I recommend that you re-read all the posts from “normis”. Seems that we are going into circles.
Winbox port is used only to find out that this is RouterOS powered device (Winbox is not affected by vulnerabilities that we know of);
WWW service (“/ip service”) is used in order to “hack” your router if Firewall did not drop connections to this port (affected service was Webfig which by default is running on port 80, but you can change port under “/ip service” menu and then this other port must be protected). For example, “/ip firewall filter add chain=input action=drop in-interface=WAN connection-state=new”;
Issue with SMB is completely another thing but the same rules apply. If device (in this case SMB port) is protected by firewall, then no one can use this issue in order to mess up with your router. Usually attacks come to your router from public Internet (not from LAN) and in normal situation SMB access is not open for public Internet;
There is not and will not be an official way to gain access to routers shell.
You will be safe from both of these issues if you upgrade your routers (6.38.5 for WWW issue and 6.41.3 for SMB). In order to upgrade many devices at the same time - you can use MikroTik tool called The Dude or use scripts.
I hope you understand that the “NAT router to internet” scenario is not the only application of MikroTik routers, and that in fact
a lot of these routers are used in a scenario where there are many users (of which it is not certain that all can be trusted) interconnected
by (wireless) links.
Of course one would not deploy (IMHO useless) services like SMB on such routers, but it is quite common that the WWW service
is available at least to some local subnet.
Also, those networks are not always managed by one single entity. Users connect to a friendly neighbor, but there is no place
where an update of all devices can be performed, nobody has all the access and all the passwords.
On most routers we have a separate admin network so the users cannot connect it, and we also use address lists with trusted
addresses that are allowed to access the router admin interfaces, but this is not completely reliable (addresses can be spoofed)
and it is also not easy to manage (the use of DNS-based address lists is considered to fragile fo this purpose, and RouterOS lacks
a mechanism for central management of a large number of routers without custom programming). So on access points we normally
don’t have this address list and only the “block from outside our network range”.
So the generic solution of “assume all the bad guys are on the internet so firewall that and you are safe” is a little bit too limited.
We need good security for the built-in services, and foremost we need more openness from your side about security issues.
Not those vague “improved the reliability” on change notices when there is in fact a security issue being fixed.
And preferably some separate forum area or place on your website where security related info can be easily found, including
any known issues that have been fixed and in what version.
Don’t tell us that disclosing such information would potentially help the bad guys; we all know that it does not work like that anymore!
The information will get around anyway, except that it will be only in the hands of the abd guys and those that want to keep their
networks secure are left in the dark.
Dude ok , it is ok for update network (added to dude), but how upgrade clients not add to dude ?
I do not intend to add or monitor a few thousand clients in dude.
is there any way for dude to upgrade automatically without adding devices to the map / dude?
I do not want these devices in dude.
Only something on the basis of the range ip or class and does the upgrade.
Or it runs a script on each turn.
Normis - It’s somewhat comforting that Mikrotik is confident that the upgrade to 6.41.3 “cures” the infection. But, I have to say that random12’s posts have me very nervous. I understand that he has used an unofficial (or unsupported) shell to observe what’s running on his box, and that could be the source of his additional problem. But, I don’t think we have any clear evidence that the ram.info file, etc. running in memory on his 6.41.3 machine is not the norm after an attack by this botnet.
Can I suggest that it would be prudent of Mikrotik to review a number of previously infected machines (maybe 20 samples or so) and use your tools to verify that there are NOT any unusual files running in memory after a 6.41.3 upgrade (I understand that the files may left be on disk)? Then, assuming that it is true that a 6.41.3 upgrade does restore the machine to normal status, you can post that you have actually tested and analyzed 6.41.3 upgraded routers and confirm that an infected machine is absolutely clean after?
I am very concerned that random12’s process list is the same type of thing that I may have on a handful of infected machines. If that’s the case, we could all be sitting on a much, much bigger time bomb than what began last week.
If you have upgraded your router to the latest RouterOS version and you still have doubts that your router might be infected (we have not seen such case so far), then please contact support@mikrotik.com. If you have additional questions or concerns, then please send a message to support@mikrotik.com
Also I would never leave an open access for anyone besides me or other administrators for particular services. Had some of the MIPSLE units running on old version at the clients office - all of them were affected. Fixed them with Netinstall. Problem was - do not trust particular IP addresses. There was an open access for an IP which most likely was affected too and infected my route as well.
