hacked

optio

Maybe stupid question, but couldn't the (safe/complex/random/whatever) password be asked during the netinstall process for those (older) devices that still have the blank one?

Good suggestion! It will cover user access security if internet access is on any interface.

optio

How do you suggest the router will determine which port has internet access, and then disable it? You can't disable all interfaces. Is it possible to have internet access without default route is set? If not, which other than LTE can dynamically set default route without config? Edit: But this is i...

jaclaz

Maybe stupid question, but couldn't the (safe/complex/random/whatever) password be asked during the netinstall process for those (older) devices that still have the blank one?

Amm0

Just some clarification, all devices with LTE and WiFI come with default password for at least a year, I think. I have to check for up to date info. I think the last remaining devices with no password are CCR series. and if y'all add eSIM support... you'd have to provision something in config for L...

Just some clarification, all devices with LTE and WiFI come with default password for at least a year, I think. I have to check for up to date info. I think the last remaining devices with no password are CCR series.

Amm0

Sure, "interesting case" here, as @optio put... But solution is for @normis/team to update the netinstall and reset-configuration docs to clarify to REMOVE any potential internet source, including SIM cards. So, yes, "what if my SIM is stuck" - you hopefully find this thread. But...

SystemErrorMessage

... is there any way to check if your mikrotik router has been hacked? i know its possible for asus as ssh access is very useful but i never use asus as my main router only wifi. I know people use mikrotiks a lot ...

How do you suggest the router will determine which port has internet access, and then disable it? You can't disable all interfaces.

anav

Exactly, which I suggested above...
ROS without config should not have internet access because of exposed services.

On that we can agree LOL.

optio

Exactly, which I suggested above...
ROS without config should not have internet access because of exposed services.

rextended

There is an even simpler solution: On newer versions of RouterOS leave LTE turned off, it will be turned on in case of defconf that also set firewall in place.

Reset or netinstall without default config = no interface active except etherX and sfpX, like wifi is disabled if no default config.

New devices come with a default password. This is the only way I think can solve this issue.

optio

@Ammo As you wrote, not a common case, several cases matched: issue with SIM slot failed ROS upgrade - unable to boot, this is preventing for eg. configuring SIM pin before not expected netinstall (as @rextended suggested) without inserting it into another device public IP over LTE due to changes on...

rextended

Since in my test lte1 started immediately, but it took a while for the SIM to register to the network, it is more than enough to immediately set the password to the admin user, logging in immediately as soon as RouterOS has started... Easy step for not remove the SIM: Enable PIN, netinstall, do conf...

anav

or just apply script... It seem logic is here - more stupid people are ones which cannot for any reason remove SIM than ones that don't know that lte1 needs to be enabled to have internet access (if is mitigated like that) Go ahead and rely on scripts the rest of the "real" IT human race ...

Amm0

I think the FUD is a bit overblown. There is nothing to worry about a SIM being in a new unit with factory defaults. The default firewall will protect you and all LTE devices come with a firewall. And on newer AX things, there not a lot of reasons for netinstall, less so in starting from empty confi...

infabo

Maybe first line in provisioning script could disable all IP services:

/ip/service/disable [find]

Later on when IP firewall rules are added or at end of script you can selectively re-enable needed services with proper "address" restriction.

optio

Inconvenience to get convenience

I get your point and I do agree default inactive interface is the best way, security-wise.
But it may be inconvenient for some to enable it again

optio

Choose: convenience or security ?

Maybe convenience is not right term in case when such HW issues are present and requires a lot of effort to eject SIM including risk to damage it, convenience can be for eg. laziness when simple push-to-eject SIM is available.

Maybe reading a bit carefully won't hurt ... In some cases removing SIM from slot is not convenient ... then providing simple script to netinstall with command which disables lte1 interface is the way... Convenience is a factor which has a huge impact towards lowering security. Human factor BTW is ...

infabo

Sure, disable lte1 interface in script. But keep in mind, you have to wait until lte interface is available. Here is how default-configuration does it - in a very cumbersome while loop but this is how (limited) ROS scripting: :local count 0; :while ([/interface lte find] = "") do={ :set co...

optio

or just apply script...
It seem logic is here - more stupid people are ones which cannot for any reason remove SIM than ones that don't know that lte1 needs to be enabled to have internet access (if is mitigated like that)

infabo

A question of priorities: getting hacked or remove SIM.

optio

Maybe reading a bit carefully won't hurt

...In some cases removing SIM from slot is not convenient ... then providing simple script to netinstall with command which disables lte1 interface is the way...

anav

Genius, brilliant! Solution of the century. So basically remove the invisible cable wire.... who would of thunk it.........

You can always install without SIM being present.
Result: no LTE.

Mission accomplished.

optio

Generally speaking that is correct, but LTE device is specific when performing netinstall without config, it can provide internet connection without any config if connects using network provided APN and default route is dynamically assigned to LTE WAN IP, in other cases you need at least assign defa...

anav

The logic is NOT to connect to the internet until firewall rules are in place and admin information/access to router has been changed from default and secured. Relying on default anything in the router is the wrong approach. Just dont attach the cable or sim card etc, until the router is ready to be...

