How to protect CCR router from DNS attacker.

RouterOS General
1

I have CCR routerboard since last 2days attackers were able to change DNS settings on Mikrotik router via api interface, so the clients were directed to attacker’s servers, as you can no doubt of guess SSL secured services immediately warned about certificate issue on clients’ browsers. DNS was the only setting that was changed, so we did not have any other issue, changed to DNS servers.

192.200.110.108 > is set as DNS server by the attacker.

2

Upgrade ROS to latest version, do not allow access to the router from public networks.

3

Read this thread: http://forum.mikrotik.com/t/security-attackers-changed-dns-servers/119776/1

4

Make sure that external attackers have no access to your router.
Do this by setting up a proper ip->firewall->filter input chain.
Only trusted networks should have access to your router.

5

Why was api service enabled?