Hacker News new | past | comments | ask | show | jobs | submit login

Some time ago I went through the list of all the major router manufacturers and rated them on 1) security, and 2) long term usability, and 3) culture.

My conclusion was that I would buy my infrastructure from Allied Telesis. It's pretty much a Japanese version of Cisco, but it's still healthy.

Ubiquity was number 2. I refrain from buying from them only because of their glossy UI.

Mikrotik was on that list. Until I saw how horrible their winbox protocol was. And their implementation of SMB.. I must assume there are still plenty of unknown RCEs there.




https://threatpost.com/hardware-vendor-offers-backdoor-every...

At least Allied Telesis documents their backdoors :)


LOL

I guess there is nothing good.. what is wrong with people :(


Oh god...


I had several Allied Telesis switches at a previous job. The hardware was fine but resetting the configuration password was a remarkably painful process.


Can you elaborate on Mikrotik? I've only heard good things about them and am very satisfied with the one hAP I bought from them.


They have had several remote code execution vulnerabilities lately (summer 2018). While they were very quick to patch them they did not notify their customers in any way. There was nothing on their website that said anything about the urgency.

Instead of reusing functionality that exists in the router already (ssh?), the authentication for winbox is something they built themselves. It was in the winbox auth that the main security flaw was. It just looked really bad to me.

The winbox client also downloads and runs any DLL that is sent by the winbox server. The winbox client has a windows certificate so all it's code is trusted. So own the router and you get the admins workstation too.

It just feels like maybe they hired some random guy without much appreciation for security for doing winbox.

The SMB server also had a rce a while ago.

That said, I guess that if you disable winbox and stuff that should not face the internet, you are probably safe?

Too much for me though. I would not feel safe.


WinBox is not that simple and cannot be replaced with SSH. WinBox works on Ethernet level, so one can connect to router by MAC address and recover when IP level configuration is invalid.


disable winbox and use their webui?

also, while not perfect, what is so horrible about their winbox protocol?




Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: