Thanks for the heads-up.

Is there a specific version from which this malware is able to infect a mikrotik?
How about RouterOS 5.22 for example or 6.27?

Hi Normis,

Found this IT News Article today saying Mikrotik devices are in the list for being at risk to being Hacked. What’s your take on this article??
https://www.itnews.com.au/news/hackers- ... ces-491582

Hopefully my comment won't come through as rude, but to me it seems a bit irresponsible (or at least over-confident) to say "we are highly certain" without having an actual sample of the malware to analyze and confirm that it was exploiting the old vulnerability and not some new one you might not yet be aware of.

Also, with security threats constantly on the rise, it would be nice if there was a dedicated Security sub-forum or some kind of channel / RSS / mailing list which would discuss only security and which we could subscribe to be notified of things like this.

Hopefully my comment won't come through as rude, but to me it seems a bit irresponsible (or at least over-confident) to say "we are highly certain" without having an actual sample of the malware to analyze and confirm that it was exploiting the old vulnerability and not some new one you might not yet be aware of.

Also, with security threats constantly on the rise, it would be nice if there was a dedicated Security sub-forum or some kind of channel / RSS / mailing list which would discuss only security and which we could subscribe to be notified of things like this.

We do have in-depth analysis materials from the Cisco Talos team. They also said they think it is using the same vulnerability that was pubished/known. We also have conducted a thorough code review after the previous vulnerability.

Thanks for the prompt response Normis.

I assume people that were using the quickset dynamic dns vpn and appropriate firewall rules + updated fw would have been invunerable to these attacks ?

.....Found this IT News Article today saying Mikrotik devices are in the list for being at risk to being Hacked. ....

investigating the malware, which targets devices from Linksys, MikroTik, Netgear, TP-Link and QNAP, advising users to install security updates. .... Cisco Systems, which has been investigating the threat for several months....

BartosP are you working for juniper ;-P

BartosP are you working for juniper ;-P

Nokia-Alcatel-Lucent has strong presence in Poland with numerous competence centers, Juniper perhaps doesn't

.... in Poland ....

You mean Roland or PPoland ...

The question in the next I was phoned by the cyberpolicy and said that my router is infected with a virus, that I need to reset my device and set it up which I do not really want to do.
Will I have enough passwords and firmware updates?

Can somebody please tell me what this log information is (in dark red below containing warning denied winbox/dude connect from?
** Is this log indicating remote IP addresses trying to get into my CHR via a potential vulnerability which has been discussed many times here ? **

Or - is this a log from my btest fw rules which auto-blocks lengthy btest connections then later auto-removes them. I do see some of the above IP address in my fw Connections list (which are auto added & auto removed an hour later).
North Idaho Tom Jones

Can somebody please tell me what this log information is (in dark red below containing warning denied winbox/dude connect from?
** Is this log indicating remote IP addresses trying to get into my CHR via a potential vulnerability which has been discussed many times here ? **

This is from my public btest server. This btest server is the public 207.32.194.24 btest server that is always in use by other Mikrotik admins.
. . .

North Idaho Tom Jones

The question in the next I was phoned by the cyberpolicy and said that my router is infected with a virus, that I need to reset my device and set it up which I do not really want to do.
Will I have enough passwords and firmware updates?

That´s a fraud/fake call, google for that one that wants you to pay him.

The question in the next I was phoned by the cyberpolicy and said that my router is infected with a virus, that I need to reset my device and set it up which I do not really want to do.
Will I have enough passwords and firmware updates?

That´s a fraud/fake call, google for that one that wants you to pay him.

The fact is that it was the police and they did not demand money from me, the provider gave them to them because the IP address is reserved for the director

Can somebody please tell me what this log information is (in dark red below containing warning denied winbox/dude connect from?
** Is this log indicating remote IP addresses trying to get into my CHR via a potential vulnerability which has been discussed many times here ? **

This is from my public btest server. This btest server is the public 207.32.194.24 btest server that is always in use by other Mikrotik admins.
. . .

