insecure method to store passwords.

luqasz · December 8, 2011, 2:06pm

hi

are you aware of this ?
http://felinemenace.org/~andrewg/MikroTik_Router_Security_Analysis_Part3/
and this ?
http://manio.skyboo.net/mikrotik/index.en.php

ayufan · December 8, 2011, 2:58pm

Yes, we are. Problem was told many times before.

luqasz · December 8, 2011, 5:07pm

and ? any official statement ?

normis · December 9, 2011, 8:09am

don’t give your router to somebody who will hack it. lock it away from public.
keep backup files safe

given enough time, any encryption can be cracked. so use also other methods of protection.

ayufan · December 9, 2011, 9:24am

normis you’re funny how can you say that passwords in routeros are encrypted? no they are not, if by encryption you mean simple xor, then it’s not very nice…

It wonders me who in your company made such faux pas when industry standard is password hashed with some random salt.

normis · December 9, 2011, 9:49am

please read my post again, because you completely missed my point. I said - why even bother encrypting it? it will just take a little more time to read. Better deal with your other security hole - why can somebody take your router and do what he pleases?