Threat video1:00
ForgeRock OpenIDM Felix Console Takeover: Detection & IOCs
Default admin:admin on the Felix console gives RCE on ForgeRock OpenIDM servers. 9 detection rules, 5 IOCs and a free Splunk SPL rule.
Read the full threat intel for ForgeRock OpenIDM Felix Console Takeover: Detection & IOCs →
Chapters
- 0:00The hookFixed in about 2 hours.
- 0:04The storyResearchers reproduced default logins.
- 0:10Attack pathResearchers reproduced the email-validation chain.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:30Indicators of compromise2 indicators to hunt: 2 file names.
- 0:35MITRE ATT&CK techniques8 ATT&CK techniques, from initial access to lateral movement.
- 0:40Remediation4 steps now: Inventory ForgeRock/PingIDM/OpenIDM deployments and check whether /system/console is reachable.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fixed in about 2 hours.
0:05Researchers reproduced default logins.
0:07Two automakers patched it.
0:10Researchers reproduced the email-validation chain.
0:13Path-normalization slipped the firewall.
0:16Default logins opened the console.
0:18Remote code ran on identity servers.
0:21Vehicle APIs accepted the tokens.
0:26No threat actor: this was defensive research.
0:302 indicators to hunt: 2 file names.
0:358 ATT&CK techniques, from initial access to lateral movement.
0:404 steps now: Inventory ForgeRock/PingIDM/OpenIDM deployments and check whether /system/console is reachable.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.