Hacker News Reader

You should NOT have any terramaster NAS internet facing right now. I disclosed a bug last month to Terramaster that still hasn't been fixed.

Go to http://NAS_IP/module/api.php?wap/ and it will give your admin password out as an md5crypt hash. Why? I assume it's some sort of backdoor/dev code but I don't know.

View on HN

Hi friend, Could you please send a description of the specific problem to our email：support@terra-master.com? TerraMaster will do our best to serve every customer.

I sent an email to that address on the 19th of March. The issue is that millions of passwords per second can be tried against the hash on an average computer and there's no good reason to give the hash out in production.

To anybody owning a Terramaster NAS then i'd advise to set a random password of the maximum length possible.

Jesus, confirmed here. That is tragic.

Reply on news.ycombinator.com