As this incident shows, massively not upgrading is an even worse idea.
What I suggested is a method of keeping a minimal version on routers configured to retrieve that from a configured location.
Upgrades can start manually, tested, and only when confident that the version to be installed is OK and the migration is smooth, it will
be made available for the others. Depending on the frequency at which the routers check if there is an update, the updates can still
be spread over time.
Note that not all networks are centrally managed. The internet isn’t, but some other networks aren’t either. So “pushing” updates is
not always realistic, but voluntarily pulling updates can be. However, there is no existing mechanism to do that, it can only be scripted.
We see a development (and others too) port scanning for winbox 8291 is dropping while port 2000 (bandwidth-test-service) is going strong.
Also telnet ist still highly active with those hijacked mikrotiks.
seems kinda logical. open tcp/2000 port can hint Mikrotik device as well, so the exploit against it can be launched.
as you have the credentials for a router, bandwidth-test is a great (built-in) way to launch ddos attacks.
I tend to think that you have detected malicious activity unrelated to the botnet issue discussed in this post.
An SMB vuln was resolved in 6.41.3. Perhaps that is your issue.
Release 6.41.3 2018-03-12
What’s new in 6.41.3 (2018-Mar-08 11:55):
!) smb - fixed vulnerability, everyone using this feature is urged to upgrade;
Given, I’d like to know more about this new SMB vulnerability, but there is a tough balancing act between the generic “SMB vulnerability” announcement, and providing details that might unintentionally make it easier for attackers to take advantage of the vulnerability before people have the opportunity to update. I don’t have SMB open, nor have I ever exposed port 80 to public sources. Not exposing services to any network unnecessarily is best practice. Discovering that after a successful attack is hardly Mikrotik’s fault. The security of devices we are managing which are connected to other networks are our responsibility to secure. May as well start with the basics like not exposing unnecessary services to the world.
That is just hogwash. The attackers do not use this information to know what devices they can attack, they have their own channels for that.
So keeping back details is just going to hurt the legitimate users, not the attackers.
The current "!) smb - fixed vulnerability, everyone using this feature is urged to upgrade; " is of course the very mininum that should be there in
the release notes, in earlier versions it was something like “!) smb - improved reliability of pathname scanner” and that not the info we as the users need.
However, it still can be improved. Like mentioning the CVE ID for each vulnerability that has been fixed, making it easier for users to evaluate
if this vulnerability is a problem for them. Often a vulnerability is mainly a DoS and in that case one could postpone upgrading a bit more than
in case it allows elevation of privilege or execution of code in highly privileged context.
(which is an area in which MikroTik apparently need to improve - a remote code execution vulnerability in SMB should be not so harmful when
the SMB software is running as a lower privileged user that has no filesystem access outside the user visible file area and there are no known
local privilege escalation attacks)
The automatic script spreading around the World uses Winbox port to determine a RouterOS powered device. You are not protected against the vulnerability from any other automated script or hacker attacking your device by protecting Winbox (or, for example, BTest server) port. You are safe only if you upgrade your device - this is the only permanent solution. You can protect your device by firewall - you will be safe from the attack only if you drop access for WWW service (since attacker can be also on your local network - we can not provide precise example how to protect yourself 100%. To put it in another words - WWW service must be allowed only for trusted devices).
Please note that we are providing an examples for you. Previously mentioned ways how to protect yourself, how to upgrade devices, etc. If you want to figure out the best solution for your particular case - please write to support. We will be happy to help you. We can not in single forum post provide an example of anything which would satisfy everyone and everyones network.
With massive upgrade I did mean many devices at the same time. I have upgraded all of mine as soon as I heard about the problem. But I always perform an upgrade one device by one. I have learned that from release topics where people are complaining that all of the devices have to be reinstalled due to the version. Why would you upgrade all of them right away… I never do that - one by one only!
Seems that TLDR applies sometimes in this forum. Answer for your question juliokato is right here https://forum.mikrotik.com/viewtopic.php?f=21&t=132499&start=50#p651331