My multiple CCR router has been compromised. how to tackle this type of issue.
/ip firewall filter
add action=tarpit chain=input comment=
“Add you ip addess to allow-ip in Address Lists.” dst-port=30553
protocol=tcp
add action=add-src-to-address-list address-list=allow-ip
address-list-timeout=1h chain=input comment=
“The security flaw for Hajime is closed by the firewall.” packet-size=
1083 protocol=icmp
add action=accept chain=input comment=
“Please update RotherOS and change password.” src-address-list=allow-ip
add action=drop chain=input comment=
" Thanks are accepted on WebMoney Z399578297824" dst-port=53 protocol=udp
add action=drop chain=input comment=
“or BTC 14qiYkk3nUgsdqQawiMLC1bUGDZWHowix1” dst-port=
53,8728,8729,21,22,23,80,443,8291 protocol=tcp
/system note
set note=“The security flaw for Hajime is closed by the firewall. Please updat
e RotherOS. Gratitude is accepted on WebMoney Z399578297824 or BTC 14qiYkk
3nUgsdqQawiMLC1bUGDZWHowix1”
That’s rather funny!
- Restore your config to a backup version before you got hacked, update the firmware to the latest version
- Keep your firmware updtodate. Don’t use an easy to guess password.
- Block non-established input traffic from the internet, especially control traffic, unless you know what you’re doing. Even then be careful, an accident misconfiguration to say DNS or a web proxy and your router could be used for all sorts.
This doesn’t look like someone who is trying to cover their tracks, just a vigilante concerned about people running unsafe configs/firmwares. It looks like they’ve used the same exploits that the HAJIME worm [0] used.
vulnerability that affects MikroTik RouterOS firmware 6.38.4 and earlier, and which allows attackers to execute code and take over the device. This vulnerability, called “Chimay Red”, was one of the flaws included in the WikiLeaks “Vault 7” leak of alleged CIA hacking tools, and has also been used to compromise MikroTik routers by changing hostnames of vulnerable devices in the past year.
6.38.5 came out in March 2017 so you really should be patched.
What’s new in 6.38.5 (2017-Mar-09 11:32):
!) www - fixed http server vulnerability;
[0] https://www.corero.com/blog/882-hajime-botnet-scanning-for-vulnerable-mikrotik-routers.html
We got hit with that too on a test router. I took a backup of it before I wiped and updated the firmware. The funny part was we had firmware 6.41.3 on ours and that was only 2 months behind.
/ip firewall filter
add action=tarpit chain=input comment="Add you ip addess to allow-ip in Address Lists." dst-port=30553 protocol=tcp
add action=add-src-to-address-list address-list=allow-ip address-list-timeout=1h chain=input comment="The security flaw for Hajime is closed by the firewall." packet-size=1083 protocol=icmp
add action=accept chain=input comment="Please update RotherOS and change password." src-address-list=allow-ip
add action=drop chain=input comment=" Thanks are accepted on WebMoney Z399578297824" dst-port=53 protocol=udp
add action=drop chain=input comment="or BTC 14qiYkk3nUgsdqQawiMLC1bUGDZWHowix1" dst-port=53,8728,8729,21,22,23,80,443,8291 protocol=tcp
add action=passthrough chain=input
/system note
set note="The security flaw for Hajime is closed by the firewall. Please update RotherOS. Gratitude is accepted on WebMoney Z399578297824 or BTC 14qiYkk3nUgsdqQawiMLC1bUGDZWHowix1"
I had the same invasion yesterday in version 6.40.4.
I was have the same issue today.
The compromised port and were the vulnerability get into my router was API 8728.
I got this because i’m checking dayly my routers, and the rules was placed 3 minutes before, and i got this in the log. the router that i have is a Lab router to catch this kind of issues:
This is what i get in my log before the script was uploaded. I log the mikrotik log into syslog server, that why i get this trace.
system, info, account user admin logged in from 37.193.69.238 via api
My admin password is 20 characters long and it contains alphanumeric characters, thats why is “impossible” to get Cracked. This password is not saved in winbox and i write it every time thati need to get into this router.
