4 ms·
I was referring to the password used to log in. You can store a hash in memory for comparison.
by mikegerwitz 10y ago
I was referring to the password used to log in. You can store a hash in memory for comparison.
- johncolanduoni 10y agoThis attack doesn't involve a login password. It's a pre-shared key. If you have the hash, you can both connect and decrypt the connections of others. If it was only needed for comparison, the plaintext password shouldn't even be in a database.
- mikegerwitz 10y ago> Brian Waters, another security researcher, tested BENIGNCERTAIN on his own hardware and managed to obtain the VPN's password, also known as a preshared key. > On Friday, he tweeted a message of the output from his test, which revealed his test password of “password123” among a list of two other possibilities. A password and a pre-shared key can mean the same thing depending on context. Regardless of what it is, the value in memory should not be able to be used externally to log into the system. The article references "password123"---that should not be recoverable from memory.