Attack on port 45678

RouterOS General
1

Hello people,

I just mitigated a DDoS attack which starts from outside to my router port 45678/tcp and the router floods the upload connection sending data from that port to many other IPs on random ports!

Does anyone have idea what service is that port 45678/tcp on the mikrotik router? It’s an RB2011 with routerOS 6.43 (latest).

When i telnet the router on port 45678/tcp I get connected but nothing happens. It just read my data without answering anything and without disconnecting me!

Thanks in advance

Haris

2

My guess: on your hacked router socks proxy listens on port 45678.

Port 45678 is closed on my (so far) un-hacked RB.

3

There’s nothing on port 45678 by default. If you don’t want to click through Winbox/WebFig, just export configuration in file and look for “45678” in there.

4

Thank you very much.

Indeed I found that it was proxy enabled! But I never enabled any proxy. Probably a hacked router? How can I tell if it has been compromised?

5

Probably if it ran an old version and didn’t patch in time, it fell to this: https://blog.mikrotik.com/security/winbox-vulnerability.html

Safest way forward is to netinstall. Don’t forget to change all passwords.