Extortion group leaks keys to bank vendor’s Fed firewall
- Key insight: An extortion group published not only system keys and credentials but also a map of how Finzly’s firewall connects to other systems.
- What’s at stake: Finzly’s 11 listed bank and credit union clients share a single connection to ACH, Fedwire and FedNow, and the leaked files describe a direct link to the Fed with rules for FedNow and FedACH traffic.
Overview bullets generated by AI with editorial review.
Processing Content
This week, a cyber extortion group, n0n, published the passwords and keys to a firewall that guards the link that Finzly’s bank clients use to send payment instructions to the Federal Reserve. The group also published details about how the firewall is set up and how it connects to other systems.
Finzly, a company that connects banks to payment networks, says the leaked files can’t get anyone into its systems. The company has “rotated system keys and credentials,” a company spokesperson told American Banker.
Regardless of changing the passwords, “the possession of the compromised configuration information alone does not provide access to our systems or data,” the spokesperson said.
Federal Reserve payment services “were not impacted,” a Fed spokesperson said.
Finzly sells
Finzly’s investigation so far shows “no evidence that customer data or access information related to our banking customers’ systems was compromised,” the spokesperson said. “At no point were Finzly’s customer operations impacted.”
Finzly has notified law enforcement, hired outside legal and forensic experts and begun communicating with customers, the spokesperson said. “We continue to work closely with regulators and our customers,” they said.
American Banker reviewed the publicly available files; they do not contain customer data, bank data or transaction records. American Banker did not test whether the leaked keys or passwords work.
Annotations in the files call the configuration the “2023 config,” suggesting it dates to that year.
N0n
N0n’s listing did not say how much it wanted from Finzly. The group’s listings of South Korean companies demanded between $600,000 and $14 million in bitcoin, according to
How it went down
It is unclear exactly how n0n obtained the passwords and keys.
The Finzly spokesperson said only that the company determined that “an unauthorized third party accessed a single device in our backup data center containing configuration information.”
The statement did not say whether that device was the firewall, when the access happened or how the intruder got in.
Five of the six files n0n posted this week appear to make up the configuration of a Fortinet FortiGate firewall, which is a device that sits between a company’s systems and the outside world and controls what traffic passes between them.
The sixth file contains a summary of the configuration and calls the firewall a “payment gateway.”
The files describe a direct link labeled “FED” and firewall rules labeled for FedNow and FedACH traffic.
Firewalls normally store passwords and keys in scrambled, encrypted form. The summary file says the ones in this configuration were decrypted on Oct. 15.
Fortinet (like other firewall makers) has protected such secrets with hard-coded or weak encryption keys in the past; Fortinet
As such, it is “absolutely plausible” that n0n got the keys by decrypting the configuration, according to Michael Tigges, a principal tactical response analyst at the cybersecurity firm Huntress.
What could have happened
By Finzly’s account, the files n0n leaked no longer offer a way into its systems, but the episode could have gone much worse had the group used the passwords and keys to get in.
In the worst case, a leaked firewall configuration “can lead to total domain compromise,” or an attacker’s control of an entire network, according to Tigges.
It also could have led to the theft of data such as account numbers and financial transactions, and “potentially ransomware,” he said.
It is unclear whether n0n tried to use the passwords and keys for any of these purposes before turning to extortion.
It is also unclear whether Finzly detected n0n’s access to the keys before the group started extorting the company, or whether it was n0n’s extortion that tipped the company off that something was awry.
Finzly has not said when it changed the keys, so it is unclear whether it did so before or after the group obtained or published them.
What changing the keys doesn’t fix
An old firewall configuration still holds information about what connections a network trusts, even if the passwords have changed, according to Rafe Pilling, senior director of threat research at Sophos, a security company that also sells firewalls.
In this case, the configuration offers a map of the tunnels to Finzly’s cloud systems and its direct link to the Fed. That map can show an attacker which systems talk to which and where to aim on the way to the one it wants to access.
Changing passwords doesn’t change those connections, so a map of them still saves an attacker much of the work of scouting a target, Pilling told American Banker.
“Network layouts, IP addresses, tunnel endpoints, and trust relationships change far more slowly than passwords,” Waseem Ahmed, head of engineering at the security firm Secure.com, told American Banker.
In other words, Finzly can change the locks on its own systems quickly, but redrawing the map attackers now hold (by changing how the systems connect to each other) would take far longer.
What banks should do
A bank whose vendor’s firewall configuration has leaked should first ask the vendor one thing, according to Denis Calderone, chief technology officer at the security firm Suzu Labs: “Have you rotated every credential and key in that file, and can you show me?”
He would also ask whether the vendor told the Fed.
A bank should also list every connection it has to the vendor, change every credential it controls and agree on new VPN keys with the vendor “rather than waiting to be told,” Ahmed said.
Finally, banks should check their logs for unusual connections from the vendor’s systems “going back months, not just since the leak,” Calderone said.
