Slashdot Mirror
MikroTik Routers Are Forwarding Owners' Traffic To Unknown Attackers (bleepingcomputer.com)
Attackers have been exploiting vulnerabilities in MikroTik routers to forward network traffic to a handful of IP addresses under their control. "The bug is in Winbox management component and allows a remote attacker to bypass authentication and read arbitrary files," reports Bleeping Computer. "Exploit code is freely available from at least three sources from at least three sources." From the report: 360Netlab announced in a blog post today that more than 7,500 MikroTik routers across the world are currently delivering their TZSP (TaZmen Sniffer Protocol) traffic to nine external IP addresses. According to the researchers, the attacker modified the device's packet sniffing settings to forward the data to their locations. "37.1.207.114 is the top player among all the attackers. A significant number of devices have their traffic going to this destination," Qihoo experts inform.
The analysis shows that the attacker is particularly interested in ports 20, 21, 25, 110, and 144, which are for FTP-data, FTP, SMTP, POP3, and IMAP traffic. An unusual interest is in traffic from SNMP (Simple Network Management Protocol) ports 161 and 162, which researchers cannot explain at the moment. The largest number of compromised devices, 1,628, is in Russia, followed by Iran (637), Brazil (615), India (594) and Ukraine (544). The researchers say that security outfits in the affected countries can contact them at netlab[at]360.cn for a full list of IPs.
The analysis shows that the attacker is particularly interested in ports 20, 21, 25, 110, and 144, which are for FTP-data, FTP, SMTP, POP3, and IMAP traffic. An unusual interest is in traffic from SNMP (Simple Network Management Protocol) ports 161 and 162, which researchers cannot explain at the moment. The largest number of compromised devices, 1,628, is in Russia, followed by Iran (637), Brazil (615), India (594) and Ukraine (544). The researchers say that security outfits in the affected countries can contact them at netlab[at]360.cn for a full list of IPs.
For someone in the security community to not know the significance of sniffing SNMP traffic is quite sad.
Having the community strings would give an attacker the ability to map out every device on the entire network. In some cases the right community strings would give them access to change the configuration of the routers, firewalls and switches on the network. SNMP v1 and v2 are not secure.
Install Openwrt firmware instead
Check if your router is compatible with openwrt first
Openwrt.org
Patches were released by Mikrotik in April. The upgrades are easy - just a few mouse clicks. Configuring automatic upgrades is also easy. Out of the box, the routers come with a secure WAN configuration.
Given this scenario, if users do not upgrade their router for a significant period of time, and/or configure the routers in a insecure manner, I would not apportion much blame on the supplier.
All routers have had vulnerabilities. The question is how quickly the manufacturer fixes them, if the vulnerabilities were a result of malice or incompetence, is what I would use to judge the manufacturers. And Mikrotik would get one of the top ranks on these parameters. The article does not bring out these details.