SSH Backdoor Found In Fortinet Firewalls (arstechnica.com)

An anonymous reader writes: The IT community was shaken a few weeks ago when Juniper Networks firewalls were found to contain "unauthorized code" that seemed to enable a backdoor. Now, Fortinet firewalls have been found to contain an apparent SSH backdoor as well. "According to the exploit code, the undisclosed authentication works on versions 4.3 up to 5.0.7. If correct, the surreptitious access method was active in FortiOS versions current in the 2013 and 2014 time frame and possibly earlier, based on this rough release history. The weakness was eventually patched, but so far, researchers have been unable to locate a security advisory that disclosed the alternative authentication method or the hard-coded password." A spokesperson for Fortinet told El Reg, "This was not a 'backdoor' vulnerability issue but rather a management authentication issue."

Comments

Don't worry

[DickBreath]

All the other firewalls are safe. Trust the NSA. Nothing to see here. Move along.

Hey, check out one of the new reality tv shows.

iptables + fwbuilder

[The-Ixian]

You don't need no fancy schmancy hardware device.

Re:iptables + fwbuilder

[SuricouRaven]

That depends how much traffic you are shifting and how many ports you need. Using a linux or BSD box as a firewall is common now at the low end of performance - a lot of firewall appliances actually are nothing more than modified rack servers running linux and a web interface for ease of management, like Smoothwall. But if you want to put a firewall between two networks with a 20Gb/s backbone while meeting a strict latency target? You need something specialised. There's still a space for dedicated firewall appliances at the top end. They do a lot more than just iptables-like rule sets too - lots more SPI, detection and automatic blocking of IPs trying to use known vulnerabilities, logging of specified events (ie, any external IP connecting to a server on port 22), detection of port scanners. Fortinet have firewalls with 100Gb/s ports, and the routing/filtering capacity to keep up too. Hardware firewalls are still going strong at the top end - if you've got the need, you've probably got the money.

Re:"management" = ???

[jones_supa]

So then the backdoor is required for whom exactly? Probably the police/China.

Good luck proving that. My bet is on this being once again just some developer sloppiness, not an intentional backdoor. Hanlon's razor: "Never attribute to malice that which is adequately explained by stupidity."

Re:"management" = ???

[phantomfive]

Here is their full quote:

"This was not a 'backdoor' vulnerability issue but rather a management authentication issue. The issue was identified by our product security team as part of their regular review and testing efforts. After careful analysis and investigation, we were able to verify this issue was not due to any malicious activity by any party, internal or external."

Their PR firm is earning its money today.

Not "shaken", more surprised it took that long

[gweihir]

Seriously, any actual security expert has been expecting things like this for a long time. The only explanation that makes sense for so few of these being found is that most vendors do not go looking in the first place...

Re:At least they came out and said it

[cheater512]

They haven't admitted they had a backdoor.
They've only admitted they had a 'management authentication issue'.

Just like many companies are coming under 'advanced persistent threat' attacks.
They aren't filled with idiots who click Important Document.doc.exe from random emails. Course not!
The attack has 'advanced' in the title!

Re: "management" = ???

[ZeroWaiteState]

The fact that DoD (who is just one government among many) spent well over 9 figures on exploits means that government surveillance actually is the simplest explanation these days.

Re:"management" = ???

[s.petry]

So then the backdoor is required for whom exactly? Probably the police/China.

Good luck proving that. My bet is on this being once again just some developer sloppiness, not an intentional backdoor. Hanlon's razor: "Never attribute to malice that which is adequately explained by stupidity."

My Theorem: "Never assume the motive unless you did it yourself." When humans become perfect and never take advantage of other humans I'll agree that Hanlon's razor is always true. That won't happen, so measure the motive based on evidence and probability.

In other words, every Government and Government agency is attempting to legalize back doors in all encryption. Several of those same institutions were found to be installing and using backdoors in hardware and software, and attempting to hack into systems they lacked access to.

Do you find it more probable that a developer "accidentally" left a backdoor in the code and nobody caught it during the whole development chain? Or is it more likely that the backdoor was intentionally installed and not documented so that people could use plausible deniability as defense?

The latter of course is the most probable, and of course reinforcing the idea that "nobody knew about it" and "it was a mistake" will fly around. Hell, they might even find a scapegoat to fire over it. People like you fall for it all the time, so why would they do otherwise?

LOL

[JustAnotherOldGuy]

A spokesperson for Fortinet told El Reg, "This was not a 'backdoor' vulnerability issue but rather a management authentication issue."

Later they said, "You didn't get 'pwned', you got 'haxored'...it's like, totally different, man."

And just for the record, I'm not "eating a potato", I'm "utilizing a starch resource with a multi-pronged utensil!"

Re: NSA spotted - or throwing out misdirection?

[ZeroWaiteState]

They weren't caught out. Most likely the exploit is already known in several countries and the risk of leaving the exploit in place outweighs operational benefit. If they were actually caught out you wouldn't hear anything because Fortinet would be under NSL.

Re:At least they came out and said it

[dreamchaser]

Unfortunately SRXs also suck harder than a whore at Mardis Gras.

Volkswagen`cf. Juniper/Fortinet

[Tokolosh]

The reaction to these types of revelations should be the same as for the VW emissions scandal. A fired CEO, congressional FCC and FTC investigations, class-actions, naming and shaming of the individuals responsible, and the source code.