Iliasla

When resetting the router configuration, WI-FI interfaces are disabled by default. Developers also need to disable the LTE interface by default. This will be logical and will solve this problem.

You should keep trying netinstall. One suggestion is to unplug everything else from your router and from your computer. Disable wifi if you are on a laptop.
.....

+ Stop any firewall in the PC

SystemErrorMessage

... port 53 as source. for ppp if your customers connect using that you can use explicit allow for that protocol from LAN. The reason why you were hacked is because the input side of the router where you can manage it is accesseable from either WAN/customer. If you need remote access to the device ...

a hub will help with connectivity issues, it will improve it, yes.

CGGXANNX

It's probably the same hack as this https://forum.mikrotik.com/viewtopic.php?t=211182. Multiple people from my country recently also reported exactly the same on a local forum discussing MikroTik topics. The attackers (probably bots scanning RouterOS routers not protected by firewall) add a new user...

borte6510

You should keep trying netinstall. One suggestion is to unplug everything else from your router and from your computer. Disable wifi if you are on a laptop. Then connect the device like this: [PC] ----- cable ---- [basic ethernet HUB or simple ethernet switch] ----- cable ----- [router boot port] l...

borte6510

netistall hang point RouterBOOT backup booter 3.27 RouterBOARD 3011UiAS CPU frequency: 1400 MHz Memory size: 1024 MiB NAND size: 128 MiB Press any key within 2 seconds to enter setup Please, check ethernet cable... trying bootp protocol...... OK Got IP address: 192.168.88.3 resolved mac address C0:2...

You should keep trying netinstall. One suggestion is to unplug everything else from your router and from your computer. Disable wifi if you are on a laptop. Then connect the device like this: [PC] ----- cable ---- [basic ethernet HUB or simple ethernet switch] ----- cable ----- [router boot port] la...

infabo

A user can log in but have no rights to open terminal.
Read users can use Winbox terminal. That's not true.

You have no permission to open terminal in Winbox even if you have winbox permission. As said: !local or !telnet prevents opening a terminal inside Winbox.

borte6510

thanks for answer. I got the codes piece by piece. How do I recover the device?

A user can log in but have no rights to open terminal.

Read users can use Winbox terminal. That's not true.

borte6510

no, just type /export in command line (ssh) and you will see all config, and be able to copy from terminal screen

i understand you. there are more than 5000 hotspot users. and the codes are endless. it gets stuck somewhere. but i am trying with serial console. i will report the results.

infabo

I am sorry, just edited my previous answer. User may have !local, !telnet, !ssh and thus can't execute export, or I am missing something?

no, just type /export in command line (ssh) and you will see all config, and be able to copy from terminal screen

infabo

A user can log in but have no rights to open terminal.

borte6510

I don't understand, what do you mean "no authorization"?
if you can login, you can use export

did you mean file export?

my user is not authorized to write to disk

I don't understand, what do you mean "no authorization"?
if you can login, you can use export

borte6510

Yes, I can connect to the serial console. My version is 7.13 booter version 3.27 I can't export. No authorization. I can print but the code is interrupted and not all is visible. I've tried over and over. netinstall won't progress. thank you for the answers. still looking for a solution. After a few...

Hello everyone. Our 3011 device was hacked. Our users have been put in read mode. reset button is disabled. and I have no backup outside. we use Custom software for hotspot. configuration is important. how can I proceed. thanks. - What RouterOS ...

wfburton

I'v had issues in the past with netinstall. Usually the device, or more specifically the ethernet port of the laptop/pc causing the netinstall trouble. Funnily enough, i'v used usb dongles on the same machine that had a fixed etherport tht didnt work, but the usb dongle allowed the netinstall proce...

killersoft

I'v had issues in the past with netinstall. Usually the device, or more specifically the ethernet port of the laptop/pc causing the netinstall trouble. Funnily enough, i'v used usb dongles on the same machine that had a fixed etherport tht didnt work, but the usb dongle allowed the netinstall proces...

wfburton

netinstall does not see the device. stay in there; setting up elf image... or RouterBOOT backup booter 3.27 RouterBOARD 3011UiAS CPU frequency: 1400 MHz Memory size: 1024 MiB NAND size: 128 MiB Press any key within 2 seconds to enter setup trying bootp protocol.........................................

borte6510

No point in resetting anything as you have no idea why this happened and thus it will happen again. Do you a copy of the config prior to hacking to show........... Netinstall is the only viable method of putting a clean load, if the device is accessible. I don't have any configuration. I just saw a...

borte6510

netinstall does not see the device. stay in there; setting up elf image... or RouterBOOT backup booter 3.27 RouterBOARD 3011UiAS CPU frequency: 1400 MHz Memory size: 1024 MiB NAND size: 128 MiB Press any key within 2 seconds to enter setup trying bootp protocol..........................................

anav

No point in resetting anything as you have no idea why this happened and thus it will happen again.
Do you a copy of the config prior to hacking to show...........