North Idaho Tom Jones

Tom, let me apologize. I defined your btest server as a host in my local DNS, and gave it a box in my dude configuration, so I could more easily run infrequent tests when needed without having to remember all your IP information. Apparently, this causes grief in your log, because my IP is one of the ones you listed. Also apparently, a whole lot of other MikroTik admins have done the same thing I did, and they are generating all the other IP addresses. In order to run MikroTik speed tests, I had to tell the Dude that you were a MikroTik device, and it looks like that causes it to bother you with Dude queries.

Technical details of the worm here : https://blog.talosintelligence.com/2018 ... ilter.html

Technical details of the worm here : https://blog.talosintelligence.com/2018 ... ilter.html

Please read this article:
http://linkcom.lviv.ua/%D1%83%D0%B2%D0%B0%D0%B3%D0%B0/
https://www.facenews.ua/news/2018/407644/

They are stating that all versions prior 6.42.1 are vulnerable.

Thanks for the prompt response Normis.

I assume people that were using the quickset dynamic dns vpn and appropriate firewall rules + updated fw would have been invunerable to these attacks ?

Any RouterOS version with firewall on the www port from untrusted networks was always safe. The original vunlerability that was fixed in march 2017 was only affecting you, if the www port 80 (webfig) was open to untrusted networks.

Firewall will as allways disable fastpath in your system. Setting source ip's allowed on the service is more direct lo level approach witch does not disable fastpath.

Hi Normis,

I still do not have a reply regarding 5.26 on R750GL, can you comment?

Best regards.

1. reset all configuration settings, uncheck 'keep default settings'
2. Disable all non-essential services:
   1. telnet
   2. http
   3. https
   4. ftp
   5. api
   6. secure api
3. Create a whitelist of admin IP addresses/netmasks
4. Add the following firewall filter rules to the beginning of the list
   1. Allow all admin whitelisted ips access to tcp 20,21,22,23,80,161,443,8291,8728,8729 on the input chain
   2. Block all access to tcp 20,21,22,23,80,161,443,8291,8728,8729 on the input chain
   3. Allow all admin whitelisted ips access to udp 161 on the input chain
   4. Block all access to udp 161 on the input chain
   5. Allow all established and related traffic (state) for both input and forward chains

Apparently VPNFilter is now scanning for port 2000 (btest server) on Mikrotik routers. Another exploit? Not many admins are aware that this service runs by default.

To be safe against any kinds of attacks, make sure you secure access to your devices:
https://wiki.mikrotik.com/wiki/Manual:S ... our_Router

Apparently VPNFilter is now scanning for port 2000 (btest server) on Mikrotik routers. Another exploit? Not many admins are aware that this service runs by default.

Again and again ... it seems be kind of sport nowadays to ask "Is Mikrotik volunerable because someone is scanning particular port?"
If you disable or limit sources's IPs for all new incoming connections then there should be no problem at all.
If you not secure your router then offenders will try to identify the brand and then try to attack.
Scanning ports is not an attack. I have some routers with IP range where some addresses are not used yet but I see on WAN ports traffic to unsed IPs.
Should I ask: "Are my Mikrotik's routers volunerable as they see and could accept traffic for nonexistient IP?"

If we/they have no proof that something is "broken" then they always could say "YES, it is safe".

If your have no open ports on your WAN interface, then you are completely safe from remote wired exploits of any kind.

now are more mikrotik devices affected.....

The fact that Mikrotik is still on the list due to them seeing Mikrotik routers still being hit by this means one thing only for Mikrotik users. They have failed to keep their routers current and are still running over a YEAR OLD (plus) version of ROS. Regardless of this virus attack, that is just bad practices all around.

The fact that Mikrotik is still on the list due to them seeing Mikrotik routers still being hit by this means one thing only for Mikrotik users. They have failed to keep their routers current and are still running over a YEAR OLD (plus) version of ROS. Regardless of this virus attack, that is just bad practices all around.

how to determine if my router is infected?

