Slashdot Mirror
SSH Backdoor Found In Fortinet Firewalls (arstechnica.com)
An anonymous reader writes: The IT community was shaken a few weeks ago when Juniper Networks firewalls were found to contain "unauthorized code" that seemed to enable a backdoor. Now, Fortinet firewalls have been found to contain an apparent SSH backdoor as well. "According to the exploit code, the undisclosed authentication works on versions 4.3 up to 5.0.7. If correct, the surreptitious access method was active in FortiOS versions current in the 2013 and 2014 time frame and possibly earlier, based on this rough release history. The weakness was eventually patched, but so far, researchers have been unable to locate a security advisory that disclosed the alternative authentication method or the hard-coded password." A spokesperson for Fortinet told El Reg, "This was not a 'backdoor' vulnerability issue but rather a management authentication issue."
So did Juniper. Wonder when we hear from sonicwall. I won't hold my breath.
All the other firewalls are safe. Trust the NSA. Nothing to see here. Move along.
Hey, check out one of the new reality tv shows.
I'll see your senator, and I'll raise you two judges.
You don't need no fancy schmancy hardware device.
My eyes reflect the stars and a smile lights up my face.
So then the backdoor is required for whom exactly? Probably the police/China.
Good luck proving that. My bet is on this being once again just some developer sloppiness, not an intentional backdoor. Hanlon's razor: "Never attribute to malice that which is adequately explained by stupidity."
"This was not a 'backdoor' vulnerability issue but rather a management authentication issue. The issue was identified by our product security team as part of their regular review and testing efforts. After careful analysis and investigation, we were able to verify this issue was not due to any malicious activity by any party, internal or external."
Their PR firm is earning its money today.
"First they came for the slanderers and i said nothing."
And Mexico paid for it..... Yea, we know...
If we listened carefully, would we hear crying at Fort Meade because they've been caught out, or is it that they've now got other ways to get what they were getting from these sources? My guess is that they won't be happy about all this coming to light, but let's not be fooled into thinking that we are ever really secure on the net.
So then the backdoor is required for whom exactly? Probably the police/China.
Good luck proving that.
I'd say the proof has to come the other way given the current state of trust in various entities to do the right thing.
The cesspool just got a check and balance.
Fortigategate or just plain Fortigate?
Seriously, any actual security expert has been expecting things like this for a long time. The only explanation that makes sense for so few of these being found is that most vendors do not go looking in the first place...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The fact that DoD (who is just one government among many) spent well over 9 figures on exploits means that government surveillance actually is the simplest explanation these days.
So then the backdoor is required for whom exactly? Probably the police/China.
Good luck proving that. My bet is on this being once again just some developer sloppiness, not an intentional backdoor. Hanlon's razor: "Never attribute to malice that which is adequately explained by stupidity."
My Theorem: "Never assume the motive unless you did it yourself." When humans become perfect and never take advantage of other humans I'll agree that Hanlon's razor is always true. That won't happen, so measure the motive based on evidence and probability.
In other words, every Government and Government agency is attempting to legalize back doors in all encryption. Several of those same institutions were found to be installing and using backdoors in hardware and software, and attempting to hack into systems they lacked access to.
Do you find it more probable that a developer "accidentally" left a backdoor in the code and nobody caught it during the whole development chain? Or is it more likely that the backdoor was intentionally installed and not documented so that people could use plausible deniability as defense?
The latter of course is the most probable, and of course reinforcing the idea that "nobody knew about it" and "it was a mistake" will fly around. Hell, they might even find a scapegoat to fire over it. People like you fall for it all the time, so why would they do otherwise?
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
A spokesperson for Fortinet told El Reg, "This was not a 'backdoor' vulnerability issue but rather a management authentication issue."
Later they said, "You didn't get 'pwned', you got 'haxored'...it's like, totally different, man."
And just for the record, I'm not "eating a potato", I'm "utilizing a starch resource with a multi-pronged utensil!"
Just cruising through this digital world at 33 1/3 rpm...
If only they would release the source code somebody could take a look.
Hrm, has anybody done a pf PFGA compiler yet? My low-end pfSense boxes won't really keep up over two bonded gigabits. All this propreitary gear is e-waste now.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Nations have to learn to stop importing complex with issues.
Learn to fab, design your own hardware, add the code and test it. Lots of nice domestic work for years and a good secure product is created.
The hardware might not be fast, cool running, an international standard but it will be fully understood from the chips up and be fully supported locally.
Domestic spying is now "Benign Information Gathering"
If you want something that uses less power. It is as true today as ever that you can do more with less juice in an ASIC than in software. So sure, you throw a big CPU at something it can often do the trick. But maybe you don't want a big CPU and associated support hardware, maybe you have a reason to want something lower power. In that case, dedicated hardware comes in.
Also I think many people who dis hardware firewalls have never seen really difficult networks. It isn't so much the traffic that causes trouble, but the number and randomness of connections. I work on a university campus and we were getting firewalls back in the early days of them as dedicated appliances. On paper, our network as easy, we only had like an OC-3 (155mbps) to the Internet and you could get 1gbps firewalls no problem... ya those fell over the moment they were turned on. They could not handle the nature of our traffic. We ended up getting some of Cisco's very first hardware firewalls, and they worked well.
So, much like the WMF flaw, "working as intended"?
WARNING! This girl exceeds the MAXIMUM SAFE standards established by the FDA for BRATTINESS
I don't know, but I assume if they were actually trying to hide a back door, they would have done a better job.
It's not always wise to over-estimate the ability of programmers, though.
"First they came for the slanderers and i said nothing."
The reaction to these types of revelations should be the same as for the VW emissions scandal. A fired CEO, congressional FCC and FTC investigations, class-actions, naming and shaming of the individuals responsible, and the source code.
Prove anything by multiplying Huge Number times Tiny Number
A spokesperson for Fortinet told El Reg, "This was not a 'backdoor' vulnerability issue but rather a management authentication issue."
Hm. To me, that reads like this:
A spokesperson for the Zeta Beta Tau chapter told El Reg, "This was not a surprise unwanted group buttsex situation but rather a dating faux pas."
This kind of "management authentication issue" IS a backdoor...it's exactly what the term "backdoor" was created to refer to.
For your security, this post has been encrypted with ROT-13, twice.