Re:FortiGuard XOR Encryption in Multiple Fortinet Products
by precurse on Tuesday November 26, 2019 @12:43PM
(#21640612)
They won't even create a fix for their software after blatantly disabling TLS server validation in their FortiSIEM product: https://packetstormsecurity.com/files/154702/Fortinet-FortiS...
They use the "-k" curl flag throughout their code (disabling ALL certificate validation), since I assume is to make initial configuration easier. Rather than fix this going forward, they created a workaround document which all new and existing customers need to follow to secure their setup.
Re:FortiGuard XOR Encryption in Multiple Fortinet Products
by NedIsakoff on Tuesday November 26, 2019 @10:06AM
(#21638836)
That's why you pay your legal time extra money to write a good "Terms of Services".
To intentionally design an insecure obfuscation for customer confidential traffic, and then keep it in place for a year and a half after someone discovers and reports it, is obviously negligent and causes real damage to the companies who bought this defective product.