There is unfortunately no easy way to tell, since Mikrotik doesn't allow us shell access to our routers to perform this kind of examination.

how to determine if my router is infected?

- Upgrading to v6.38.5 or newer will remove the bad files, stop the infection and prevent anything similar in the future.

There is unfortunately no easy way to tell, since Mikrotik doesn't allow us shell access to our routers to perform this kind of examination.

There is a "check installation" feature but unfortunately it does not check if there are files on the router that are unaccounted for, even though this has been claimed.

Back in the Urgent security advisory, it was said that upgrading your RouterOS version would remove "the bad files" on the device.

The fact that Mikrotik is still on the list due to them seeing Mikrotik routers still being hit by this means one thing only for Mikrotik users. They have failed to keep their routers current and are still running over a YEAR OLD (plus) version of ROS. Regardless of this virus attack, that is just bad practices all around.

It's also bad practice on the part of Mikrotik when it comes to information, it took them over a year to email about the httpd vulnerability, and I still have not yet received an email advisory about the winbox vulnerability. You cannot expect all Mikrotik users to be checking forum and changelog constantly.

Mikrotik doesn't allow us shell access to our routers to perform this kind of examination.

If you think a device may be infected, netinstall is by far the safest option.

For now the best indicator of compromise would be to watch your outbound traffic at an upstream device

Just upgrade your routers to RouterOS bugfix >6.40.8 or stable >6.42.1

If the malware is already on the device with root level privileges

Just for the record, I don't think people need to check changelogs "constantly" but probably at least once a year might be cool. Maybe even every six months? Might be a stretch but just actually *looking* would be a start for most.

So , anybody got some ideas on how to do this and what can be found/checked/modified/fixed/enhanced/expanded ?
I would guess the bad guys already do something like this all of the time when looking for possible exploits on Internet connected devices.

One thing I have started doing as a preventative measure - block everything in the OUTPUT chain except necessary services (eg dhcp client, sntp client, etc).

Rich/Pe1chi do you mean something like?

/ip firewall filter
add chain=output action=drop protocol=tcp src-port=80

Rich/Pe1chi do you mean something like?

/ip firewall filter
add chain=output action=drop protocol=tcp src-port=80

Change that src-port with dst-port ...

That'll stop the check for upgrades of RouterOS from working, so not very clever.
You should at least add a white-list item for upgrade.mikrotik.com first.

Rich/Pe1chi do you mean something like?

/ip firewall filter
add chain=output action=drop protocol=tcp src-port=80

Change that src-port with dst-port ...

That'll stop the check for upgrades of RouterOS from working, so not very clever.
You should at least add a white-list item for upgrade.mikrotik.com first.

To WHY?
What is the functional difference or outcome of
a. src-port=80 What is prevented, what are the outcomes positive and negative?
vice
dst-port=80 What is prevented, what are the outcomes positive and negative?

What is the functional difference or outcome of
a. src-port=80 What is prevented, what are the outcomes positive and negative?
vice
dst-port=80 What is prevented, what are the outcomes positive and negative?

So what IP is that? LOL, I don't know which domain or IP mikrotik uses when checking for updates LOL. I suppose I could add an exception!

The winbox exploit was a 0-day - meaning it was being exploited in the wild before a patch appeared. If you weren't paying close attention to forums / changelog you were probably compromised within a week or two.

Re: ... since Mikrotik doesn't allow us shell access to our routers to perform this kind of examination. Lack of shell access also makes it hard to tell if upgrading a compromised device actually removes the compromise ... VPNfilte ...

Re: ... A thought on how to possibly examine a Mikrotik x86/CHR file system. ... Then just cd /mnt/"Mikrotiks-x86-CHR-file-system ... I would guess the bad guys already do something like this all of the time when looking for possible exploits on Internet connected devices ...

