1]

3. 2022-05-11

   It began countermeasures. [1]

4. 2022-05-16

   It announced the case. [1]

5. 2022-06-29

   It published an overview and measures to prevent recurrence. It corrected the period with traces of unauthorized access to May 7 to 11. Forensics found that arbitrary commands could be run inside the load balancers, that there were traces of a file compressing certificate data, and that traffic information had been collected at some points (no credentials or personal data were found in it). No misuse of the information was confirmed. [2]

Technically, access data for the control panel and API, traffic passing through the load balancers, and certificate data registered by customers may have been stolen. At the time of the announcement there was no sign of intrusion into the cloud interior or exfiltration. Part of the layered defenses was also misconfigured. [1]

The partial misconfiguration of the layered defense came from flaws in the access control settings of the internet-facing network devices, made while the load balancers were replaced. To prevent recurrence it will run penetration audits to find misconfigurations and speed up vulnerability response and detection of unauthorized access. It also reported to the ISMAP operation support body. [2]