FortiGuard Used Hardcoded Key, XOR to Encrypt Communications

guest · Nov 25, 2019

FortiGuard Used Hardcoded Key, XOR to Encrypt Communications
November 25, 2019
https://www.bleepingcomputer.com/ne...-hardcoded-key-xor-to-encrypt-communications/

Security researchers found that multiple security products from Fortinet use weak encryption and static keys to communicate with FortiGuard services in the cloud, such as AntiSpam, AntiVirus, and Web Filter.
An attacker capable to intercept network traffic would have little trouble to decrypt and modify messages exchanged with FortiGuard servers.
XOR and static key
The issue affects versions of FortiOS (before 6.0.7 or 6.2.0), FortiClient for Windows before 6.2.0, and FortiClient for Mac before 6.2.2, that were released starting March 28, 2019. Fortinet announced the vulnerability on November 20.

The advisory from the pentesting company notes that an adversary exploiting this weakness could glean information that would help them build a better attack. They would be able to track users across the world, spy on their browsing, or obtain email data.
Click to expand...

Log in or Sign up

FortiGuard Used Hardcoded Key, XOR to Encrypt Communications

guest Guest

Log in or Sign up

FortiGuard Used Hardcoded Key, XOR to Encrypt Communications

guest Guest

Useful Searches