Netinstall is the only viable method of putting a clean load, if the device is accessible.

kleshki

Your device probably has reset jumpers, you may try it. Also, netinstall may help, if bootloader is not in protected mode, otherwise gg.

borte6510

Hello everyone. Our 3011 device was hacked. Our users have been put in read mode. reset button is disabled. and I have no backup outside. we use Custom software for hotspot. configuration is important. how can I proceed. thanks.

BrateloSlava

... is simple to implement, but very easy to detect by attackers. In a couple of hours you will be watching your computers inside the network being hacked from the outside. And the likelihood of being hacked is very high. By (correctly) Setting up VPN access to the local network. In this case, the ...

jaclaz

Back to the off topic SIM card size issues :shock: . I think that it greatly depends on how the actual socket receptacle is made, in theory the nano is thinner than the micro (by a teeny tiny amount, 0.67 instead of 0.76 mm) to allow the adapter to have a "back sheet" (that can often be re...

optio

Thank you for getting the point of this topic. Now regarding applying default config on netinstall, my config is build around it, some defaults are slightly changed, some left as is, but if you export whole config and you need to import it again, it needs to be on clean install because if default co...

Amm0

I think @optio is getting a bad wrap here. He was trying re-enforce the point that an attack can happen quickly. And LTE can surprise you since it can, sometimes, take no configuration to come up and work with a public IP. (Now... having public IP on LTE is not that common, and more typical CGNAT fr...

optio

And it breaks when you use some amount of force to pull it out of tight slot.

infabo

Yes, these "frames" are connected initially. You need to break out if you need it smaller.

mkx

Unfortunately my MNO provides only nano SIM cards with adapters like this so I need to use adapter to insert into router. Isn't it that cuttings for different SIM sizes are not through? So if one needs e.g. micro SIM, only outer piece of plastic has to be removed. The rest is still decently sturdy ...

infabo

I used different nano-SIMs from different providers with their adapters and never had an issue. I even once had a microSIM trimmed down with a cutter to the size of a nanoSIM (so I could put it into a smartphone), years later used it in an microSIM adapter again. No problem at all.

jaclaz

Yep, but if the good Mikrotik guys (who have an established record for omitting even vital documentation and even when documenting it, doing it in the most minimal and succinct possible form) felt compelled to put this info in the manual, adding even a picture, it must mean that the issues with that...

optio

Unfortunately my MNO provides only nano SIM cards with adapters like this so I need to use adapter to insert into router.

jaclaz

The good Mikrotik guys did warn you, though :shock: : https://help.mikrotik.com/docs/pages/viewpage.action?pageId=73826313 SIM slot usage https://manuals.plus/wp-content/uploads/2023/10/Chateau-LTE12-Routers-and-Wireless-User-SIM-slot-usage.png SIM card slot is designed to use with Micro SIM cards. ...

optio

Connecting to the internet prior to having at least the requisite firewall rules in place is a fools game, unless one is into gambling. Well after thinking why I was doing it like that in the past and not bothering much, it was because my MNO always assigned me WAN IP behind CGNAT over network prov...

jaclaz

Only for the record, and as a side-side note, besides using the "right" adapter and not attempt to combine two into one, metal adapters (as opposed to plastic) do exist, they don't cost (IMHO) excessively more and they are much more sturdy and the SIM fits in them more tightly.

infabo

Maybe new models, on my SIM slot doesn't have.

Then you maybe crushed it somehow. My first Chateau in mid 2020 already had that.

anav

Connecting to the internet prior to having at least the requisite firewall rules in place is a fools game, unless one is into gambling.

optio

Sometimes 1+2 doesn't make 3.

Ikr, but I had that combination, got it from MNO, so I used it.

Chateau has a push-to-eject mechanism. Did not destroy my nano-SIM adapter in years.

Maybe new models, on my SIM slot doesn't have.

infabo

Yes sure Removed once and destroyed nanosim-to-microsim-to-sim adapter because it was very difficult to pull it out.

Chateau has a push-to-eject mechanism. Did not destroy my nano-SIM adapter in years.

jaclaz

Removed once and destroyed nanosim-to-microsim-to-sim adapter because it was very difficult to pull it out. Sure, life stinks. :( Anyway, there are three common adapters in a kit: 1. nano to micro 2. micro to standard 3. nano to standard Sometimes 1+2 doesn't make 3. The nano to micro is so thin on...

infabo

optio, I know. I've read your report. I know you performed a Netinstall without default config. My response was to kleshki's post:

P.S.: still propose MT to disable api/rest stuff in defconf to prevent such things. Those API hacks seem to be common.

optio

Isn't there a (removable) SIM card? :-? Yes sure :) Removed once and destroyed nanosim-to-microsim-to-sim adapter because it was very difficult to pull it out. defconf has firewall rules in place that dont allow api access from WAN. But basically I agree; API should be disabled by default in defcon...

