Slashdot Mirror
MikroTik Routers Are Forwarding Owners' Traffic To Unknown Attackers (bleepingcomputer.com)
Attackers have been exploiting vulnerabilities in MikroTik routers to forward network traffic to a handful of IP addresses under their control. "The bug is in Winbox management component and allows a remote attacker to bypass authentication and read arbitrary files," reports Bleeping Computer. "Exploit code is freely available from at least three sources from at least three sources." From the report: 360Netlab announced in a blog post today that more than 7,500 MikroTik routers across the world are currently delivering their TZSP (TaZmen Sniffer Protocol) traffic to nine external IP addresses. According to the researchers, the attacker modified the device's packet sniffing settings to forward the data to their locations. "37.1.207.114 is the top player among all the attackers. A significant number of devices have their traffic going to this destination," Qihoo experts inform.
The analysis shows that the attacker is particularly interested in ports 20, 21, 25, 110, and 144, which are for FTP-data, FTP, SMTP, POP3, and IMAP traffic. An unusual interest is in traffic from SNMP (Simple Network Management Protocol) ports 161 and 162, which researchers cannot explain at the moment. The largest number of compromised devices, 1,628, is in Russia, followed by Iran (637), Brazil (615), India (594) and Ukraine (544). The researchers say that security outfits in the affected countries can contact them at netlab[at]360.cn for a full list of IPs.
The analysis shows that the attacker is particularly interested in ports 20, 21, 25, 110, and 144, which are for FTP-data, FTP, SMTP, POP3, and IMAP traffic. An unusual interest is in traffic from SNMP (Simple Network Management Protocol) ports 161 and 162, which researchers cannot explain at the moment. The largest number of compromised devices, 1,628, is in Russia, followed by Iran (637), Brazil (615), India (594) and Ukraine (544). The researchers say that security outfits in the affected countries can contact them at netlab[at]360.cn for a full list of IPs.
have you inspected the source code? No, so do not use them. Just put your PC on the internet and use hosts files protection from /.
I don't use Winbox.
"I don't know, therefore Aliens" Wafflebox1
So they're targeting the non-SSL versions of services.
And SNMP being included is somehow a mystery? If you were the sort who wanted illicit access to people's systems, networks, and communications why wouldn't you want to also catch their SNMP strings? It's notoriously insecure yet shockingly common; a great way to dig deeper into a compromised site.
Is as a raw device with something like OpenWRT or other customized firmware
This was patched back in April and only affected people who left services open to the internet and not firewalled off. Even the default config protects these with firewall rules.
In short, you had to go out of your way to screw up the config to allow this to happen AND not patch it when it was known about.
Meanwhile, with Cisco, you get deliberate backdoors installed from the factory.
The analysis shows that the attacker is particularly interested in ports 20, 21, 25, 110, and 144, which are for FTP-data, FTP, SMTP, POP3, and IMAP traffic
Uhh, that's 143 for IMAP. 144 is for "NewS window system" or "Universal Management Architecture".
It is pitch black. You are likely to be eaten by a grue.
Great, so send spoofed packets to your router using the source addresses of google etc, watch your router block all access to legitimate sites for 24 hours because of spoofed packets.
After 24 hours you do it again, trivially easy denial of service.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Patches were released by Mikrotik in April. The upgrades are easy - just a few mouse clicks. Configuring automatic upgrades is also easy. Out of the box, the routers come with a secure WAN configuration.
Given this scenario, if users do not upgrade their router for a significant period of time, and/or configure the routers in a insecure manner, I would not apportion much blame on the supplier.
All routers have had vulnerabilities. The question is how quickly the manufacturer fixes them, if the vulnerabilities were a result of malice or incompetence, is what I would use to judge the manufacturers. And Mikrotik would get one of the top ranks on these parameters. The article does not bring out these details.
So... you sort of have a border agent that wants to look at all the data on your phone before it crosses the border?
Must be a U.S.A. router.
#DeleteFacebook
Most consumer isps in the west don't, most business focused isps or transit providers do, as do many providers in other countries. Guess where someone malicious is going to launch their spoofed packet attacks from?
http://spamdecoy.net - free throwaway anonymous email - avoid spam!