Sophisticated Linux Implant Discovered Compromising Fortinet Network Security

I worked for Fortinet for a short period of time. It's a very odd organization. The history here is the founders (the Xie's) got screwed over during the Netscreen days. When they founded Fortinet they were wearing their tinfoil hats. No internal directory and a lot of weird trust-no-one policies. Fortinet panders to customers, not security. They'll build anything for anyone with money. They sell IP cameras because a customer wouldn't buy their other products unless they could sell them some. Fortinet had some IP in their custom silicon, but they never knew how to market or sell into the Enterprise early on. To their credit they're very fiscally conservative and have, traditionally, had a lot of money in the bank. Their big competition, that steamrolled them, however is Palo Alto Networks. The Xie's focused on their ASICs while PAN integrated off the shelf hardware and built a better, more polished mouse trap.

But at the end of the day I couldn't get over that no matter how many flaws or bypass I'd find in their products - they just didn't give a shit. Fortinet checks the box for SMB and SLED. It's cheap, it mostly works and they've got a lot of flexibility with how they can integrate. But I never really viewed them as a serious security company. Seeing it from the inside was an eye opener. I had worked for Palo Alto Networks as well and the conversations with PM there were much different.

Given how FortiOS is built, I'd guess there's a lot of other bugs lurking. I especially wouldn't recommend any of these network security manufacturers for VPN. All of them are garbage no matter who you buy. But Fortinet... No way.

I've had to use some of their SSL-VPN and SD-WAN solutions.

Perhaps select areas of their engineering and business were exemplary and pristine. You don't want anything that touches that to be noticeably shoddy.

A corporate VPN is a "You Had One Job..." situation, and it's very hard job to do sufficiently well.