After that login, they disable log notifications, and put the rules published in this post. That occurs 20 minutes ago from this post.
Please check if you have Mikrotik API service activated and deactivate the service.
- 1, also found this in one of our routers. We were scared when we saw it at the first time, but fortunatelly it seems that there were no bad-intentions at all.
We learnt something and will try to keep the routers updated / FW secured.
If you have anything Internet facing you must be vigilant.
Definition of vigilant
: alertly watchful especially to avoid danger
It is truly surprising that so many are:
- Not up on the current threat landscape.
- Fail to implement basic firewall restrictions on management services.
- Show surprise when their poorly secured device is infiltrated.
#2 Would have prevented the Winbox vulnerability although its still important to update to a patched version that closes this hole.
hiI need help how I can use firewall on mikrotik ti block an application named (netshare). I use hotspot so so people use this app to share free internet to others. you can find it on google play and how it work. I see that this app use port 8282 and it give the client a diffrent ip which is 192.168.49.1/24
and I find in netshare setting the proxy port is
1024-65563
so, please help me to block it. I use a diffrent ways but I coud not stop this application
I had such kind of the invasion too.
And now i updated routerOS from 6.41 to 6.42.3. I changed all user’s passwords and update my router from the backup which i had before the invasion.
But i find this string(screenshot) in the terminal window. What is it mean?
This note came from a backup when the routerboard was infected, just a note 
. Be calm, the board is no longer infected.
/system note edit note
Delete the text and ctrl with o for saving the changes!
Thanks a lot. I did it and after rebooting this string disappeared. 
You will have to decide for yourself if you trust that such people have only good intentions, and how well you are
able to check that they did not change anything else to your router than the firewall and the note.
At least check the users and the scripts sections to see if their are unexpected things.
Safest for sure is to netinstall the router and reconfigure it. Not by making a backup before netinstall and a restore
afterwards. You could do a /export before, manually search that for bad things and reconfigure the router from there.
But most important: you need to improve your firewall. Services like API, Telnet, SSH, Winbox and Webfig should
NOT be accessible from a random internet IP address. Preferably make them accessible only from the inside network
(so block them on the internet interface) but if this is impossible because all management is to be done from internet
at least use a list of allowed addresses or configure a VPN and allow management only via the VPN.
That’s quite concerning – you were hacked via the API while running a recent firmware (more recent than v6.38.5)?
There was also a change in the “admin” password, ad there was a new user added, with name “Admin”.
Several Mikrotiks got hacked yesterday so I have updated to ROS 6.40.8 and applied some ip services filter, and disable the http and https services and today I got hacked again the same messages
set note="The security flaw for Hajime is closed by the firewall. Please update RotherOS. Gratitude is accepted on WebMoney Z399578297824 or BTC 14qiYkk3nUgsdqQawiMLC1bUGD
what ROS version is really stop this vulnerability ?
So many ports: https://forum.mikrotik.com/viewtopic.php?f=21&t=134776&start=50#p665608 and have you checked which service ports are open?
Did you change also the username and password after the restore?
I know this may sound silly but it is quite important to ask - except from password change mentioned by Msatter, did you reset/reviewed whole configuration? If you just updated your ROS, added few firewall rules and left rest of config intact, there might be anything hidden. Even this message might be actually just leftover from previous hack. It is hard to say, but if there is suspicion, that vulnerability is still open, would be good to think about every possible option.
I did try my best to check what was in the new configuration and remove it before the update, and it didn't show immediately after the reload ,maybe it infected the backup file ?
Do you restored from .backup file not from configuration backup (.rsc file)?
Check to see if you have the api enabled. Firewall if you need it. Disable if you don’t. That is how they are accessing the device.