John TimaeusMar 10

Maybe giving an external firewall an Active Directory service account wasn't such a brilliant idea after all.

https://thehackernews.com/2026/03/fortigate-devices-exploited-to-breach.html

FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials

Attackers exploit FortiGate vulnerabilities to steal LDAP credentials and breach networks, enabling AD access and malware deployment.

The Hacker News
Show threadfuzzyfuzzyfungusMar 10
@johntimaeus Any bets on 'badly overprivileged service account" vs. "look who didn't adjust ms-ds-MachineAccountQuota from its alarming default"?
Show threadJohn Timaeus

@fuzzyfuzzyfungus

Por que no los dos?

Mar 10 at 8:44pmWeb
Show threadfuzzyfuzzyfungusMar 10

@johntimaeus Can't really argue with that.

There are cases where you want the firewall to treat different people differently, which makes a case for AD access; but if the thing is joining workstations you've clearly erred one way or another.

Show threadJohn TimaeusMar 10

@fuzzyfuzzyfungus

I haven't done AD design in a while, but this is a case where I'd consider limiting all LDAP traffic from the firewall to Read Only DCs. After I'd walked the permissions set on the service account twice.

Show threadfuzzyfuzzyfungusMar 10
@johntimaeus We award the head->desk of diligence to anyone who implements this precaution by using rules on the fortinet to block the fortinet's access to non-RO DCs. For when you want to miss the point; but none of the steps.
Show threadJohn TimaeusMar 10

@fuzzyfuzzyfungus

Look no further than the ICS/OT world, where all the network segmentation and firewalling is done on a single edge-facing combined VPN/firewall.