Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

F5 says hackers stole undisclosed BIG-IP flaws, source code

bleepingcomputer.com

Post reply on HN
Print view View original

41–50 of 109 posts

Re: F5 says hackers stole undisclosed BIG-IP flaws, source code

#41

Post by tru3_power »

bangaladore wrote: post #10
tru3_power wrote: post #2

“No one will ever find these vulns without source access! Fix deferred” oh wait…

Yeah, I was trying to make sense of what was described here. Is it that (through some mechanism) an actor gained access to F5's sytems, and literally found undisclosed vulnerabilities documented within F5's source control / documentation that affects F5's products? If so, lol.

Yeah that’s what I’m understanding is the case. That’s why they’re harping on no known (unreleased) vulns. But it’s kinda funny, a lot of times bugs that fall under this category are constantly shuffled around/not fixed because there is no public pressure to address them.

Re: F5 says hackers stole undisclosed BIG-IP flaws, source code

#42

Post by bangaladore »

Veserv wrote: post #30
bangaladore wrote: post #20

Earlier quoted context omitted.

Not sure why I'm downvoted. Literally quoted from their incident page. > We have confirmed that the threat actor exfiltrated files from our BIG-IP product development environment and engineering knowledge management platforms. These files contained some of our BIG-IP source code and information about undisclosed vulnerabilities we were working on in BIG-IP. > We have no knowledge of undisclosed critical or remote cod…

No, they claimed: "We have no knowledge " and "we are not aware " which does not mean "the vulnerabilities discovered through exfiltration were not used ". That admits nearly every possible class of outcome as long they did not actively already know about it and chose to say they did not. The specific words that their lawyers intentionally drafted explicitly even allow them to intentionally spend effort to destroy an…

Fair point, I certainly missed a word in my summary.

Re: F5 says hackers stole undisclosed BIG-IP flaws, source code

#43

Post by weeha »

Looks like they rotated all signings keys a day earlier:

https://my.f5.com/manage/s/article/K000157005

In October 2025, F5 rotated its signing certificates and keys used to cryptographically sign F5-produced digital objects.

As a result:

    BIG-IP and BIG-IQ TMOS product versions released in October 2025 and later are signed with new certificates and keys
    BIG-IP and BIG-IQ TMOS product versions released in October 2025 and later contain new public keys used to verify certain F5-produced objects released in October 2025 and later
    BIG-IP and BIG-IQ TMOS product versions released in October 2025 and later may not be able to verify certain F5-produced objects released prior to October 2025
    BIG-IP and BIG-IQ TMOS product versions released prior to October 2025 may not be able to verify certain F5-produced objects released in October 2025 and later

Re: F5 says hackers stole undisclosed BIG-IP flaws, source code

#45

Post by toast0 »

vel0city wrote: post #16
scotho3 wrote: post #8

Earlier quoted context omitted.

BIG-IP runs DPI (not as good as Sandvine Active Logic), but it's an authoritarian states best friend. Want to compromise another nation state that runs all their traffic through it? These vulns aren't a bad place to start...

This is why I don't understand this strong desire for security auditors to have centralized TLS decryption be important to having some high security stance. You're just creating a massive single point of failure and potentially massively weakening encryption.

> You're just creating a massive single point of failure and potentially massively weakening encryption.

It need not be a single point of failure. You can set these things up with redundancy. There's certainly an element of adding risk, your interception box is a big target to do unauthorized interception or tampering; but there's also an element of reducing risk --- you'd be potentially able to see and respond to traffic that would be opaque otherwise.

Re: F5 says hackers stole undisclosed BIG-IP flaws, source code

#46

Post by vel0city »

toast0 wrote: post #45
vel0city wrote: post #16

Earlier quoted context omitted.

This is why I don't understand this strong desire for security auditors to have centralized TLS decryption be important to having some high security stance. You're just creating a massive single point of failure and potentially massively weakening encryption.

> You're just creating a massive single point of failure and potentially massively weakening encryption. It need not be a single point of failure. You can set these things up with redundancy. There's certainly an element of adding risk, your interception box is a big target to do unauthorized interception or tampering; but there's also an element of reducing risk --- you'd be potentially able to see and respond to tr…

> You can set these things up with redundancy

Yes, so instead of one box with the keys to decrypt all the traffic flowing through the network I'll have multiple boxes that have the ability to decrypt all the traffic. Multiple machines to update and secure and guard against those getting attacked or else everything gets broken.

Re: F5 says hackers stole undisclosed BIG-IP flaws, source code

#48

Post by vel0city »

palmotea wrote: post #28
vel0city wrote: post #16

Earlier quoted context omitted.

This is why I don't understand this strong desire for security auditors to have centralized TLS decryption be important to having some high security stance. You're just creating a massive single point of failure and potentially massively weakening encryption.

It seems like its a place were there are some serious tradeoffs. You can choose to have visibility into your network traffic or can choose not to. If you choose yes, you create a single point of failure but have the ability to detect breaches elsewhere; if you choose no, you avoid the single point of failure but make it easier for an attacker to exfiltrate data undetected.

I'm down for endpoints having to report whatever metrics to whatever servers and have their transactions highly audited. I'm down for their connectivity to be highly locked down. It's important to know what's happening on your systems and where data is flowing, I agree!

But in the end of I want Alice to talk to Bob and know they and only them are talking I'd like to guarantee that. Instead companies are spending tons of money and work hours doing Eve's work for her, installing her tools and getting it all nicely configured for when she logs in.

How many times do we have to backdoor our crypto systems to realize we're not building doors for just us but for everyone else as well?

Re: F5 says hackers stole undisclosed BIG-IP flaws, source code

#49

Post by shakna »

fn-mote wrote: post #17
navidr1 wrote: post #6

cisa just released: ED 26-01: Mitigate Vulnerabilities in F5 Devices. https://www.cisa.gov/news-events/directives/ed-26-01-mitigat...

This report seems empty of useful information. It’s just “contact us under these circumstances”. Is it just me?

It reads more like, "find, update, and prepare to decommission all of these products" to me.

Re: F5 says hackers stole undisclosed BIG-IP flaws, source code

#50

Post by mpyne »

scotho3 wrote: post #8
sevg wrote: post #3

I wonder if they’re just saying “nation-state” to make it seem less bad that they were compromised, without having proof that it was an actual nation state. (I mean it could well be a nation state, but just a thought.)

BIG-IP runs DPI (not as good as Sandvine Active Logic), but it's an authoritarian states best friend. Want to compromise another nation state that runs all their traffic through it? These vulns aren't a bad place to start...

Perhaps more importantly to a non-U.S. nations is that there are a lot of military networks that touch the public Internet whose security from outside attack is more or less premised on F5's implementation of mutual TLS to CACs.

Finding a way to subvert that authentication or, better yet, bypass it entirely, could put U.S. military networks that can be reached over the public Internet at risk of remote exploitation. Those networks can often also reach other military networks not directly exposed to the public Internet.

Post reply on HN