Loading today’s stories
Security1 distinct publisher2 min readPublished
fortitool folds a scatter of version-specific scripts into one dependency-free Go binary, and the drop in cost to inspect a Fortinet appliance lands the same for a defender and an attacker.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The individual breaks here are borrowed, not new, and Ali Mosajjal says so plainly. The work is stitching them into one path that does not care which era of firmware it is fed. What makes that worth doing lives in the outer layer.
That layer is a block XOR cipher over the whole disk image: 512-byte blocks, a 32-byte alphanumeric key, and CBC-like chaining off a fixed 0xFF initialization vector [8]. The known-plaintext shortcut works because bytes 48 through 79 of each decrypted block are null padding in practice, which hands the keystream straight back [c9b]. Recovery is quick for a duller reason: reuse. BishopFox counted roughly 25 distinct keys across about 29,000 images [10]. That is one key for every 1,160 images on average [18], so the outer layer is not protected by a per-device secret at all but by the size of a shared pool.
The inner layer, which wraps the actual root filesystem, is the messy part. From 7.4.1 through 7.4.11 it is ChaCha20 with a non-standard counter plus AES-CTR, keyed off a seed hidden in the kernel; from 7.6.x on it becomes XOR plus RSA plus FORT-RC4 or a modified RC4, depending on the silicon [11]. FORT-RC4, per the researcher hacefresko, is RC4 with a modified KSA and PRGA and a 32-byte key tucked inside a PKCS#1 v1.5 signature on rootfs.gz [12]. The variants do not even agree across product lines: the FGT build zeroes the RC4 state after key scheduling while the FFW build carries the j index across [13].
Two things sit just outside the crypto. flatkc is a Linux 3.2.16 kernel whose GPL source Fortinet never published, so decrypting the image is one of the few routes to seeing what actually runs on the box [6]. And config-secret decryption, the routine that reads the set <field> ENC <base64> lines in a config backup, is the one part Mosajjal says required a real disassembler [16]. It is also where the headline sits: the post is framed around a key nobody previously had, though the published writeup stops before laying that key out in full [17].
Ranked by verification strength, evidence, and original report placement.
Ali Mosajjal built fortitool, a single static Go binary with zero runtime dependencies that runs the whole FortiOS decryption pipeline: outer cipher, rootfs decryption, filesystem extraction, signature verification, and config-secret decryption.
fortitool picks the correct decryption method by itself instead of demanding a version flag.
Before fortitool, decrypting a FortiOS image meant choosing tools by version and architecture: forticrack for the outer layer, fgx for the 7.6.x rootfs scheme, forticrack_v8 for 8.0, and blog posts or one-off scripts for the ARM 7.4.x path; the tools did not interoperate and many required openssl, binwalk, or Python installed.
flatkc, the kernel inside the image, is a Linux 3.2.16 kernel, and Fortinet never published the GPL source for it.
The inner .tar.xz archives use a Fortinet-modified xz format that standard xz refuses to open; they are extracted using the ftar binary shipped in the image's own sbin/ directory.
The outer layer wraps the entire disk image in a block XOR cipher: 512-byte blocks, a 32-byte alphanumeric key, and CBC-like chaining between blocks with a fixed IV of 0xFF.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Detailed primary source, no corroboration
The cluster is a single, highly detailed technical writeup by the tool's own author. It specifies concrete cipher parameters, key-recovery mechanics, and cites external researchers (BishopFox, hacefresko, RandoriSec, gquere) and public identifiers (CVE-2019-6693, FG-IR-19-007), which raises credibility. But every claim is self-reported with no independent reproduction or second source in the cluster, capping evidence strength.
Only a release, no uptake data
The source documents the tool's creation/publication but provides no downloads, stars, forks, third-party deployments, or usage metrics. There is no evidence to measure real-world adoption, so this dimension is insufficient rather than inferred.
Mild tease beyond delivery
Most claims are modest and technically substantiated. The slight overstatement is in the framing: the title promises 'a key nobody had' (and the cluster title says 'key included'), while the published text stops short of laying that key out in full, creating a small gap between promise and delivery.
Author promoting own tool
The publisher is the author's personal blog and the piece promotes a tool he built, creating a self-promotion/recognition incentive. There is no disclosed commercial arrangement or paywall, and the work credits prior researchers, which tempers but does not remove the incentive.
Single expert source
Confidence is moderate: the source is detailed and internally consistent and references verifiable public identifiers, but it is a lone, self-interested primary source with no corroboration, benchmarks, or adoption signal in the cluster.
build
SSE in Go breaks twice before your handler runs: an illegal header, then a 30-second timeout1 distinct publisher
build
TypeScript 7.0 is a build-infrastructure release: re-budget CI, then check your toolchain1 distinct publisher
build
Your meter now runs on someone else's machine: signed receipts, fsync, and failing open1 distinct publisher
build
Zero-Instrumentation Go Tracing Works, But You Are Now Maintaining ABI Offsets1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 25, 2026