I have never used webfig for my routers. Winbox only and I only allow specific IP’s that access. I should be fine yeah? Most of my routers are currently at 6.41.
As stated before. All RouterOS devices were affected under following conditions:
- Webfig was open on untrusted networks (default firewall protects you, so this applies if you manually configured the firewall or removed the default);
- You had an older RouterOS version, before these releases:
Current release chain:
What’s new in 6.38.5 (2017-Mar-09 11:32):
!) www - fixed http server vulnerability;
And also Bugfix release chain:
What’s new in 6.37.5 (2017-Mar-09 11:54):
!) www - fixed http server vulnerability;
What to do:
- Upgrade RouterOS
- Change your password
- Configure firewall and other security measures according to this guide: https://wiki.mikrotik.com/wiki/Manual:Securing_Your_Router
NEVER LEAVE YOUR DEVICE OPEN TO THE INTERNET, WITHOUT SPECIFIC FIREWALL ACCESS RULES
Thats not correct.
Firewall will as allways disable fastpath in your system. Setting source ip’s allowed on the service is more direct lo level approach witch does not disable fastpath.
Hi Normis,
I still do not have a reply regarding 5.26 on R750GL, can you comment?
Best regards.
Unfortunately, the DNS server does not allow restrictions using ip / services.
What’s faster:
- no fastpath and IP firewall rule for blocking DNS;
or - bridge interface, ipv4 fastpath and bridge filter rule for blocking access?
I did reply that your version is below the one with the fix. If you have an exposed webfig interface to untrusted network, UPGRADE IMMEDIATELY
Good afternoon!
A few thoughts about this problem.
We also suffered an attack, lost more than 50 routers, and many had a firmware version of 6.42.2.
Access to the router is preserved, but the user admin has read-only privileges. In this case, a new root user appears in the system.
Analysis of the situation showed that it is not possible to restore the router through a netinstall, because the protected-routerboot option is enabled. To flash the equipment, you need to see the time set in the field of the reformat hold button, then we fix the reset button for this period of time and supply power to the router. Through the terminal (console cable), we confirm the formatting of the flash. Further through netinstall we restore the firmware. We go to winbox and restore from backup.
You describe a different attack vector. We have seen this before. It was a brute-force password guess attack to the FTP (If I remember correctly). This is not a vulnerability. Simply limit access to the device services from unknown networks.
If you have read only access with Winbox, you can see the “reformat hold time” setting, then you can wipe the device and reconfigure it. Follow manual about protected RouterBOARD on how to use the button to wipe all config: https://wiki.mikrotik.com/wiki/Manual:RouterBOARD_settings#Protected_bootloader
From the active services on the devices, ssh and winbox were installed. FTP was not active on any device. When starting in the console on all devices, there were reports of the inability to remove / var / run / vpnfilterw.
The process of restoring working capacity I described, by the way, support for Mikrotik in the email could not tell us this decision.
FWIW, I use the following related best practices when I set up a router that has a public-facing interface:
- reset all configuration settings, uncheck ‘keep default settings’
- Disable all non-essential services:
- telnet
- http
- https
- ftp
- api
- secure api
- Create a whitelist of admin IP addresses/netmasks
- Add the following firewall filter rules to the beginning of the list
- Allow all admin whitelisted ips access to tcp 20,21,22,23,80,161,443,8291,8728,8729 on the input chain
- Block all access to tcp 20,21,22,23,80,161,443,8291,8728,8729 on the input chain
- Allow all admin whitelisted ips access to udp 161 on the input chain
- Block all access to udp 161 on the input chain
- Allow all established and related traffic (state) for both input and forward chains
The effect of this is that if a firmware upgrade accidentally clobbers one of these settings or one of my admins mistakenly deletes or disables a rule, I still have the other to fall back on.
For reference:
port 20 = ftp data port
port 21 = ftp control port
port 22 = ssh
port 23 = telnet
port 80 = http
port 161 = snmp
port 443 = https, sstp (do not block if you need to create an sstp connection to the box)
port 8291 = winbox
port 8728 = api
port 8729 = secured api
Set up the rest of your firewall as needed for your application.
Add a drop all rule to the input chain on the filter tab.
After an hour, make sure that you’re getting packet counts on the drop all rule. If you’re not, you’ve got another rule before it preventing packets from getting to it, and it’s probably a misconfigured rule. It’s pretty much a sure thing that you’ll be getting traffic coming on the router’s WAN interface that is unwanted traffic.
Apparently VPNFilter is now scanning for port 2000 (btest server) on Mikrotik routers. Another exploit? Not many admins are aware that this service runs by default.
That’s why normis wrote in his original post…
To be safe against any kinds of attacks, make sure you secure access to your devices:
https://wiki.mikrotik.com/wiki/Manual:Securing_Your_Router
Again and again … it seems be kind of sport nowadays to ask “Is Mikrotik volunerable because someone is scanning particular port?”
If you disable or limit sources’s IPs for all new incoming connections then there should be no problem at all.
If you not secure your router then offenders will try to identify the brand and then try to attack.
Scanning ports is not an attack. I have some routers with IP range where some addresses are not used yet but I see on WAN ports traffic to unsed IPs.
Should I ask: “Are my Mikrotik’s routers volunerable as they see and could accept traffic for nonexistient IP?”
If everyone would adhere to the principle “block all and allow only what you need”, which is considered best practice, none of these discussions would be necessary.
Start with:
- allow all from (management) LAN
- allow established/related
- drop all
and work your way up from there on an “as needed” basis and be faithful to that (drop what you do don’t need anymore).
In such a case, any port scan is useless, unless you have an intentional running service on that port, which is easy to track by checking your firewall accept and port forward rules. Nothing which is “unknown” can pass anywhere.
And, if needed, use VPN techniques for remote management, not direct access on WAN ports. It adds a layer of security to it.
There’s a big difference between random port scans and targeted traffic to a specific port. MT devices without a firewall are trivial to identify due to service banners, I doubt attackers are trying to “identify the brand”, most will just send any exploit to any device. Given that VPNFilter is supposedly created by a nation state attacker, it’s a little more concerning to see it targeting a specific Mikrotik service.
R1CH
Scanning port 2000 is not new one … I see it from long time .. I do not agree that scanners do not identify routers … they scan them for “well known” ports to make proper attack instead of blind tries.
The point is that asking “is btest volunerable?” or “is service >>name of service<< volunerable?” just making noise and panicking than reporting problem.
Guys, you don’t understand me.
Situation for example:
- i want enable bandwidth test server for access from ANY IP without authentication
Anybody can get admin access to my mikrotik?
When i say “vulnerable” I mean vulnerability as winbox for version smaller then 6.42.1
(yes, I am test scanner and get admin credentials from unfirewalled routers).