Thread by @dcuthbert

Hang on a minute @Fortinet I’ve a few questions here about this #Fortinet

Problematic is spilling your coffee on your pants. Problematic is kids hiding your phone. A BACKDOOR in a product designed to allow strict accsss to corporate networks, is not problematic. This rather flowery wording is an attempt at downplaying the seriousness

“inadvertently bundled”

This tells us that your pipeline isn’t actually a pipeline but potentially a file share structure with someone doing releases by randomly slinging the .out file to the web. Seems rather implausible

I’d love to know what kind of customer requests a pretty obvious unauthenticated function making use of a random string to reset anyone’s password? Seems an odd admin function when they’d be admin right?

Oh wait....

Honest question: for such a striking addition to the codebase to exist for a number of years, there exists fairly serious flaws in your dev pipeline, automated tests, code quality and access to branches, etc. What are you doing to address this?

Numerous governments and intelligence community leaders were quick to jump on Huawei, and rightly so, for insecure code and backdoors, yet here is a backdoor and the chatter is rather quieter.

I'm actually really glad @GossiTheDog has been so vocal about this and the potential impact. Respect Sir