Slashdot Mirror
SSH Backdoor Found In Fortinet Firewalls (arstechnica.com)
An anonymous reader writes: The IT community was shaken a few weeks ago when Juniper Networks firewalls were found to contain "unauthorized code" that seemed to enable a backdoor. Now, Fortinet firewalls have been found to contain an apparent SSH backdoor as well. "According to the exploit code, the undisclosed authentication works on versions 4.3 up to 5.0.7. If correct, the surreptitious access method was active in FortiOS versions current in the 2013 and 2014 time frame and possibly earlier, based on this rough release history. The weakness was eventually patched, but so far, researchers have been unable to locate a security advisory that disclosed the alternative authentication method or the hard-coded password." A spokesperson for Fortinet told El Reg, "This was not a 'backdoor' vulnerability issue but rather a management authentication issue."
I do all the soldering, everything. The walls are tall and fortified.
So did Juniper. Wonder when we hear from sonicwall. I won't hold my breath.
Yeah, management authentication issue... So then the backdoor is required for whom exactly? Probably the police/China.
All the other firewalls are safe. Trust the NSA. Nothing to see here. Move along.
Hey, check out one of the new reality tv shows.
I'll see your senator, and I'll raise you two judges.
You don't need no fancy schmancy hardware device.
My eyes reflect the stars and a smile lights up my face.
And you think the Democrats are ANY different?
https://theintercept.com/2015/12/07/obama-hints-at-renewed-pressure-on-encryption-clinton-waves-off-first-amendment/
It doesn't matter which party is in power, you will always move progressively towards tyranny. Both parties hate privacy.
If we listened carefully, would we hear crying at Fort Meade because they've been caught out, or is it that they've now got other ways to get what they were getting from these sources? My guess is that they won't be happy about all this coming to light, but let's not be fooled into thinking that we are ever really secure on the net.
Fortigategate or just plain Fortigate?
Seriously, any actual security expert has been expecting things like this for a long time. The only explanation that makes sense for so few of these being found is that most vendors do not go looking in the first place...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I wonder if we're going to hear about any backdoors or exploits for pfsense.
A spokesperson for Fortinet told El Reg, "This was not a 'backdoor' vulnerability issue but rather a management authentication issue."
Later they said, "You didn't get 'pwned', you got 'haxored'...it's like, totally different, man."
And just for the record, I'm not "eating a potato", I'm "utilizing a starch resource with a multi-pronged utensil!"
Just cruising through this digital world at 33 1/3 rpm...
If you limit management plane access, this really would be a trivial issue. Only those with access to the management network would even be able to initiate an SSH session. If an attacker cannot initiate an SSH session, they cannot exploit.
Using proper network segmentation and having a management network makes it where there is need to rush in patching this. Just implement the next upgrade which would include the fix when there is another reason to do so.
From Making Money, regarding a fictional communications company. Read it sarcastically.
Here, too, the backdoor vulnerability was spontaneously generated in some weird, chilly, geometrical otherworld...
...all in the name of remote support. HP and Dell both do this, as do GE and Philips.
Nations have to learn to stop importing complex with issues.
Learn to fab, design your own hardware, add the code and test it. Lots of nice domestic work for years and a good secure product is created.
The hardware might not be fast, cool running, an international standard but it will be fully understood from the chips up and be fully supported locally.
Domestic spying is now "Benign Information Gathering"
If you want something that uses less power. It is as true today as ever that you can do more with less juice in an ASIC than in software. So sure, you throw a big CPU at something it can often do the trick. But maybe you don't want a big CPU and associated support hardware, maybe you have a reason to want something lower power. In that case, dedicated hardware comes in.
Also I think many people who dis hardware firewalls have never seen really difficult networks. It isn't so much the traffic that causes trouble, but the number and randomness of connections. I work on a university campus and we were getting firewalls back in the early days of them as dedicated appliances. On paper, our network as easy, we only had like an OC-3 (155mbps) to the Internet and you could get 1gbps firewalls no problem... ya those fell over the moment they were turned on. They could not handle the nature of our traffic. We ended up getting some of Cisco's very first hardware firewalls, and they worked well.
Likely another NSL casualty reveals itself, juniper, cisco the list goes on, top notch "security" products broken as ordered by those that help to secure sweet FA.
Cue user cold fjord shilling in 3 , 2 , 1
The reaction to these types of revelations should be the same as for the VW emissions scandal. A fired CEO, congressional FCC and FTC investigations, class-actions, naming and shaming of the individuals responsible, and the source code.
Prove anything by multiplying Huge Number times Tiny Number
A spokesperson for Fortinet told El Reg, "This was not a 'backdoor' vulnerability issue but rather a management authentication issue."
Hm. To me, that reads like this:
A spokesperson for the Zeta Beta Tau chapter told El Reg, "This was not a surprise unwanted group buttsex situation but rather a dating faux pas."
This kind of "management authentication issue" IS a backdoor...it's exactly what the term "backdoor" was created to refer to.
For your security, this post has been encrypted with ROT-13, twice.