infabo

defconf has firewall rules in place that dont allow api access from WAN. But basically I agree; API should be disabled by default in defconf.

kleshki

Nah there are lots of hosts that are focused on scanning such things. I got caught by the same thing and ALSO with api but on a fresh CHR on VPS. It's actually your fault that you netinstall with WAN/modem link up, eject it until your config is reapplied and device is secure. P.S.: still propose MT ...

jaclaz

Isn't there a (removable) SIM card?

optio

... open Terminal (Terminal - not permitted (9)) because I wanted to apply my configuration from export. This raised suspicion and I looked into logs: hacked.png Device got hacked approx 1 minute after connected to internet, created backdoor System user and changed api port. Since Chateau LTE12 is ...

kleshki

... situation, where I did fresh CHR installation on a VPS using dd, and was literally too slow to login though VNC and change password before getting hacked - because router received IP and has no password at default, so had to request OS reinstall.

jaclaz

It sounds like your device has been attacked/hacked, there are several reports that an user "system" is created with all privileges and admin is limited to only a few ones. https://forum.mikrotik.com/viewtopic.php?t=202945 Only way out ...

abbio90

if it was exposed they probably limited your admin account and created the system account. they often get hacked with APIs

TheCat12

... is your whole firewall filter, you better unplug your router from the internet, add all missing rules from the forward chain and pray nobody has hacked anything on your network because at this state you're an open door. After you have done that, you can resume searching the issue in your dst-nat ...

peich1

If you didn't run script from Windox and you have log with its source could be that device is hacked, examine if you have some job running in /system/script/job , it should be empty if there is no active CLI sessions and no running scripts/events. I would recommend netinstall ...

optio

... Server, etc. didn't test error for all ROS events... If you didn't run script from Windox and you have log with its source could be that device is hacked, examine if you have some job running in /system/script/job , it should be empty if there is no active CLI sessions and no running scripts/events. ...

... to get the effect reliably so the lesson doesn't fail due to clever electronics in the PHY compensating for the purposeful nonidealities in the hacked-up cable. Simplified, equation (1) from my link above is L=X/(2πf). It gives you the inductance of the bead (or beads, in series) needed to get ...

anav

... log=yes protocol=tcp to-addresses=192.168.50.19 to-ports=25 { **** HOSTING AN UNencrypted MAIL SERVER IS A VERY BAD MOVE AND INVITING GET HACKED !!!!} add action=dst-nat chain=dstnat dst-address-list=MyWAN dst-port=110,143,465,587,993,995,4190, log=yes \ protocol=tcp to-addresses=192.168.50.19 ...

infabo

... professionally with ROS nor have knowledge of ROS or networking in general. This is disgusting. You literally should have issues (and probably get hacked) if you're too lazy to set your own password yourself. As in real life, every action (or lack of) has its consequences. Pay someone to do it ...

ksx4system

... really go to hell. That's like lobbying for cars without seatbelts... This is disgusting. You literally should have issues (and probably get hacked) if you're too lazy to set your own password yourself. As in real life, every action (or lack of) has its consequences. Pay someone to do it ...

skycanfiya

I had a same issue, it is the api service didn't turn off, someone hacked in and did the same thing.

abbio90

it was probably exposed with a public IP during installation and they hacked it. happened to me too.

IMG_20240707_072642_434.jpg

marekm

... The warnings about ground loops etc. may suggest the power supply has positive ground, or possibly floating. Perhaps external -48V DC could be hacked by using the hot-swap PSU connector instead of inserting the PSU itself. Older CRS328-24P had negative ground for both +24V and +48V PoE. Fully ...

Kanzler

I think it’s worth writing to support@mikrotik.com and clarifying whether such a user could appear after the update. Because at first glance it looks like the router is hacked

anav

Using an un encrypted mail system/server is asking to get hacked.

HannesKruger

... plane of a lot of MikroTik routers, you have a target on your back. If you end up being the reason all your users' MikroTik routers were hacked... that's it, curtains. Skills are expensive. Over the last five years, we've spent more than the cost of 10 brand-new Tesla Model 3s, and we've ...

mkx

... due to some reason (1. just because they can; 2. these don't seem "legit" connections so let's save our users from being extensively hacked; 3. because some government agency tells them to do so; etc.) There was an ISP in my country, which provided (and still does) internet via PPPoE ...

pe1chl

... would consume all memory, and then MikroTik would run the risk that an outraged user would spam all the way over internet that their router was hacked because it failed to block an attacker even though they had configured protective measures? That would not be great, either. You cannot defeat ...

patrikg

Oohhh I get it, thanks for that, but i have to make some tools for hold the reset button in in 10 min. reformat-hold-button-max: 10m That have solved my own problem very early with I have change the routerboot from bootp to dhcp, and not get it back to bootp to enable use of netinstall-cli. https://...

