Removing Mikrotik elements from beacons

RouterOS Wireless Networking
1

Hello,
Is there a way to prevent RouterOS from advertising itself in the 802.11 beacon frames? It’s not so great to publicly broadcast the radio name, model name and RouterOS version to the world. This makes exploiting of Mikrotik networks much easier, since an adversary doesn’t even need to break the WPA2 key before knowing if the device is running a vulnerable version of RouterOS. Removing these beacon elements would also help make the beacons smaller and reduce interference.

2

Bump.. still annoyed by the fact that anyone can see the version numbers.

3

Very true. I am with you. Two so far… Not enough. But one parameter for that shouldn’t be so big deal…

4

I agree. +1

5

Same here

6

+1,

this should already exist since the moment they implemented this information.

7

agree. +1

8

This is a vulnerability +1

9

Didn’t even know they were doing this, that’s definitely something I’d like to turn off. +1

10

+1 good idea

11

Agreed

12

Hi,

Wireshark does not have a decoder for the RouterOs beacon tag. I’m thinking of making one :slight_smile:

The field is filled with this:

0000   00 00 00 01 1e 00 00 00 00 0a 66 2a 06 00 00 44  ..........f*...D
0010   34 43 41 36 44 36 37 38 44 37 37 00 00 00 00 00  4CA6D678D77.....
0020   00 00 00 05 02 6c 09                             .....l.

The D4…D77 is the radioname/mac of the wlan interface.

I’m running 6.42.10

DEC to HEX
06 = 06
42 = 2A
10 = 0a

In the code I see: ‘0a 66 2a 06’. Seems to be in reverse with 66 added.

Any one already figured this out? Or made the dissector?

Cheers,
Harry

13

Did some test with another board and the patron is as expected

6.42.9:
00 00 00 01 1E 00 10 00 00 09 66 2A 06 00 00 44 34 43 41 36 44 36 37 38 44 36 42 00 00 00 00 00 00 00 00 05 02 6C 09
…f*…D4CA6D678D6B…l.

6.40.8:
00 00 00 01 1E 00 10 00 00 08 66 28 06 00 00 44 34 43 41 36 44 36 37 38 44 36 42 00 00 00 00 00 00 00 00 05 02 6C 09
…f(…D4CA6D678D6B…l.

6.43.8:
00 00 00 01 1E 00 10 00 00 08 66 2B 06 00 00 44 34 43 41 36 44 36 37 38 44 36 42 00 00 00 00 00 00 00 00 05 02 6C 09
…f+…D4CA6D678D6B…l.

:slight_smile:

14

What about the lastest 6.44beta. Something different in the beacon?

15

+1, I would like to see it as an option to disable to make any mikrotik wifi device as generic wifi device as possible.

16

still see this behavior at least in 6.44.3
http://forum.mikrotik.com/t/seeing-3rd-party-mikrotiks-sw-version/132958/4