Less than a month after Juniper Network officials disclosed an unauthorized backdoor in the company’s NetScreen line of firewalls, researchers have uncovered highly suspicious code in older software from Juniper competitor Fortinet.
The suspicious code contains a challenge-and-response authentication routine for logging into servers with the secure shell (SSH) protocol. Researchers were able to unearth a hard-coded password of “FGTAbc11*xy+Qqz27” (not including the quotation marks) after reviewing this exploit code posted online on Saturday. On Tuesday, a researcher posted this screenshot purporting to show someone using the exploit to gain remote access to a server running Fortinet’s FortiOS software.
Ralf-Philipp Weinmann, a security researcher who helped uncover the innerworkings of the Juniper backdoor, took to Twitter on Tuesday and repeatedly referred to the custom SSH authentication as a “backdoor.” In one specific post, he confirmed he was able to make it work as reported on older versions of Fortinet’s FortiOS.
In a statement, Fortinet officials rejected the backdoor characterization. They wrote:
This issue was resolved and a patch was made available in July 2014 as part of Fortinet¹s commitment to ensuring the quality and integrity of our codebase. This was not a “backdoor” vulnerability issue but rather a management authentication issue. The issue was identified by our Product Security team as part of their regular review and testing efforts. After careful analysis and investigation, we were able to verify this issue was not due to any malicious activity by any party, internal or external. All versions of FortiOS from 5.0.8 and later as well as FortiOS 4.3.17 and later are not impacted by this issue.
According to the exploit code, the undisclosed authentication works on versions 4.3 up to 5.0.7. If correct, the surreptitious access method was active in FortiOS versions current in the 2013 and 2014 time frame and possibly earlier, based on this rough release history. The weakness was eventually patched, but so far, researchers have been unable to locate a security advisory that disclosed the alternative authentication method or the hard-coded password. While one researcher told Ars the exploit no longer works in version 5.2.3, that release is still suspicious because it contained the same hard-coded string.
“So a lot of parts of this auth mechanism are still in the later firmware,” said the researcher, who asked not to be named. The most recent version of FortiOS 5.4.0, which was released this month.
At this point, it’s too early to definitively identify the suspect routine as a backdoor that was planted for the purpose of providing unauthorized access. Still, there’s little doubt the code had precisely that effect. Given the revelations that unauthorized eavesdropping code resided in Juniper software for some three years, it’s feasible the now-patched routine was unauthorized as well. Fortinet officials should give a thorough and transparent accounting soon to clear up the uncertainty.
SOURCE: Dan Goodin | Ars Technica