pajapatak

Even if protected-routerboot is enabled, it is still possible to do a recovery, according to RouterBOARD documentation: https://help.mikrotik.com/docs/display/ROS/RouterBOARD . As an emergency recovery option, it is possible to reset everything by pressing the button at power-on for longer than refo...

mkx

If reset button is indeed disabled[*] (a.k.a. protected routerboot), then your RB951Ui just became e-waste. [*] In theory it's not possible to enable protected routerboot without physical access to device, so it's unlikely that remote hacker did it. If you didn't do it yourself, then it still should...

rarriazu

Hi, my RB952Ui was hacked because I didn't have a password. Now, I can't log in with Winbox or Netinstall. The reset button is disabled. Is there any way to recover it ?
Thanks

johnson73

... environment as the primary one, then you absolutely need to arrange the traffic flow as shown in my example. Otherwise, your router can be hacked, your local LAN can be accessed and it will cause you a lot of other problems. Sonicwall and Cisco are a slightly different level of hardware ...

infabo

Requests from the server itself to wp-cron.php. Nothing wrong with that. Nevertheless, I think you should make yourself familiar with WordPress. Keeping it updated and secure is crucial when exposing it to public internet.

anav

Unplug router from internet. Netinstall latest stable firmware Put back config WITHOUT any port forwarding. a. think about having ONLY a server with a secure login process b. think about limiting in source address list which public IPs can access server. c. even better use wireguard and have people ...

vmax

maybe file is not attached.?? I cannot see it in my post.
Please advice if the file is not received by you.

vmax

Hello Erlinden,
please accept my apologies for this inconvenience.
If i know cannot asking you.
Attached please find configuration file named: forchecking.rsc

At your disposal with respect.

erlinden

In /ip/firewall/connections you can see all connections, just filter on Dst. Address 192.168.88.100 to get the list of Src. Addresses. Still unclear what makes you think your router is part of the hack. Especially because the only log you provide is from the XAMPP server. Can you provide your router...

vmax

Hello Normis. Thank you for replay. I have involved router, because as per my point of view, if router is hacked bad persons can send requests from internal IP. For first time i see hacker that attack using internal IP and cannot see real IP or MAC inside of router. In the log ...

The "hack" is coming from the internet to your wordpress server. Why would the router be involved at all? The hacker can visit your wordpress site just like any other internet user.

vmax

... IP is not visible. I am asking for guidance on how to find out where the attack is coming from. The computer has Malwarebyts licensed. Is mikrotik hacked or WinBox or something else. Here is an example from the server access log: 192.168.88.100 - - [15/Mar/2024:14:14:57 +0200] "POST /wp-cron.php?doing_wp_cron=1710504897.6459970474243164062500 ...

atais

... one is Static: 192.168.100.100 and they both are added to the MySever list which is used in NAT rules. It works. Should I be happy :D? Or I have hacked something again ;-)?

anav

... address from a trusted subnet. 6. SECURITY ISSUE ---> one should never provide direct external access to configuration ports........ asking to get hacked. Also source port makes no sense. /add action=accept chain=input comment="Allow Winbox & SSH" dst-port=8291,22 \ protocol=tcp src-port=8291,22 ...

danjde

... It has currently been sitting on top of the roof weathering the elements for years! I was interested in understanding if it could have been hacked but the problem seems to be another.. Again (if I can fix it), do you consider the update safe? Do I lose my settings? Thanks again!!

Amm0

... certs from a forum isn't a good idea, download them from the website itself is only slightly better. Although your current DNS servers have to be hacked for it to be a problem in the later case.

Amm0

Running your own game server with a port exposed is a dangerous game, you will be hacked or ddossed for sure. Best bet is cloudflare as that doesnt expose your public IP. Even the zerotier option is good because you control who has access to your server and again ...

Rihards9229

Running your own game server with a port exposed is a dangerous game, you will be hacked or ddossed for sure. Best bet is cloudflare as that doesnt expose your public IP. Even the zerotier option is good because you control who has access to your server and again ...

anav

Running your own game server with a port exposed is a dangerous game, you will be hacked or ddossed for sure. Best bet is cloudflare as that doesnt expose your public IP. Even the zerotier option is good because you control who has access to your server and again ...

johnson73

... to your ssh, winbox or Telnet, etc. It looks like you have too many ports open on your router. Blocks the Telnet port so that your router is not hacked from the outside... of course, if it is not necessary for some important task. And as the "good practice" shows, it should be blocked ...

mkx

... difference is that only router is wide open to attacks while LAN is slightly shielded behind NAT (which will mean nothing if/when your router gets hacked). Next: upgrade router to more recent ROS. Version 7.12.1 seems to be a good one (pretty stable and quite recent; newer ones got some major changes ...

cbwecomm

... Tried setting antenna gain. Tried setting power levels. Tried setting chains. Nothing made a difference. Both devices are configured with a simple hacked together script we use (Global variables just allow us to not have to type things multiple times), built off of a default config from an ax2 ...

infabo

But healthy again afterwards

kanuns

Netinstall and learn a lesson the hard way.

