The new version is more reliable when uneducated administrators add new things like PPPoE client.
It also fixes an issue where incoming traffic over IPsec is dropped by default, which users usually would not want.
When ether1 is really your internet interface (i.e. where your default route points) it is otherwise not more secure.
Don’t forget that until recently, even router with no firewall was sort of safe (if it had at least strong password). Even to become open resolver, user had to manually enable remote requests (most probably did that). Same for becoming open web or socks proxy (fewer did so, because proxies are not used that much). Router’s own services didn’t allow unauthorized access either.
So if it wasn’t for www and winbox bugs, things wouldn’t be perfect, but not extremely bad either. I’m not really buying current “if you want it secure, you must not allow anyone to connect”, just because MikroTik hates to admit how bad these bugs were and tries to shift blame on users.
But I don’t want to repeat myself (although maybe I’m not, because my post in other thread did strangely not appear, I see it in search, but not in thread; perhaps there’s moderator approval required for posts in announcements forum, I don’t know).
I can see the top of Sob’s posting in the preview. And what happened was the unimaginable happening. A buyer of a device, you expect that it won’t share your secret information, that you need to use that device.
It was a blindspot on the side Mikrotik that it not was discovered during audits of this most vulnerable part of the router.
One think I’m missing is information to the Distribution, they know the big Customers, so all get informed not only the ones, that look at Facebook or here!
Let’s face it, it was horrible mistake and oversight. But what’s done is done. It’s easy to bash MikroTik, but it can happen to anyone. Everyone hopes that such thing won’t ever happen to them, and they won’t have to explain it to their customers. But you never know, only 100% safe way is to not write any code. And that’s clearly not the solution.
Everything bad is good for something. It will make some people think more about security. I did that after www bug and realized that maybe I don’t absolutely have to keep some services (WinBox included) accessible from everywhere, even though it was convenient and should be safe with strong passwords. Others will have similar thoughts now. But please don’t go overboard and say that the only secure way is to block everything. Many services must be accessible from everywhere by design. And if they can survive, so can WinBox.
About current situation, damage is done and it’s not the end of it. Those articles mention some 200k infected routers, some more will follow, some will be fixed, but unless hackers make a mistake and visibly break something, many of them will be infected even years from now. And there’s really nothing to be done. Some ISPs started to block incoming connections to tcp/8291 (not ideal solution) and many will probably stop there. Others won’t care at all, until it starts to harm their networks. And users, half of them won’t care or won’t know what to do even if someone alerts them.
Does the latest bugfix fix this, or do we need to be on 6.42? I don’t really like using non-bugfix releases. If it isn’t, can you guys work to update bugfix?
Yes, last bugfix 6.40.8 is fine (+ change your passwords after upgrading, restore your configuration and inspect it for unknown settings, implement a good firewall)
What’s new in 6.40.8 (2018-Apr-23 11:34):
!) winbox - fixed vulnerability that allowed to gain access to an unsecured router
The warning e-mails by Mirkotik are sent out a day after news. I hope next week we will be informed why informing resellers and users that were on the mailing list were not informed earlier about the risk. If creating a CVE would have reduced the number of routers being infected to spread bad software?
Looking forward to that and maybe Mikrotik will layout a plan how they are going to handle security risks in the future and if they going to think and implement a way to warn owners of routers that are not updated and form a risk to the rest of the internet.
Hands up who is daily following CVE news?
[quote=Companion post_id=678178 time=1533399348 user_id=101447]
Is it not possible to integrate Firewall default rules into Mikrotik devices so that the user can not delete them, just turn off (ON-Off)?
Create default options so that we only open what is needed. No default open 21.22.23 port. For example, if you need to add a firewall filter, this could be done as before, but it would not affect the default configuration in any way.
It would be ideal if mikrotik were to think of a case like a built-in firewall from the factory, which can be disabled if necessary, but then the normal user saw the message - your router is not protected or similar. That would improve the situation.[/quote]
It is already like that! There could be a minor improvement: to update the default firewall when a new version is loaded with another default firewall.
But other than that, it works like you suggest it should work. The problem is caused by incorrect action by the user, often directed by incorrect Youtube videos that are not from MikroTik.
There is little that can be done.
[quote]
The same goes for downloading updates. Create a simple section with a check-in option - Allow auto updates. If you do not want to - no check-in
[/quote]
I am all for an auto-update function. Configurable of course.
By default it should auto-update. Users should be able to turn it off and to configure the update channel to use.
There should be a separate update channel that releases “required updates” and that is the default for new devices.
(so every device does not track all the updates by default, but it only installs updates that MikroTik have marked as “required”. those will be the updates that fix vulnerabilities, not those that merely are further development of features. once in a year or so, a feature development could be marked to be auto-updated after it has been found to be stable and without issues)
I have bookmarked for Mikrotik and AVM now. AVM had a good run after the last containment of the VOIP vulnerability. ISP often offer also VOIP and the had to compensate customers for the expenseive calls made due to this vulnerability.
Version 7 by AVM is rolled out whole we are speaking and it is based on a more recent version of Linux and let’s hope all checks move with it.
Since a few months we have now GDPR laws which regulated protection of private information.
I think that I can state that password falls also under the GDPR and that would have the impact that Mikrotik did not do enough, to protect their customers under the GPDR.
From the GDRP Wiki-page: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation
According to the European Commission, “personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address.”[7]
As you care about IT-security, and you’re right to do so. I asume you’re using some sort of password-manager so the password isn’t related to you.
Besides that, the GDPR protects you for data-stored by companies, the password is stolen from your own router, you can blame MikroTik for the security-flaw in the RouterOS software, but you cannot state that the GDPR applies to it.
If all our account on this forum where breached, yeah, than you have the right to say MikroTik didn’t protect our data accordingly to the GDPR, but that doesn’t apply here.
Thanks Bram for explaining this and the access data was indeed stored in the device and so not with Mikrotik. Was stored, this because the password is not stored in router anymore, if I remember that well?
Some kind of hash of the password has to be stored in the router unless you’d use RADIUS for remote authentication, but cleartext passwords are not there any more.
tell that to the several routers which were compromised today, running 6.40.8.
@BrianHiggins: It would have to be either:
a) something new (the same WinBox exploit doesn’t work with 6.40.8 )
b) you didn’t change passwords
c) you changed passwords before upgrading and previously infected system managed to send them out before the upgrade happened