LOstorm SL Viewer

Advisory-002 (2025-Dec-08)

back to main website

An issue was identified where the security of the saved password database on Linux versions of LOstorm is slightly weaker than offical viewers, due to not incorporating the system MAC address in to the encryption key.

(This also causes the password database to be unreadable when switching to/from official versions of Firestorm!)

This issue means a password database stolen from a Linux system (~/.firestorm_x64/user_settings/binconf.dat) can be opened and used on any other Linux system.

This is considered a minor issue, as the MAC address is not unique enough to resist a serious brute force decryption attempt anyway. Changing the behavior will also break sandboxing solutions which randomize the MAC address.

A future LOstorm version will fix this issue by including an option to enable/disable the use of MAC address in the saved password database encryption key.