PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Breaking Fortinet Firmware Encryption

bishopfox.com | blog | #reverse-engineering | #firmware | #security-research | #encryption | #fortinet | #fortigate
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox explains how it reverse engineered Fortinet's firmware image encryption—most bare-metal images ship encrypted—to enable its FortiGate version-comparison research.
Published
Collected

Related coverage

vulnerability · bishopfox.com
CVE-2023-27997 Is Exploitable, and 69% of FortiGate Firewalls Are Vulnerable
Bishop Fox built a working exploit for CVE-2023-27997, a FortiOS SSL VPN heap overflow allowing RCE, and found nearly 490,000 exposed interfaces via Shodan—roughly 69% unpatched.
vulnerability · bishopfox.com
CVE-2023-27997 Vulnerability Scanner for FortiGate Firewalls
Bishop Fox released a non-crashing detection tool for CVE-2023-27997 that uses a timing side channel—comparing response times for valid versus invalid length fields—to check FortiGate firewalls.
vulnerability · bishopfox.com
A More Complete Exploit for Fortinet CVE-2022-42475
Bishop Fox's Team X details a more complete exploit for CVE-2022-42475—the FortiGate SSL VPN heap overflow exploited in the wild—covering ROP chains, shellcode, and per-appliance targeting.
blog · bishopfox.com
Further Adventures in Fortinet Decryption
Bishop Fox analyzed Fortinet's new FortiOS firmware encryption layer and released a tool that decrypts the root filesystem of x86-based images, detailing the ChaCha20-based scheme found in the kernel.
blog · bishopfox.com
A Guide to Choosing the Right VPN
A practical guide to choosing a VPN: after testing a range of providers, Bishop Fox breaks down the strengths and weaknesses of its top five picks and warns about the shadier record of free VPNs.
blog · bishopfox.com
On Apple, Encryption, and Privacy: A Word About Decryption
Follow-up on the Apple-FBI encryption standoff after the iPhone was unlocked without Apple: speculation on the technique, Secure Enclave's limits, and untested legal ground for compelled OS changes.
Back