Last week we had 2 routers on our network compromised. Both were running 6.29.1 (yes I know its not the latest but ive been through the changelog and cant see anything relevant). In the log was shown a Single “login failure for user admin via winbox”, followed 8 seconds later by “user admin logged in via winbox”.
Now I know that the default admin username should be changed, and now has been on all my routers, the password being used on this router was not a dictionary password, or name, or something silly. This clearly is not a brute-force attach as there is only a single failed login previous to the successful login.
did router had web service active? had someone in your company left, or is planning to leave? Any disgruntled external tech? Are passwords common to all routers?
Did you netinstall the routers? hopefully you took a supout before?
Web service is disabled, so I assumed HTTP vulnerability would be irrelevant ?
No staff issues (that i know of lol)
Reading log from remote syslog server, no previous attempts
and didnt use netinstall.
There are no known security vulnerabilities and there haven’t been in the past. The mentioned Changelog entry refers to the Wikileaks documents, where something was mentioned, but with those tools never released, there are no known attempts to exploit that. More info: http://forum.mikrotik.com/t/statement-on-vault-7-document-release/106907/18
you should note the source IP address is from Palestine… - also I have sent you extract from the log showing other things being “done” after successful login that we wouldnt have done..
Is it possible that, for example, your computer is connected to some VPN service in Palestine and you have connected to router by yourself through VPN?
Is it possible, that you have “Keep Password” enabled on Winbox loader and someone got an access to your Winbox configuration files and stole a password?
Any indications what was done after obtaining the successful login?
That could be a clue whether it was malicious, and maybe what the vulnerability is.
Aug 3 00:14:19 xx.xx.xx.xx system,error,critical login failure for user admin from 5.11.41.216 via winbox
Aug 3 00:14:34 xx.xx.xx.xx system,info,account user admin logged in from 5.11.41.216 via winbox
Aug 3 00:16:19 xx.xx.xx.xx system,info ppp secret added by admin
Aug 3 00:16:27 xx.xx.xx.xx system,info PPTP Server settings changed by admin
Aug 3 00:16:52 xx.xx.xx.xx pptp,info TCP connection established from 5.11.41.216
Aug 3 00:16:53 xx.xx.xx.xx pptp,ppp,info,account Jcpth logged in, 0.0.0.0
Aug 3 00:16:53 xx.xx.xx.xx pptp,ppp,info : authenticated
Aug 3 00:16:53 xx.xx.xx.xx pptp,ppp,info : using encoding - MPPE128 stateless
Aug 3 00:16:54 xx.xx.xx.xx pptp,ppp,info : terminating… - no network protocols running
Aug 3 00:16:54 xx.xx.xx.xx pptp,ppp,info,account Jcpth logged out, 1 108 86 8 8
Aug 3 00:16:54 xx.xx.xx.xx pptp,ppp,info : disconnected
Aug 3 00:18:01 xx.xx.xx.xx system,info ppp secret changed by admin
Aug 3 00:18:08 xx.xx.xx.xx pptp,info TCP connection established from 5.11.41.216
Aug 3 00:18:08 xx.xx.xx.xx pptp,ppp,info,account Jcpth logged in, xx.xx.xx.xx
Aug 3 00:18:08 xx.xx.xx.xx pptp,ppp,info : authenticated
Aug 3 00:18:09 xx.xx.xx.xx pptp,ppp,info : using encoding - MPPE128 stateless
Aug 3 00:18:09 xx.xx.xx.xx pptp,ppp,info : connected
That sure doesn’t look good! I presume the “Jcpth” does not provide any clues to you?
That they could add a PPTP server without making firewall changes means you have to do some work
on your firewall as well. Implement a default-drop regime at the internet side (allow only what is required).
Of course it is always best to limit access to admin interfaces to predefined addresses, and when this is
not practical use a VPN for management or allow management only from the LAN side.
One thing I can tell you, this is not some random incident. The person clearly knows how to configure RouterOS.
Your supout.rif file also shows no firewall or any protection at all.
A firewall and choosing another user may be good ideas to deter possible attacks, but the critical question in this
case of course is: did the attacker get into winbox service by first doing an unsuccessful login, then maybe do some
computation on the result, and then do a successful login?
Or did he know the correct password beforehand? If so, why did he first get an unsuccessful login?
That he then immediately proceeded installing a VPN backdoor indeed indicates he knows what he is connecting to,
but more important is the possibility of some way to get logged in without previous knowledge of the password.
The supout.rif file shows he is actually in a private network, so the connection must have come from a local IP (ie. that IP may not be from Palestine after all). There are many strange things in his config …
We have firewall at our main edge router, not rules on each individual router (this will be changed imminently), we have now updated main firewall to block additional ports.
I know admin username should be changed, this has now been done.. The only username that exists on router was “admin”, and its not possible the password was known.
The access definately came from outside our network not internal IP.
The router does have internal IP for routing on our network, but also has public IP for local PPPoE.
I will send more info to support today regarding the configuration.
I have run a 10 hour trace on a /16 subnet on internet that of course receives a lot of background noise, but in this time window there was not a single attempt to connect to port 8291 from internet.
So it does not look there exists a widely known exploit, because as soon as this happens the different “research scanners” and other idiots start scanning the whole internet to find devices that have this port open.
(as is happening for some other router types e.g. on ports 5358, 7547 and of course 22 and 23)