I did - its bitter tasting medicine.

infabo

If user accounts are part of the configuration files then yes: no access even after keep configuration setting.

pe1chl

Maybe this is your last chance to regain access to your device again without losing your whole config. Yes, you can get the config again but that will include your loss of access! So not useful to do that. The only thing that can be useful before netinstall is look around in the user interface if y...

infabo

Netinstall and learn a lesson the hard way.

JCDC

... error, just saying invalid password. last thing I did was active API and create home assistant user and password, don't understand wether i got hacked in some way throuh the API beacause I haven't changed my password and it was stored in my brower. winbox gives me the same result as webfig or ...

Netinstall and learn a lesson the hard way.

MaxwellsEq

In general, if a system has been hacked, you can have no faith in its configuration. As you say, because you couldn't run terminal, you couldn't export the current (suspect) configuration. But your problems started before you were hacked. ...

kanuns

When you still have admin access to the router you can use the /export command. /export show-sensitive file=routername Then you download the routername.rsc file from the router and save it. Sorry but there is no method to recover lost access to the router and keep the configuration. You need to app...

infabo

"The "Keep old configuration" process involves downloading the configuration database from the router, reinstalling the router (including disk formatting), and uploading the configuration files back to it. However, it's important to note that this process solely applies to the configu...

pe1chl

When you still have admin access to the router you can use the /export command. /export show-sensitive file=routername Then you download the routername.rsc file from the router and save it. Sorry but there is no method to recover lost access to the router and keep the configuration. You need to appl...

infabo

read the fine manual https://help.mikrotik.com/docs/display/ ... Management

kanuns

But I havent done anything. Its the first screen I am getting.

So now my only chance is to reset the router?

just for my knowledge, can you please also tell me what is the scenario on which the textual configuration is exportable ?

Thanks in advance

pe1chl

No, it is too late for all that.
You should have saved the backup and export files BEFORE this happened...
Now, the best thing is to netinstall, remove the checkmark for "keep old configuration", and start over from defaults.

kanuns

Hi,
I am not able to see any Textual Config option. Can you please help me in this regard. Where can I export the existing configuration so that I can check what the user configured before hacking. Is that also possible to get the password of the users?

Regards

tdampier

... return traffic also don't I? I am actually not being paranoid as a work computer which was on the same network when I had a simple flat one was hacked via the company network and then in turn hacked my entire network. Due to my work and complex home/work configuration they eventually even my ...

kanuns

Well, thanks, I wanted to get the Textual config. Ill try this netinstall thing. Many thanks.

mkx

By default there is no user System. So your router is likely hacked. Netinstall router and use textual config export as reminder what was configured. If you only have binary backup, then restore it after netinstall, do configuration export and netinstall ...

kanuns

... and it has full rights. By default admin users has normal rights but I cannot open terminal/backup settings etc. I dont know if my router is hacked or there is a default user named as System. Can anyone give me aa idea ?

rextended

That was a joke which you may have missed.

(sure?)
ah, I thought I had choice the wrong timing 2/4 (is 3/8)

That was a joke which you may have missed.
(but your comment was one too

)

rextended

"just press the reset button according to the notes of Beethoven's 5th symphony and you have all privileges again"

But what are you talking about? I tried and it didn't work...

infabo

Thanks, I already have one myself. But to discontinue such a helpful device makes me sad

wfburton

eBay?

infabo

And... woobm has been discontinued.

wfburton

Your going to have to do a netinstall. Sorry to say. Even if you connect to the serial port your still going to need a valid user name and password with admin privileges.

Good luck

And... woobm has been discontinued.

infabo

There is the Woobm USB Stick that emulates a serial console port. but still you need to login with a valid user/password.

anav

Why did you have unsecure API enabled and running.
Perhaps you need to take some courses before being allowed to setup a router?

Netinstall, stop arguing do it, you wont get any other advice, stop wasting our time.

FabFab10

@infabo
some devices let you connect to a console port and make some recovery procedures.........
I hoped there was one using a different connection

infabo

If there was a legal and official way to gain admin privileges again.....lol? Then everyone could make themselves admin? to be honest: what answer did you expect to hear? "yes sure, just press the reset button according to the notes of Beethoven's 5th symphony and you have all privileges again&...

FabFab10

Honestly i'd rather prefer trying to resolve it (if possible) and I have already disabled some unnecessary services.
But i need to regain full access to the system

erlinden

Sounds like you know what happened...were you hacked or not? If this situation is caused by a known user (like yourself), you might want to resolve it. If it's not, you really really should use netinstall.

FabFab10

Thanks for your reply. I'm pretty sure there was just a user modification, so if there is a way to regain group control of my user that will be fine. I know Netinstall would replace everything but if there is a way to modify group belongin for my user that would fix it. It happened with API service....

elbob2002

You should netinsall to factory reset the router. It's the only way to be certain that the compromise has been completely removed: https://help.mikrotik.com/docs/display/ROS/Netinstall That won't prevent you from future hacks though so likely you have an issue with your firewall rules or services op...

