“Recently, researchers at the Fujitsu Security Operations Center in Warrington, UK began tracking Upatre being served from hundreds of compromised home routers — particularly routers powered by MikroTik and Ubiquiti’s AirOS.”
“The consistency in which the botnet is communicating with compromised routers in relation to both distribution and communication leads us to believe known vulnerabilities are being exploited in the firmware which allows this to occur.”
Sounds like FUD. As you well know, MikroTik devices have firewall by default, on the public interface. Article blames use of default login/password, but this is not true for access from the internet.
Always possible people are disabling the firewall and not setting the password. Did a write up on this issue as it seems to have been more of an issue on the Ubiquity side with some actual evidence of the router being used as a distribution point for Dyre:
I know quickset will generally put a deny all filter rule on the wan input if used. But could you also put a security checklist or section for securing router access in quickset too?
Something that might let you specify an admin ip/subnet and then automatically populate firewall rules on all input interfaces permitting that admin address as well as changing the permitted addresses under ‘ip > services’ and the various tool discovery interfaces as well?
That way if you want the quick setup path you get the option of a bit more lockdown without having to find and configure the various commands scattered around the interface but if you’re more experienced you can still manage the total config yourself without using quickset.
I recognise the type of people who don’t know enough about the equipment to research securing it in production will be exactly the type of people who will loudly complain about being “locked out” by a security ‘wizard’ though.
But handholding in quickset and leaving everything else to the power user otherwise seems the least worst option for a ‘can’t please everyone all the time’ problem.