INFO: MikroTik new default device password practice

RouterOS Beginner Basics
21

Yes, that is true. But when the device “just works” in its default configuration, the user never needs to login and the default password remains blank.
Then the hacker can just login and set a password, and abuse the device. With the added problem that the owner himself now no longer can login, should he want to do that later (e.g. because their ISP advised them that their router has been hacked and is used for DDoS).

So the real solution is to have a unique password per device. And it should be randomly generated and not e.g. derived from the MAC address using a “complicated secret function”, because sooner or later the hackers will reverse engineer the function and publish it. Happened for many routers that tried to go that way!
(of course that still is more secure than no password at all, e.g. when attacking the device from internet you normally do not know its MAC address. but when attacking from WiFi you do know it)

22

My password strategy is twofold:

For stuff that I have to login manually sometimes i use cca 15-25 char passwords that are also relatively easy to type.

For stuff that I never type, I set the pass alphanumeric as large as the system accepts. Say 50, 100 or more random generated characters. So devices can never be hacked due to poor account security.

Security holes are another thing, but from what I have seen with MT devices till now is that they are fairly secure. No problems ever on hundreds of devices I installed (provided there is a good local security, too).

23

I still would not dare to have a MikroTik router with open webfig/winbox ports to the internet!
Only allow management from the “inside” or via a VPN.

24

Of course :slight_smile: