wheeeeeee
Sigh
Massive password-stealing attack hits 75k Fortinet firewalls
UPDATED If you have a Fortinet firewall, it's time to stop and change your passwords. Intruders somehow gained access to around 75,000 Fortinet firewall devices and stole credentials belonging to major corporations across 194 countries, in some cases leading to full network compromise. Security researchers say that they have …
-
-
Thursday 18th June 2026 10:03 GMT CrazyOldCatMan
If this involved cracking hashes then Fortinet are using the wrong kind of hashes.
Probably using the really cheap 'brown lump of something' hashes [1] rather than the delicious, hand-cooked goodness that a proper hash-brown could be.
[1] As found in most American-style burgers that include hash browns..
-
-
-
Thursday 18th June 2026 11:21 GMT David Austin
Re: what is fortinet doing.
To be fair, I think every major SMB/Enterprise firewall vendor has had major security issues in the last 12 months; SonicWall, Cisco, Fortigate, Watchguard, just off the top of my head from some messes I've cleaned up.
I have a degree of sympathy: As the gateway between The Enterprise and the World Wide Web, they are high profile, valuable targets, and worth putting effort in to pop open, but that just means the security standard we expect from these companies has to be higher.
-
-
-
Thursday 18th June 2026 11:26 GMT fg_swe
No
We just have to start using well-known computer science techniques instead of QUICK AND DIRTY ENGINEERING.
1.) Well-educated, experience software engineers developing security-critical systems. Computer Science Degree. No more half-educated pastors and chemists.
2.) Well-defined, strictly scanned+parsed languages from machine code to JSON input. No serialization shortcuts
3.) Mathematical verification of critical components such as SSH. See also seL4, CompCert, MST(https://github.com/DiplIngFrankGerlach/MST)
4.) K.I.S.S. instead of SSL/TLS-type of BLOAT.
5.) Memory-Safe, strongly typed Programming Languages instead of the C-Hamburger (also see https://sappeur.di-fg.de/LanguageAnalogy.html)
The bottom line is: the internet accepted your challenge. You will lose.
-
Thursday 18th June 2026 12:02 GMT Tron
Re: No
Whack-a-mole won't work. Anything connected to the internet is at risk due to the complexity of systems and the methods of production, sale. implementation and maintenance.
You can only design out the problem. Take as much as you can offline. Use thin systems online. Airgap. For some that isn't an option, but the more you can take completely offline, the safer you are.
-
-
-
Thursday 18th June 2026 10:54 GMT fg_swe
How To Fix This Once And Forever
Satellites, data center servers, firewalls, industrial control systems (water supply, electrical substations, sewage treatment plants, etc.), sensors, and their control computers require remote monitoring and operation. Remote Desktop Protocol and X11 are among such applications. Clearly, these command interfaces must be protected against unauthorized or hostile access; a wide range of private and state-sponsored cyber actors—such as "hackers" and cyber-warfare personnel—must be fended off. Fortunately, however, there is no need to process potentially hostile data packets at the application layer. This allows the security challenge to be reduced entirely to a problem of cryptographic engineering. In turn, the cryptographic design should be minimalist, thereby allowing its correctness to be mathematically proven.
More: https://di-fg.de/MinimalesChiffrierSystem.html (use GT for a version in your language)
