Sonicwall diag tool includes VPN credentlials

[Milton Lopez]

Our Sonicwall Pro 300 firewall appliance includes a diagnostic tool called "Tech Support Report", which dumps the current configuration info to a plain text file. I have been asked by Sonicwall personnel to email this file as an attachment during several
tech. support calls, without any additional warning or explanation. One of the items included in the report is a plain-text copy of the Shared Secret used for authenticating VPN users. Unless everything I've read about protecting this kind of information
is suddenly not true, sending unprotected shared secrets to anyone via email is very bad idea. I also doubt that tech. support personnel need this in most cases and, if they do, the customer should be notified and asked for it explicitly.

[Stephan Sachweh]

Milton Lopez <mlopez@iattc.org> wrote on 30.07.2004 23:46:07:

> Our Sonicwall Pro 300 firewall appliance includes a diagnostic tool=20
> called "Tech Support Report", which dumps the current configuration=20
> info to a plain text file. I have been asked by Sonicwall personnel=20
> to email this file as an attachment during several tech. support=20
> calls, without any additional warning or explanation.

Before downloading there is a Warning "You are about to export sensitive=20
information in plaintext format. Continue?". So the firmware tells you,=20
what you are doing.

> One of the=20
> items included in the report is a plain-text copy of the Shared=20
> Secret used for authenticating VPN users. Unless everything I've=20
> read about protecting this kind of information is suddenly not true,
> sending unprotected shared secrets to anyone via email is very bad=20
> idea.

The shared secret is not included in the standard report. You have to tag=20
"VPN Keys" before generating the report.
But sure, the Tech Support Report includes other sensitive information (IP =

networks connected, routing tables, mail addresses etc).

I would not send this report by plain mail. Normally the TechSupport=20
Report should be added to a https protected customer portal site at=20
sonicwall. I had never been asked by sonicwall tech support to send a=20
report by mail.

Freundliche Gr=FC=DFe

Stephan Sachweh
Technischer Leiter, Prokurist
--------------------------------------------------------------------
//// pallas
Pallas GmbH / Herm=FClheimer Str. 10 / 50321 Br=FChl
Stephan.Sachweh@pallas.com / www.pallas.com
Tel 02232-1896-62 / Fax 02232-1896-29 / Mobil 0173-5490754
--------------------------------------------------------------------

[Jody McCluggage]

Hello,

Yes, I have also ran into this several times with the SonicWall tech
support. They ALWAYS ask me to send the TSR, with all the options checked,
via regular email. I did not realize just how sensitive these were until I
actually read one. I immediately changed my shared secret password and had
all my VPN clients updated after that. I refuse to send these reports via
email now, but they still always ask. I now attach them to my https
mysonicwall page. I am just amazed how supposed "security professionals "
always advocate sending this report via email.

Jody

-----Original Message-----
From: Stephan Sachweh [mailto:Stephan.Sachweh@pallas.com]
Sent: Monday, August 02, 2004 3:54 AM
To: bugtraq@securityfocus.com
Cc: Milton Lopez
Subject: RE: Sonicwall diag tool includes VPN credentlials


Milton Lopez <mlopez@iattc.org> wrote on 30.07.2004 23:46:07:

> Our Sonicwall Pro 300 firewall appliance includes a diagnostic tool
> called "Tech Support Report", which dumps the current configuration
> info to a plain text file. I have been asked by Sonicwall personnel
> to email this file as an attachment during several tech. support
> calls, without any additional warning or explanation.

Before downloading there is a Warning "You are about to export sensitive
information in plaintext format. Continue?". So the firmware tells you,
what you are doing.

> One of the
> items included in the report is a plain-text copy of the Shared
> Secret used for authenticating VPN users. Unless everything I've
> read about protecting this kind of information is suddenly not true,
> sending unprotected shared secrets to anyone via email is very bad
> idea.

The shared secret is not included in the standard report. You have to tag
"VPN Keys" before generating the report.
But sure, the Tech Support Report includes other sensitive information (IP
networks connected, routing tables, mail addresses etc).

I would not send this report by plain mail. Normally the TechSupport
Report should be added to a https protected customer portal site at
sonicwall. I had never been asked by sonicwall tech support to send a
report by mail.

Freundliche Grüße

Stephan Sachweh
Technischer Leiter, Prokurist
--------------------------------------------------------------------
//// pallas
Pallas GmbH / Hermülheimer Str. 10 / 50321 Brühl
Stephan.Sachweh@pallas.com / www.pallas.com
Tel 02232-1896-62 / Fax 02232-1896-29 / Mobil 0173-5490754
--------------------------------------------------------------------

[Eric McCarty]

You are specifically told that the information included in the report
contains confidential information, if you are concerned with privacy,
zip it and add a password or use another more secure method of
transferring the file such as the TSR upload feature of mysonicwall.com,
this has been this way for years.

Eric


-----Original Message-----
From: Milton Lopez [mailto:mlopez@iattc.org]=20
Sent: Friday, July 30, 2004 2:46 PM
To: bugtraq@securityfocus.com
Subject: Sonicwall diag tool includes VPN credentlials



Our Sonicwall Pro 300 firewall appliance includes a diagnostic tool
called "Tech Support Report", which dumps the current configuration info
to a plain text file. I have been asked by Sonicwall personnel to email
this file as an attachment during several tech. support calls, without
any additional warning or explanation. One of the items included in the
report is a plain-text copy of the Shared Secret used for authenticating
VPN users. Unless everything I've read about protecting this kind of
information is suddenly not true, sending unprotected shared secrets to
anyone via email is very bad idea. I also doubt that tech. support
personnel need this in most cases and, if they do, the customer should
be notified and asked for it explicitly.

[neil gardner]

Nope, as a Sonicwall Certified Engineer I can tell you this is basically
wrong.

Yes, it does save all the important keys in Plaintext, but only if you
don't read the manual which warns about this, and only if you click ok
on the dialog box pop-up which warns you about this when you go to do
it.

The legit need for this BTW is when you have to replicate a firewall
config onto another Sonicwall box that's perhaps different architecture
and you need a human readable copy of all the keys etc.

Cheers- Neil Gardner

ps. The more interesting Sonicwall issue is that if you don't change
the default IP address of the Sonicwall (192.168.168.168) then anyone
with access to your LAN segment can change the LAN Ip address of the
Sonicwall using a publically available Sonicwall utility - even if the
box has had it's username/password changed.... If I bothered to sniff
out the transaction I would probably be able to recreate the ARP request
that does this. I reported this in person to a Senior SOnicwall tech rep
and he didn't think it was an issue. Go Figure.



>>> Milton Lopez <mlopez@iattc.org> 31/07/2004 9:46:07 a.m. >>>


Our Sonicwall Pro 300 firewall appliance includes a diagnostic tool
called "Tech Support Report", which dumps the current configuration info
to a plain text file. I have been asked by Sonicwall personnel to email
this file as an attachment during several tech. support calls, without
any additional warning or explanation. One of the items included in the
report is a plain-text copy of the Shared Secret used for authenticating
VPN users. Unless everything I've read about protecting this kind of
information

NOTICE: This message contains privileged and confidential
information intended only for the use of the addressee
named above. If you are not the intended recipient of
this message you are hereby notified that you must not
disseminate, copy or take any action in reliance on it.
If you have received this message in error please
notify Allied Telesyn Research Ltd immediately.
Any views expressed in this message are those of the
individual sender, except where the sender has the
authority to issue and specifically states them to
be the views of Allied Telesyn Research.