9 votes

Multiple Fortinet products communicate with FortiGuard services while only "encrypting" sensitive user data using XOR with a hardcoded key

Posted by Deimos
Tags: security, privacy, fortinet
https://sec-consult.com/en/blog/advisories/weak-encryption-cipher-and-hardcoded-cryptographic-keys-in-fortinet-products/

Link information

This data is scraped automatically and may be incorrect.

Title
Weak encryption cipher and hardcoded cryptographic keys in Fortinet products
Published
Nov 25 2019
Word count
912 words

1 comment

  1. Omnicrola
    Link
    "Security" like this is just jaw-dropping incompetent. It points to a critical lack of peer review in development, as well as a lack of QA and other processes. I really hope someone gets fired...

    "Security" like this is just jaw-dropping incompetent. It points to a critical lack of peer review in development, as well as a lack of QA and other processes.

    I really hope someone gets fired over this. Several someones. The person(s) who wrote it, and the person who QAd it, and the person who approved the deployment of it into production.

    5 votes