The blog post by Kristian Köhntopp is a sharp critique of the current state of security software, highlighting repeated and systemic failures by major vendors like Fortinet and Ivanti. Fortinet had multiple severe security flaws (CVSS 9.6–9.8) within days, including format string bugs and out-of-bounds writes: vulnerabilities that modern development tools should catch. Fortinet’s advisory for the out-of-bounds write CVE-2024-21762 noted it was potentially being exploited in the wild, and the only workaround it offered was to disable SSL VPN, a bold definition of mitigation for a VPN appliance. Ivanti fared no better: CISA ordered US federal agencies to disconnect all Ivanti Connect Secure and Policy Secure instances by 2 February 2024 and to factory reset and rebuild them before putting them back into service. Köhntopp argues that security products (like antivirus and DLP tools) often introduce more risk than they prevent. He cites examples like Trend Micro and Websense shipping outdated binaries, exploitable modules, and software lacking basic protections like ASLR.
