PBKDF2

Look for accounts you don't recognize and check the password hash setting.

PBKDF2 for admin credentials and Fortinet says upgrade to 7.4, 7.6 or 8.0. Then review the REST API keys, which the advisory flags specifically.

Fortinet's guidance includes a setting login lockout upon weaker encryption.

to remove the old legacy password settings, so it's worth reading that thread properly.

Investigate other edge devices sharing the same credentials and keep management interfaces off the internet.

Enforce multi-factor authentication on every VPN and management login and enable PBKDF2 for administrator accounts.

And finally, the secure by design lesson.

Two design decisions did the damage.

Applying it should cost little more than an afternoon per device.

Restrict administration to an allow list.

Switch on PBKDF2.

Rotate every administrator password.

Exactly.

It hashes it again using a secure algorithm called PBKDF2.

PBKDF2, okay.

Yeah, specifically utilizing HMAC-SHA256.

And here's the kicker.

Yes.

To an auditor enforcing that rule, a salted double hashed representation is still a representation of a password residing on a server they do not physically control.

They just don't care about the thousands of PBKDF2 iterations.

attack.

And it's better than the one we support now, which is called PBKDF2.

That is not a memory-hard algorithm.

So we're bringing in this new one.

Never.

The local agent intercepts the hash, applies unique salt, and runs it through 1,000 iterations of the PBKDF2 key derivation function.

1,000 iterations.

That's heavy.

Very

heavy.

The computational expense of 1,000 PBKDF2 iterations provides massive cryptographic resistance against brute force attacks, even if the TLS tunnel were somehow compromised.

So the plaintext password never leaves the on-premises network.