F5 BIG-IP Breach: Nation-State Threat Unleashed

Application security giant F5 disclosed a data breach this week in which a nation-state threat actor gained persistent, long-term access to the company’s product development environment and engineering knowledge management platforms for its flagship BIG-IP application delivery and security products, before exfiltrating data.

The company disclosed the breach in a post on its customer-focused MyF5 website on Oct. 15. F5 said it learned in August that “a highly sophisticated nation-state threat actor maintained long-term, persistent access to, and downloaded files from, certain F5 systems.” 

The unnamed threat actor exfiltrated files containing some BIG-IP source code as well as information regarding undisclosed vulnerabilities it was currently mitigating. The company did not describe the content of said vulnerabilities, only adding in the disclosure post that “we have no knowledge of undisclosed critical or remote code vulnerabilities, and we are not aware of active exploitation of any undisclosed F5 vulnerabilities.”

Regarding its knowledge management platform, some exfiltrated files contained configuration and implementation information for a “small percentage” of customers, it said. F5 is reviewing the files and contacting customers directly “as appropriate.”

Related:Harvard University Breached in Oracle Zero-Day Attack

As for what the threat actor did not get access to, F5 has not found evidence of access to or exfiltration of data tied to its CRM, financial, support case management, or iHealth systems, nor the NGINX source code or product development environment. 

In addition, F5 has identified no evidence of modification to its software supply chain, including source code, build pipeline, and release pipeline; and it included letters of attestation from NCC Group and IOActive to support the claim. 

Risk Remains for Potential Data Breach Security Fallout

Although customer impact seems limited for now, any long-term, persistent threat activity from a sophisticated nation-state actor constitutes a worst-case scenario for an organization.

As F5 said, there is no evidence of follow-on or supply-chain activity resulting from this attack. But concerns remain that vulnerability and source code data stolen today could be utilized in other attacks tomorrow, warns Will Baxter, field chief information security officer (CISO) at Team Cymru.

“This is similar to the SolarWinds attack as the actors will use the exfiltrated source code and configs to exploit customers in future campaigns,” Baxter says. “This is likely just the beginning of what we will see in terms of a long-term persistent attack at F5, or more likely against F5 devices across customer environments.”

Related:Critical infrastructure CISOs Can’t Ignore ‘Back-Office Clutter’ Data

Regarding possible motives behind the attack, David Lindner, CISO of application security vendor Contrast Security, tells Dark Reading that the threat actor’s reason for long-term persistence was more likely for spying purposes than stealing files that it could sell. The identity of the threat actor behind the attack remains unclear, though some have pointed to China as a possible culprit, based on previous targeting of F5 appliances.

“Their goal likely wasn’t to break things at F5 but to gather intelligence for some future plan. By stealing source code from the BIG-IP development team, they essentially grabbed the architectural blueprints for a technology that governments and huge companies rely on globally,” he says. “This information is gold for them. They can use it to find undiscovered flaws to use in a later attack, or even map out a major supply chain compromise. This also explains why they were so quiet.”

What F5 Customers Can Do About the Data Breach

In the wake of the breach, F5 said it has worked with multiple incident response firms as well as law enforcement to mitigate the event, and that based on extensive action taken, it believes it has contained the threat posed by the nation-state actor. It also shared an 8-K filing with investors. 

Related:Feds Shutter ShinyHunters Salesforce Extortion Site

Beyond basic remediation, F5 said it rotated credentials and strengthened its access controls across systems, deployed improved inventory and patch management automation, integrated better monitoring and detection tools, implemented enhancements to network security infrastructure, hardened its product development environment, and more. 

“Your trust matters. We know it is earned every day, especially when things go wrong,” the company said in its blog posting. “We truly regret that this incident occurred and the risk it may create for you. We are committed to learning from this incident and sharing those lessons with the broader security community.”

F5 advises that customers apply the latest BIG-IP updates. It also shared various guidance for hardening customers’ systems. 

On Oct. 15, CISA directed federal civilian executive branch (FCEB) agencies to inventory F5 BIG-IP products and apply updates where necessary. 

Some questions about the breach still remain, including how the threat actor managed to get into F5 systems in the first place, and how the company finally caught on to the compromise. Dark Reading asked F5 how it detected the threat actor, but a spokesperson declined to comment beyond the initial disclosure post.