Got it mounted and now I can cd into the ROS filesystem(s)
Please don’t ask me how to do this - I assume any decent Linux admin can already probably do the same thing
So a question to me is what is supposed to be in the /dev/sda /rw/store/user.dat file -and- ??? (take a look yourself if you know how to). Any security concerns here ?
I am by no means a Linux internals person , but I can’t help but ask myself a question “What other methods/accounts might be built-in that we don’t have normal access to see or manage?”
Part of the reason I ask myself is way back in the late 1980s I did find some hidden access (non-documented) systems in another very popular operating system which was in all distributions.
North Idaho Tom Jones
Full list of affected RouterBoards since now:
MIKROTIK DEVICES:
CCR1009 (new)
CCR1016
CCR1036
CCR1072
CRS109 (new)
CRS112 (new)
CRS125 (new)
RB411 (new)
RB450 (new)
RB750 (new)
RB911 (new)
RB921 (new)
RB941 (new)
RB951 (new)
RB952 (new)
RB960 (new)
RB962 (new)
RB1100 (new)
RB1200 (new)
RB2011 (new)
RB3011 (new)
RB Groove (new)
RB Omnitik (new)
STX5 (new)
If you have any of them backup and export configuration! And save it in a secured place!
There is no point in doing this for an already compromised router!
The value could be to add it to routers that are still unaffected, to avoid that it will become compromised.
Usually in malware like this, the attack can insert only a small amount of code e.g. the size of a buffer somewhere, and the code is used to “bootstrap” the actual
malware into the device by making it do an outside connect to a server or an already affected router to download the malware code.
That step is prevented by the output rule, and at that time the malware is not yet in full control of the router.
Sure, once the attackers know this they could first add an accept rule at the top of the output table but until they know and do that (and even assuming they can
do that in this part of the attack) it works. And with some logging attached it also serves as a journal of what happened.
It is similar to the way that works well to protect Windows machines from malware: add an AppLocker policy that forbids executing code from a location inside
the user profile (normally under C:\Users). The majority of malware introduced via webpages, infected office documents, etc. will first download some program
into the user’s Downloads or Temp directories and run it. The AppLocker policy forbids that and that is where it ends. It also protects against users clicking on links
to .exe (and similar) files and clicking away the warnings that this will give. E.g. when “a Microsoft employee” calls and tells the user to visit some site to start
something like Teamviewer to enable them to help removing a virus. Like the above, this is not a perfect measure but it works 99.9% of the time to protect naive users.
It is pointless to post this list, it was made by people who do not know MikroTik and do not know that all routers
are running the same firmware. You can safely assume that any device running RouterOS is affected.
Be aware that compromised devices could serve 2nd stage payloads from any port - blocking OUTPUT port 80 will help a little bit but ideally you should block everything and use a whitelist approach to open up legitimate IPs / ports. Port 443 (HTTPS) is a popular port for web hosting too if you still prefer to only block web traffic.
In looking into one of my possible compromised Mikrotik ROS systems, I see in the underlying vmlinuz (compressed Linux kernel) user dat file what appears to be two additional user accounts which are not visible in the Mikrotik user manager system.
The two accounts in question are:
adminb (as in admin Backdoor)
adminr (as in admin Remote -or- admin Recovery)
Are they supposed to be there or is this Mikrotik ROS system VPNfilter compromised ?
Do you have another clean router with up to date OS to compare? Actually, it should be possible to flash clean router with older SW.
No one asked me for advice, but I would restore normal network operation first while suspected device could go to the lab for forensic analysis. That is, perimeter router would be replaced asap with another, upgraded to the latest OS and configured from factory default settings.
But it’s also valid option to wait for evidence of some fancy bears wandering in the internal network.
It was less than a month between the increased botnet http vuln (03/28) & the discovery of the winbox vuln (04/23)
Can someone confirm VPNfilter exclusively utilizing the http vuln ?
A post in the http vuln (03/28) thread: “Also via the winbox port … We think there is a circular second exploit that works in a similar way to this.”
- It was repeatedly stated the winbox port was getting hit only to identify the device as MT.
I don’t have a ton of time for forum searches, but i believe there were a few winbox vuln posts floating around between the http & winbox discoveries. The timeline feels fuzzy.
- Sorry about the edits
Hi All,
yesterday my Router RB750UPr2 with latest BugFix version was attached from something… Apparently just a DNS default server Change..
The device was opened to public ip *80 *8291 *21 *22 (i need to do leave it for see what this attack do to my router), so i get the first attack. After this change i make the upgrade to latest Stable Version 6.42.3, and changed the defaut port with *8000 *8019 *8021 *8022.
After one night i can axess to my router via any service ssh telnet web winbox and with MAC-Telnet after the password prompt the client close the connection (like if sent wrong password)…
next friday i wil make a netinstall setup for clean the device…
I hope my experience can help you.
Thanks for posting this
Looking at a vanilla mikrotik x86 install - version 6.37.5, and CHR version 6.42.3, the only user mentioned is “admin”
When I create new ones, I see them appear in user.dat, but no entry for “adminb” or “adminr”
What architecture is your potentially compromised system?
I understand … but we need assume that Mikrotik is doing their best and try to deliver software without bugs. If we/they have no proof that something is “broken” then they always could say “YES, it is safe”. gclub
This was a in-house lab x86 system (non-production - but live Internet connected) system we sometimes used to ping to and btest to. Because it was not production and stand-alone , it had no firewalls on it.
Interesting
I have a similar box, created a user called “theboss”. This appeared in user.dat. I backed up user.dat first as user-old.dat
I then deleted that user, however the line didn’t vanish from user.dat
I did an upgrade – the line still didn’t vanish, however concerningly the user-old.dat file didn’t vanish either.
Perhaps a firmware upgrade would do the trick, but clearly cant’ do that on an x86 instance.
Add the bandwidth test ports and this is what we do and it works. Good post.
Try to change user’s password - AFAIR, password history is also saved in user.dat 
Of course it is quite typical (and to be expected) that a record in a user file is not completely wiped when the user is deleted, but instead there is some field that indicates active/inactive or there is a length field for the file, one of which is adjusted when you delete something. Looking in the raw disk image or even in the file itself you still see the old username.
Certainly not the unix way
{code}
~$ grep testu /etc/passwd
testuser:x :1003:1003:,:/home/testuser:/bin/bash
~$ sudo userdel testuser
~$ grep testu /etc/passwd
{code}
But that’s fine.
The way the underlying file system isn’t wiped on an upgrade does make me slightly more concerned about how the internals work, if there’s an exploit that exposed that internal file system
Unix uses the method of 1 line per user and a defined length of the file. When you add a user at the end and then delete it, the length of the file is decreased. But when you would look in the disk block directly, the entry for your deleted user would probably still be there. (depends on how the new file is written, directly over the old one or as a new file and then renamed over the old one)
What is Mikrotik’s plan for everybody in the past that purchased Mikrotik-Crossroads and/or Mikrotik-RB500 series of wireless products ?
Are those long-time older Mikrotik owners just sh!t outta Luck & to bad & throw it in the trash can because there are no Mikrotik versions that are not vulnerable ???
In the past , I’ve sold and installed lots of them - grrrrrrr
North Idaho Tom Jones