4 ms·

Maybe backdoor was a bad way to describe it? Maybe it's used as a customer-initiated support channel for when the customer wants the vendor to access the devic

Maybe backdoor was a bad way to describe it? Maybe it's used as a customer-initiated support channel for when the customer wants the vendor to access the device.

001spartan 11y ago
That may be, but it's still a backdoor by definition. There are better ways to allow a vendor to access a device, and a hardcoded password that nobody else knows about is not exactly a "front door".
EthanHeilman 11y ago
Support channel has to be the best euphemism for a backdoor I've yet heard. USG probably would have had better luck if they pitched backdoors as a consumers protection measure and had a law mandating that: 1. Software companies must always have a remote and practical method to correct dangerous flaws in the software they issue. 2. To protect consumers' valuable records, all device manufacturers must back up all data on any device the produce. Such backups should ensure that the data is always accessible by the user even if the user were to lose their password or keys. It would be a security disaster, and it already is.
- myth_buster 11y ago
  Please don't give away ideas. You be surprised how well these things would resonate with layperson.
eeZi 11y ago
Fortinet support just uses TeamViewer or Webex when they need access to a device, or you create an account for them. Source: Fortinet admin
- Smushman 11y ago
  Yes - if it isn't obvious (which is should be to anyone here) this was probably used as an beta method for a control/communication channel protocol, Probably inter device only (not meant for a user or support). Built by a programmer who was told to 'get the communication working for this new feature we want to implement'. So he hacked open a hole with a very large cudgel where he should have used a scalpel.
- deleted 11y ago
  [deleted]
ecnepsnai 11y ago
Do you know what FortiManager is? It has nothing to do with support.

Maybe backdoor was a bad way to describe it? Maybe it's used as a customer-initiated support channel for when the customer wants the vendor to access the device.

001spartan 11y ago

That may be, but it's still a backdoor by definition. There are better ways to allow a vendor to access a device, and a hardcoded password that nobody else knows about is not exactly a "front door".

EthanHeilman 11y ago

Support channel has to be the best euphemism for a backdoor I've yet heard. USG probably would have had better luck if they pitched backdoors as a consumers protection measure and had a law mandating that: 1. Software companies must always have a remote and practical method to correct dangerous flaws in the software they issue. 2. To protect consumers' valuable records, all device manufacturers must back up all data on any device the produce. Such backups should ensure that the data is always accessible by the user even if the user were to lose their password or keys. It would be a security disaster, and it already is.

myth_buster 11y ago
Please don't give away ideas. You be surprised how well these things would resonate with layperson.

eeZi 11y ago

Fortinet support just uses TeamViewer or Webex when they need access to a device, or you create an account for them. Source: Fortinet admin

Smushman 11y ago
Yes - if it isn't obvious (which is should be to anyone here) this was probably used as an beta method for a control/communication channel protocol, Probably inter device only (not meant for a user or support). Built by a programmer who was told to 'get the communication working for this new feature we want to implement'. So he hacked open a hole with a very large cudgel where he should have used a scalpel.
deleted 11y ago
[deleted]

ecnepsnai 11y ago

Do you know what FortiManager is? It has nothing to do with support.