FabFab10

Hello, i found my admin user belongin to a new "admin" group and i can't any longer open a terminal window (telnet and SSH have been disabled for this group). I also found a new "Ssytem" user which has all privilegs. Is there any way to recover full access without having to fully...

johnson73

... not have enough secure access 2) problem with firewall rolls. The default rolls have been deleted and replaced with incomprehensible entries 3) hacked IP cameras that did not have secure access, resulting in flood and traffic congestion in the internal network. It is recommended to use a vpn ...

mkx

You should not simply add accept rules (even ISP's devices can get hacked). If everything seems to work for you, then you can simply ignore these log entries. If it bothers you in any way, then you can sniff the packets and see what's their purpose. From ...

gigabyte091

Yea, but both of us know what will people do with this disclaimer

That would be only good for Mikrotik, if some customer gets hacked or get charges for illegal activities on the Internet and they try to involve Mikrotik, Mikrotik can simply say that they had disclaimer.

gigabyte091

... vector more feasible due to its simplicity. Well, in that case, we should all stop using internet as there is always possibility that someone get hacked. Or use some of the VPN providers that "keeps your data safe". Mikrotik provided nice tool for all of us that don't have access to ...

ventusz

... big time). I can't really see a DHCP Request or ACK at all, only Discover and Offer. With my phone hotspot as a router I can see the 4-way dhcp. I hacked myself into the repeater via serial connection and it's running OpenWRT. Now that may be well beyond the scope of this forum, however I might ...

RichardCourtney

PPPoE issue perhaps?

Both ae based on the Realtek chips. I can tell that the Dimiks is a hacked version.
The web interface they removed the upper left corner graphic that was, I am sure, ODI.

I have a static public IP so I don't register with PPEo.

pe1chl

It is really very common that when first using netinstall (or when using it while in distress) one simply cannot get it to work. Besides the mistake that you made in this case, it generally is a picky program that will fail on many system configurations. It is always advisable to do a rehearsal of a...

cadutchman

Hi all, I was able to reset/netinstall the router. I made a rookie mistake. I was plugged into the Eth1 port and I had to be plugged into Eth7, POE/Boot port. Once I did that, the Netinstall went smoothly! Now I have a backup router for my core, cheers!

cadutchman

Tried that several times, did not work. Just to be sure I had the process down, I tried it on another RB and it worked fine.

anav

https://help.mikrotik.com/docs/display/ROS/Netinstall

see para H. --> viewtopic.php?t=182373

cadutchman

I am not sure if the router was hacked/compromised or the RouterOS got corrupt, but I cannot access the router via winbox using my username and password anymore. I did not change the password for sure. And I cannot reset it either using any ...

Josephny

Wow, kraal, you must have hacked my life! This is all for personal use -- so the users are tremendously demanding and unforgiving. I happen to have an RB5009 sitting around just being a dude server (nothing else). And, the hEX is running ...

jkroon

... 1 Recursion available: 1 Reserved: 0 Answer authenticated: 0 Non-authenticated data: 0 reply-code: 0 (no error) Please note that for the above I hacked djbdns to truncate to 512 bytes rather than directly after the question section in the response (ie, normally it won't include even a part of ...

gabacho4

... There are password managers that do the same thing but I don't like to give things like passwords to other companies who themselves then get hacked (I'm looking at you LastPass).

amsteen

... right. Last days I notice that some clients disconnects from wifi and they do many trials to connects again I found out that there is some one hacked wifi password and use their Mac address on his device to connect. How I know this > I notice that one of my client was outside while wifi registration ...

Amm0

... still needs some work... At some point I'll fix this up a bit more. I'd only done POST originally...so the GET/PATCH/DELETE methods I just quickly hacked in, but got messy. I did convert the RAML to OpenAPI, but didn't verify it, but might be helpful since more REST tools support OpenAPI. The RAML ...

IlKa

... traffic between them. Otherwise I suggest to put each server into the separate network and filter traffic between them. So if your server gets hacked, hacker wouldn't be able to go to another server from it. Network segregation is a thing! And do you really want to have DHCP for your servers? ...

MonkeyDog

... denial-of-service ones. So the first action should be to upgrade to latest long-term version (6.49.8 ) and then analyze whether the device was hacked as well (in which case netinstall has to be performed, together with configuring device from scratch, without using binary backup files). Thanks, ...

mkx

... denial-of-service ones. So the first action should be to upgrade to latest long-term version (6.49.8 ) and then analyze whether the device was hacked as well (in which case netinstall has to be performed, together with configuring device from scratch, without using binary backup files).

circos

... from beginning... no ones answer my question Why would we help you do something foolish? Doesn't that make us partially complicit if you later get hacked, after coming to rely on your bogus security solution? how can I in other option secure access from devices called IoT (like a refrigerator) ...

