4 ms·

> 2. Procure secure-by-design devices I take this to mean "don't buy Fortinet products." https://www.cvedetails.com/vulnerability-list/vendor_id-3080/Fortinet

> 2. Procure secure-by-design devices I take this to mean "don't buy Fortinet products." https://www.cvedetails.com/vulnerability-list/vendor_id-3080/Fortinet.html https://www.cvedetails.com/vulnerability-list/vendor_id-3080...

arminiusreturns 2y ago
Cisco was in that list too.
- bigfatkitten 2y ago
  Cisco ships so many hardcoded creds that you rarely need a vulnerability.
guardiangod 2y ago
You probably should stop buying your favorite brand Palo Alto Network then. https://www.cvedetails.com/vulnerability-list/vendor_id-12836/year-2024/Paloaltonetworks.html https://www.cvedetails.com/vulnerability-list/vendor_id-1283...
- ai-christianson 2y ago
  Do you think we'd be any better off running SONiC?
  - oneplane 2y ago
    Yes, but you'd run that on your switch and not your edge devices.
- bigfatkitten 2y ago
  Palo isn't great either but Fortinet is in its own league. https://www.theregister.com/2025/01/14/miscreants_mass_exploited_fortinet_firewalls/ https://www.theregister.com/2025/01/14/miscreants_mass_explo...
oneplane 2y ago
Yes, also Ivanti. And Palo Alto. And Cisco. And Dell (unless they spun that off already). Most of the devices that rely on a scheme similar to inkjet printers (but with an even shorter shelf life) are going to be that way. This is because the money is not in the software, but in administrative choices (licensing, support contracts based on lifespan of hardware etc). Since most deployment scenarios don't really need a proprietary ASIC to handle filtering, you'd almost universally be better off with a system that is built around generic white box hardware and an OS that is kept up-to-date. But that requires more knowledge and skills, and most people and companies would rather not invest in that for various reasons. As for where you'd get your money's worth: it's mostly in the threat feeds. A well-tested, verified feed of known bad things (subnets, packet contents, behaviour) is much more useful than paying someone to keep a spare fan on the shelf so they can bring it to you "just in case".
- bigfatkitten 2y ago
  The main thing the commercial players offer that open source doesn't do well is application level filtering. I want to be able to allow RTP across this giant port range but not just any UDP, or allow TLS exchanges with only certain SNI domains, not Cloudflare's entire address space. If you want to do this, you need to select the least bad vendor. In my experience, site categorisation is about the only 'feed' worth paying for.
  - transpute 2y ago
    Is application filtering always bundled with hardware? Open-source software already ingests URLs for adblock. https://zvelo.com/about/company-history/ https://zvelo.com/about/company-history/
  - megous 2y ago
    Opensource has dynamic RTP port opening based on SIP/SDP communication. https://wiki.nftables.org/wiki-nftables/index.php/Conntrack_helpers https://wiki.nftables.org/wiki-nftables/index.php/Conntrack_... You can also send packets to userspace from nftables and do your SNI parsing/deep inspection/decision there. I used that a few times to do various things, like duplicate packet removal, etc. It's very flexible.
Saris 2y ago
And TP-Link, Ubiquiti, Asus, Linksys, D-Link, Netgear, etc.. I think the only good options are something flashed with up-to-date OpenWRT, or a PC running something like Opnsense.
stuckkeys 2y ago
Yeah. Majority of their devices can be found on breached. I saw my ex employer on there. Not that hard to decrypt the hashes stored on the config files. Base64 from what I could tell.

arminiusreturns 2y ago

Cisco was in that list too.

bigfatkitten 2y ago
Cisco ships so many hardcoded creds that you rarely need a vulnerability.

guardiangod 2y ago

You probably should stop buying your favorite brand Palo Alto Network then. https://www.cvedetails.com/vulnerability-list/vendor_id-12836/year-2024/Paloaltonetworks.html https://www.cvedetails.com/vulnerability-list/vendor_id-1283...

ai-christianson 2y ago
Do you think we'd be any better off running SONiC?
- oneplane 2y ago
  Yes, but you'd run that on your switch and not your edge devices.
bigfatkitten 2y ago
Palo isn't great either but Fortinet is in its own league. https://www.theregister.com/2025/01/14/miscreants_mass_exploited_fortinet_firewalls/ https://www.theregister.com/2025/01/14/miscreants_mass_explo...

oneplane 2y ago

Yes, also Ivanti. And Palo Alto. And Cisco. And Dell (unless they spun that off already). Most of the devices that rely on a scheme similar to inkjet printers (but with an even shorter shelf life) are going to be that way. This is because the money is not in the software, but in administrative choices (licensing, support contracts based on lifespan of hardware etc). Since most deployment scenarios don't really need a proprietary ASIC to handle filtering, you'd almost universally be better off with a system that is built around generic white box hardware and an OS that is kept up-to-date. But that requires more knowledge and skills, and most people and companies would rather not invest in that for various reasons. As for where you'd get your money's worth: it's mostly in the threat feeds. A well-tested, verified feed of known bad things (subnets, packet contents, behaviour) is much more useful than paying someone to keep a spare fan on the shelf so they can bring it to you "just in case".

bigfatkitten 2y ago
The main thing the commercial players offer that open source doesn't do well is application level filtering. I want to be able to allow RTP across this giant port range but not just any UDP, or allow TLS exchanges with only certain SNI domains, not Cloudflare's entire address space. If you want to do this, you need to select the least bad vendor. In my experience, site categorisation is about the only 'feed' worth paying for.
- transpute 2y ago
  Is application filtering always bundled with hardware? Open-source software already ingests URLs for adblock. https://zvelo.com/about/company-history/ https://zvelo.com/about/company-history/
- megous 2y ago
  Opensource has dynamic RTP port opening based on SIP/SDP communication. https://wiki.nftables.org/wiki-nftables/index.php/Conntrack_helpers https://wiki.nftables.org/wiki-nftables/index.php/Conntrack_... You can also send packets to userspace from nftables and do your SNI parsing/deep inspection/decision there. I used that a few times to do various things, like duplicate packet removal, etc. It's very flexible.

Saris 2y ago

And TP-Link, Ubiquiti, Asus, Linksys, D-Link, Netgear, etc.. I think the only good options are something flashed with up-to-date OpenWRT, or a PC running something like Opnsense.

stuckkeys 2y ago

Yeah. Majority of their devices can be found on breached. I saw my ex employer on there. Not that hard to decrypt the hashes stored on the config files. Base64 from what I could tell.