Once your device is compromised it can do anything. What actual value is there in changing user-level rules within a compromised router for what it can do? It has already been compromised, by no less than one of the most sophisticated state-level malwares seen to date ...

Full list of affected RouterBoards since now

Thanks, so other than the microtik update service there is really no need for port 80 traffic on the output chain (from the router either with a source port of 80 or with a destination port 0f 80).

Are they supposed to be there or is this Mikrotik ROS system VPNfilter compromised ?

Just upgrade your routers to RouterOS bugfix >6.40.8 or stable >6.42.1

As I said, doing that I would lose opportunity to find out if our otherwise heavily secured network has been breached. So I would really appreciate to know, i mean really know, not only guess if we were infected.

In looking into one of my possible compromised Mikrotik ROS systems, I see in the underlying vmlinuz (compressed Linux kernel) user dat file what appears to be two additional user accounts which are not visible in the Mikrotik user manager system.
The two accounts in question are:
adminb (as in admin Backdoor)
adminr (as in admin Remote -or- admin Recovery)

Are they supposed to be there or is this Mikrotik ROS system VPNfilter compromised ?

What architecture is your potentially compromised system?

What architecture is your potentially compromised system?

This was a in-house lab x86 system (non-production - but live Internet connected) system we sometimes used to ping to and btest to. Because it was not production and stand-alone , it had no firewalls on it.

FWIW, I use the following related best practices when I set up a router that has a public-facing interface:

1. reset all configuration settings, uncheck 'keep default settings'
2. Disable all non-essential services:
   1. telnet
   2. http
   3. https
   4. ftp
   5. api
   6. secure api
3. Create a whitelist of admin IP addresses/netmasks
4. Add the following firewall filter rules to the beginning of the list
   1. Allow all admin whitelisted ips access to tcp 20,21,22,23,80,161,443,8291,8728,8729 on the input chain
   2. Block all access to tcp 20,21,22,23,80,161,443,8291,8728,8729 on the input chain
   3. Allow all admin whitelisted ips access to udp 161 on the input chain
   4. Block all access to udp 161 on the input chain
   5. Allow all established and related traffic (state) for both input and forward chains

The effect of this is that if a firmware upgrade accidentally clobbers one of these settings or one of my admins mistakenly deletes or disables a rule, I still have the other to fall back on.

For reference:
port 20 = ftp data port
port 21 = ftp control port
port 22 = ssh
port 23 = telnet
port 80 = http
port 161 = snmp
port 443 = https, sstp (do not block if you need to create an sstp connection to the box)
port 8291 = winbox
port 8728 = api
port 8729 = secured api

Set up the rest of your firewall as needed for your application.

Add a drop all rule to the input chain on the filter tab.

After an hour, make sure that you're getting packet counts on the drop all rule. If you're not, you've got another rule before it preventing packets from getting to it, and it's probably a misconfigured rule. It's pretty much a sure thing that you'll be getting traffic coming on the router's WAN interface that is unwanted traffic.

I have a similar box, created a user called "theboss". This appeared in user.dat. I backed up user.dat first as user-old.dat
I then deleted that user, however the line didn't vanish from user.dat

@TomjNorthIdaho: I guess it's still the same (and unlikely to change) as last year, when the http server vulnerability was fixed, i.e. tough luck, use firewall.

I don't think there are too many residential users with surviving mipsle devices. But yeah, it would be a nice gesture to make fixed versions for them (at least two, for 5.x and 6.x). Then again, probably only few would appreciate it.

And yes, mipsle EOL was sudden and unexpected. If I remember correctly, there was even newer RC version in the works, but it had some problem on mipsle, and it felt like MikroTik just thought "oh screw it!" and dropped the whole platform rather than fixing it. It was a pity, because at least RB5xx were still good enough devices at that time.