... such as dot1x. no ones answer my question Why would we help you do something foolish? Doesn't that make us partially complicit if you later get hacked, after coming to rely on your bogus security solution? how can I in other option secure access from devices called IoT (like a refrigerator) ...

pe1chl

... they may assign outside moderators (like is happening here) which suddenly have access to your private files, and/or the forum software may be hacked and anyone may be able to download your private files. Of course that issue more or less exists with Jira as well, but at least there we may ...

helipos

... where they are dying is behind a CG-NAT system which is pretty tough to get in to, so while I can't rule it out, I see no evidence they have been hacked. A hack coming from the wireless side is unlikely, this place is in the arse end of nowhere. So I'm after ideas. As to what might be going on ...

kashifmax

Yes you are right, can be hacked easily and that is I why I updated the RouterOS to v7. But unfortunately no Userman interface.
Thank you

rextended

... to still use 6.38, already years ago you must have switched to the last long-term (actually the 6.48.7). All versions from 6.29 to 6.42 can be hacked extremely easily, like a can of tuna....

atomicduck

... I never type, I set the pass alphanumeric as large as the system accepts. Say 50, 100 or more random generated characters. So devices can never be hacked due to poor account security. Security holes are another thing, but from what I have seen with MT devices till now is that they are fairly secure. ...

pe1chl

... that the owner himself now no longer can login, should he want to do that later (e.g. because their ISP advised them that their router has been hacked and is used for DDoS). So the real solution is to have a unique password per device. And it should be randomly generated and not e.g. derived ...

atomicduck

I do use KeePass as well. Storing password in a cloud together with many other user, is a big bait for any hacker so it will be hacked soner or later. (or lost since site has corrupted disk) Same logic here. I have thousands of passwords, keys and encryption certificates. I do backup ...

Jotne

Hm. Istn't evernote a bit unsafe? I use KeePass and store everything there. Encrypted and safe.

I do use KeePass as well. Storing password in a cloud together with many other user, is a big bait for any hacker so it will be hacked soner or later. (or lost since site has corrupted disk)

Amm0

... be too hard for Mikrotik to add: https://modbusfw.sourceforge.net. Given modbus often connects to physical things that if controlled wrongly/hacked could actually be bad/dangerous it be worth considering on their part. e.g. while DoS attack are bad, commanding a downstream modbus power/water ...

anav

... of the use cases compared to the real need by home users and some business users to secure servers. In fact, while MT is opening up routers to get hacked with that so questionable 'feature', they refuse to implement one that actually allows users to run servers WITHOUT exposing their public IP ...

garybdavis

... give me IP addresses and I can ping the router but not the internet. So close... A final thought, some years ago I had a MikroTik routerboard hacked and used as a DDNS attack - to the point that the router had to be reimaged. I'm paranoid now so first thing I did with this new box is spend ...

rextended

... but the only sure thing from the screenshot, that you have the admin account active, I'm assuming it's because of your misconfiguration that they hacked it for you. The first level of security is how the device is configured.

Johannes33

... do not get anything in the neighbors tab. Does anyone know why? Fourth I'm wondering if this can be the cause of a corrupted nand. The rb3011 was hacked before, perhaps there where a lot of r/w so my nand got a little corrupt? If so how do I reformat the nand?

justinus

... login will not work - it says invalid username or password every time. I have seen some posts regarding people getting their router logins hacked or changed, but this is a brand new device that has never been connected to the internet. I am extremely confused and have no idea how to access ...

tofik

Hi,
Just received this kind of message, look on the pic,

is it a real test or I might be hacked?

Pea

As mentioned, do Netinstall and move on. Use new username and password after this.
https://wiki.mikrotik.com/wiki/Manual:Netinstall

drdog

Keep in mind routerboot is just another disk partition, while unlikely it's possible for it to be compromised and allow malware to persist post-netinstall. In this case where the scheduler was used, it's more likely that RouterOS itself was compromised rather than the device itself. Thanks RICH for...

drdog

For all questions the answer is: Yes, it's possible. Just netinstall your routers if you are not sure about them. Thanks for taking the time to reply BartoszP. However your answer could be more informative than just, to paraphrase, “yes to everything”. If the RB was compromised it would be helpful ...

R1CH

Keep in mind routerboot is just another disk partition, while unlikely it's possible for it to be compromised and allow malware to persist post-netinstall. In this case where the scheduler was used, it's more likely that RouterOS itself was compromised rather than the device itself.

For all questions the answer is: Yes, it's possible.

Just netinstall your routers if you are not sure about them.

drdog

Having read about people noticing unusual scripts in their filing system, I had a look at my core RB. Sadly I didn’t get screen grabs for all, but I’m fairly confident that: No scripts on drive Nothing in scheduler Nothing in script list. However I noticed the jobs tab in script list and looked at t...

whoodini

... I didn't open it to measure the Voltage under load. To be honest, this is not the first time but rather the second time when one of my devices got hacked. I know this points out that I am clearly at fault, it was almost a year ago, same device different location, different version of ROS ~v6.47, ...

Search found 1700 matches: hacked