4 ms·

Firefox Translations of it says it was known vulnerability: > The malware found installed a ‘backdoor’ by using a known vulnerability in FortiGate devices. The

by neilv 3y ago

Firefox Translations of it says it was known vulnerability: > The malware found installed a ‘backdoor’ by using a known vulnerability in FortiGate devices. The publication of the MIVD therefore does not describe any new vulnerability in all FortiGate devices. I could believe factory backdoors in Fortinet products, including bugdoors, but it's even easier to believe commonplace unintended software defects. Edit: This comment was a response to the HN title "China spied on Dutch Cyber Intelligence through FortiGate backdoors (defensie.nl)". I thought people will tend to interpret "FortiGate backdoor" as meaning an intentional backdoor by the vendor/factory, when that's not what the article seemed to suggest.

jacquesm 3y ago
> it's even easier to believe commonplace unintended software defects Note the fact that this was actively exploited by the Chinese. That sort of reduces the chance of this being an accident, especially since they've done this before.
- neilv 3y ago
  Commonplace unintended software defects seem to be the overwhelming source of known vulnerabilities. Which I imagine are in everyone's toolkit to exploit. It's reasonable to be cautious about Fortinet in general, but I don't think the fact that a known vulnerability was exploited suggests that the vulnerability was intentional.
- wolverine876 3y ago
  Why would Chinese intelligence (or any intelligence agency) care if the vulnerability is an accident or intentional? I imagine they prefer the former, because it reveals less about their techniques, methods, etc.
  - neilv 3y ago
    Also, a proven intentional security vulnerability in Fortinet products would be bigger news, for multiple reasons, and make a lot of urgent work and disruption for a lot of people. Occasionally, a proven intentional vulnerability will happen, so we want to be careful not to cry wolf other times.
deleted 3y ago
[deleted]
thomasahle 3y ago
> including bugdoors Is a bugdoor a factory backdoor implemented via an intentional bug? Is the idea to give plausible deniability if the backdoor gets found?
- neilv 3y ago
  Yes, I heard this concept alleged publicly ~25 years ago. I've only heard the "bugdoor" term within the last few years. The first time I heard the idea, someone was claiming publicly that a manager/lead at a tech vendor had been approached by a government, and asked to insert a backdoor that would look accidental, and without the larger organization aware. That might've been apocryphal, but the idea was plausible. The idea is maybe received a bit differently today, when there's a ton more people doing work, by a ton of developers who haven't had correctness and security prioritized. Even some of the key bits of tech infrastructure, by some the largest tech companies, seem to think weekly security updates, for multiple CVEs each, isn't insane. "Uh, you want us to make a security vulnerability, and make it look like it was because we were negligent? If you can wait a week, I can give you a dozen all-natural ones."

by neilv 3y ago

jacquesm 3y ago

> it's even easier to believe commonplace unintended software defects Note the fact that this was actively exploited by the Chinese. That sort of reduces the chance of this being an accident, especially since they've done this before.

neilv 3y ago
Commonplace unintended software defects seem to be the overwhelming source of known vulnerabilities. Which I imagine are in everyone's toolkit to exploit. It's reasonable to be cautious about Fortinet in general, but I don't think the fact that a known vulnerability was exploited suggests that the vulnerability was intentional.
wolverine876 3y ago
Why would Chinese intelligence (or any intelligence agency) care if the vulnerability is an accident or intentional? I imagine they prefer the former, because it reveals less about their techniques, methods, etc.
- neilv 3y ago
  Also, a proven intentional security vulnerability in Fortinet products would be bigger news, for multiple reasons, and make a lot of urgent work and disruption for a lot of people. Occasionally, a proven intentional vulnerability will happen, so we want to be careful not to cry wolf other times.

deleted 3y ago

[deleted]

thomasahle 3y ago

> including bugdoors Is a bugdoor a factory backdoor implemented via an intentional bug? Is the idea to give plausible deniability if the backdoor gets found?

neilv 3y ago
Yes, I heard this concept alleged publicly ~25 years ago. I've only heard the "bugdoor" term within the last few years. The first time I heard the idea, someone was claiming publicly that a manager/lead at a tech vendor had been approached by a government, and asked to insert a backdoor that would look accidental, and without the larger organization aware. That might've been apocryphal, but the idea was plausible. The idea is maybe received a bit differently today, when there's a ton more people doing work, by a ton of developers who haven't had correctness and security prioritized. Even some of the key bits of tech infrastructure, by some the largest tech companies, seem to think weekly security updates, for multiple CVEs each, isn't insane. "Uh, you want us to make a security vulnerability, and make it look like it was because we were negligent? If you can wait a week, I can give you a dozen all-natural ones."