The wireless vulnerabilities are mostly theoretical, it is not something that will go wrong just because it is there.
You need someone to go into the coverage area of your wireless and actively attacking it to then attack one of your users,
something that is not very likely to happen when looking at one particular installation.
The talk about those wireless vulnerabilities is mostly there to provide a newsfeed to IT news sites and for the ego
of those who discovered it, not really about the day-to-day risk they introduce to your or your customer's security,
especially when the wireless is only used as an access to internet, and another layer of secure communication (such as https)
is used on top of most communication.

This is of course different for the type of vulnerability in te admin interface that can be exploited over the internet and/or
using a worm, and which will eventually find its way to every vulnerable device. That is the type of thing you want to watch
out for, not those "we can hack your wireless" things.

Security advisory emails were sent to all users that are in our database.

I have not, however received any updates from MikroTik on the subsequent updates to VPNFilter status where essentially all devices running RouterOS were added to the original four cloud core router devices.

Security advisory emails were sent to all users that are in our database.

It has come to our attention that a rogue botnet is currently scanning random public IP addresses to find open Winbox (8291) and WWW (80) ports, to exploit a vulnerability in the RouterOS www server that was patched more than a year ago (in RouterOS v6.38.5, march 2017).

In other news, if I understand this correctly, ALL versions pre-6.43 (which is still in Release Candidate stage) are vulnerable to this 0-day WinBox exploit?

in 6.43rc17, something was changed in winbox service (thats why every RC since then has to use Winbox 3.14) to prevent MITM attack.

But that was done because there were bugs that allowed the retrieval of the unencrypted passwords (and thus the quick retrieval of valid user/password combinations as shown)

I am not convinced that in the current stable and bugfix versions there are no such bugs.

Apparently there are still users who have current software but unwise firewall configurations that get hacked.

After this change has been implemented, it will be more difficult to obtain passwords once another bug has been found that allows a remote attacker to retrieve the authentication database, but frankly I think it would be safer when there was some more compartmentation in RouterOS.
After all, even when there is a bug in the webserver, the webserver has no business reading the authentication database directly, so in a correctly designed system (where the webserver runs under a less privileged user ID) even a bug in the webserver would not have leaked this info.

The recent large security redesigns flowed from the April 0-day. Normis even explicitly stated it, so you are discussing nothing new: Advisory: Vulnerability exploiting the Winbox port [SOLVED]

in 6.43rc17, something was changed in winbox service (thats why every RC since then has to use Winbox 3.14) to prevent MITM attack.

No. And the purpose of this change has been explained here on the forum somewhere, and it has nothing with preventing MITM attacks.

*) winbox - improved authentication process excluding man-in-the-middle possibility (Winbox v3.14 required);

RouterOS used to store local user credentials in plain-text (or using reversible crypto), and that's what changed in 6.43rc.

Even if you are right with this one it is still vulnerability which is known and is not applied in current/bugfix.

How is it possible that actual bugfix version does not solve long time well known security issue?

Well, Telnet is vulnerable to MitM (in addition to usage of unencrypted plaintext password), and it cannot be fixed. Should they forbid Telnet in 'bugfix' versions?

Security advisory emails were sent to all users that are in our database.

Where do I register to get this advisorys?

What are you talking about?
v6.40.8 includes patches to fix known vulnerabilities including latest winbox port vulnerability.

Hopefully this a pointless discussion as with the new SRP authentication system it should protect from MITM

Code: Select all

/ip firewall
address-list add list=toknowall.com address=toknowall.com
filter add chain=forward comment="VPNfilter toknowall.com" \
  dst-address-list=toknowall.com action=drop log=yes

You still block CloudFlare and tons of other websites.

You still block CloudFlare and tons of other websites.

Well, https cert on this host covers "ssl894059.cloudflaressl.com", "toknowall.com" and "*.toknowall.com" - doesn't look like there are tons of other websites

You still block CloudFlare and tons of other websites.

Well, https cert on this host covers "ssl894059.cloudflaressl.com", "toknowall.com" and "*.toknowall.com" - doesn't look like there are tons of other websites