Summary

  • Ivanti's own knowledge-base article states that its Integrity Checker Tool is a snapshot of the current state and cannot necessarily detect threat actor activity once an appliance has been returned to a clean state, and it recommends a factory reset before patching.
  • The joint advisory AA24-060B goes further: threat actors can deceive both the internal and external tool, and CISA lab research found root-level persistence possible despite factory resets.

The first concession is written as an escalation inside the vendor's own guidance. "We have seen evidence of threat actors attempting to manipulate Ivanti's internal integrity checker (ICT). Out of an abundance of caution, we are recommending that all customers run the external ICT." That is Ivanti telling customers that the checker shipped inside the appliance had become a target, and that a second, external checker was now the safer instrument (Ivanti knowledge-base article).

The second concession is sharper, because it describes what the instrument cannot do rather than what an adversary might do to it. "The ICT is a snapshot of the current state of the appliance and cannot necessarily detect threat actor activity if they have returned the appliance to a clean state." A snapshot of the present cannot testify about a past that has been tidied up. Anyone who has read a scan result as a statement about history rather than about the moment of scanning has misread the tool, and the vendor says so in plain language.

The third is the one that should have ended a procurement argument. "Ivanti recommends as a best practice that all customers with a hardware appliance factory reset their appliance before applying the patch to prevent the threat actor from gaining upgrade persistence in your environment." A vendor does not ask its customers to wipe hardware before patching when it believes a patch plus a check is sufficient. Reset-before-patch is what you prescribe when you suspect the machine has been altered at a level the check cannot see.

The joint advisory says the same thing from the other side of the table, and says it harder. "Of particular concern, the authoring organizations and industry partners have determined that cyber threat actors are able to deceive Ivanti's internal and external Integrity Checker Tool (ICT), resulting in a failure to detect compromise." Note the scope: internal and external. The upgrade the vendor offered in its own article is inside the sentence the authoring organizations wrote about deception (joint cybersecurity advisory AA24-060B).

Then the finding that closes the loop. "In addition, CISA has conducted independent research in a lab environment validating that the Ivanti ICT is not sufficient to detect compromise and that a cyber threat actor may be able to gain root-level persistence despite issuing factory resets." The same advisory carries both halves of the contradiction: a vendor best practice built on factory resets, and agency lab research reporting that root-level persistence can survive them.

This is not a dispute between a critic and a company. It is a disagreement between two parties who both wanted the same remediation to work. Ivanti's interest was to keep customers on its gateways and get them patched without demanding a rebuild of every appliance. The authoring organizations' interest was to stop an intrusion campaign. They converged on the same admission, that a negative result from on-appliance tooling is not evidence of an uncompromised appliance, and then diverged on whether the reset Ivanti recommends is itself durable.

That divergence is the usable part. A factory reset is an assertion that the state of the machine has been replaced. Lab research finding persistence despite resets is a direct challenge to that assertion, and it does not depend on the vendor being dishonest, only on the reset not reaching the stratum where the actor sits. A customer who treats reset-before-patch as the end of the matter inherits an assumption that a co-authoring agency has publicly declined to share.

The dated instruments make the environment in which that assumption was made. Emergency Directive 24-01, titled "Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities", was issued on Friday, 19 January 2024, according to the General Services Administration's FedRAMP archive of the directive announcement; that archive page displays a heading dated 18 January 2024 while its body states 19 January 2024, and this briefing uses the body statement (FedRAMP archive, ED 24-01). Supplemental Direction v1 followed on Wednesday, 31 January 2024, and the same archive states that the supplemental direction superseded required action 4 of the directive (FedRAMP archive, Supplemental Direction v1).

Required action 4 was replaced within twelve days of the directive being issued. The directive and the supplemental direction are published by CISA at their own addresses (ED 24-01, Supplemental Direction v1), but their operative text was not readable in the sources consulted for this briefing: both CISA pages returned access errors to the retrieval used here. This article therefore makes no claim about what those instruments ordered, or about which action the supplemental direction replaced beyond the archive's own statement that number four was superseded. What it does claim is that the substitution happened, and that the two first-party documents quoted above explain better than any directive summary why a verification step can fail its own purpose.

For a board or a procurement team, the operational consequence is narrow and it survives the unread directive text. Do not demand that a supplier's scan be correct; the vendor has already told you what it cannot see. Demand that the clean-state claim not rest solely on the instrument under challenge, and demand that remediation claims name what was rebuilt or reimaged rather than what was scanned. A rebuilt appliance has a state someone can describe. A scanned appliance has a result someone asked a compromised environment to produce.

What this briefing does not establish is equally specific. Nothing here reports how many appliances were compromised, how many scans returned false negatives, or what any named agency did after 31 January 2024. The joint advisory is cited by identifier because the retained read did not include a verbatim publication date for it, and the vendor article is not dated because it carries version identifiers that change and no publication or revision date is asserted here. Those are gaps in this record, not evidence that the underlying facts are absent elsewhere.

What remains is a sentence a supplier wrote about its own tool, and a paragraph two governments and their partners wrote about the same tool, and a remediation step that one calls best practice and the other says can be survived. Read together, they settle the only question that matters at contract signature: whose evidence counts. The answer cannot be the appliance's own.