I have CRS125-24G-1S routerboard with firmware 6.41.4. Last night attackers were able to change DNS settings on Mikrotik router via web interface, so the clients were directed to attacker's servers, as you can no doubt of guess SSL secured services immediately warned about certificate issue on clients' browsers. DNS was the only setting that was changed, so we did not have any other issue, changed to DNS servers and closed web service after that, just the winbox service is left for the only management protocol of the router.
192.200.110.106 > is set as DNS server by the attacker.
Router's log revealed some information:
Code: Select all
04:20:48 ipsec,info respond new phase 1 (Identity Protection): XX.XX.XX.XX[500]<=>216.218.206.122[32233]
04:20:48 ipsec,error 216.218.206.122 failed to get valid proposal.
04:20:48 ipsec,error 216.218.206.122 failed to pre-process ph1 packet (side: 1, status 1).
04:20:48 ipsec,error 216.218.206.122 phase1 negotiation failed.
04:51:46 ipsec,info respond new phase 1 (Identity Protection): XX.XX.XX.XX[500]<=>216.218.206.66[1503]
04:51:46 ipsec,error 216.218.206.66 failed to get valid proposal.
04:51:46 ipsec,error 216.218.206.66 failed to pre-process ph1 packet (side: 1, status 1).
04:51:46 ipsec,error 216.218.206.66 phase1 negotiation failed.
05:54:22 system,error,critical login failure for user admin from 42.177.206.6 via web
05:54:27 system,info,account user admin logged in from 42.177.206.6 via web
05:54:49 system,info,account user admin logged in from 42.177.206.6 via web
05:54:51 system,info dns changed by admin
05:54:56 system,info,account user admin logged in from 42.87.96.170 via web
05:54:59 system,info dns changed by admin
05:55:35 system,info,account user admin logged out from 42.177.206.6 via web
05:56:05 system,info,account user admin logged out from 42.177.206.6 via web
05:56:05 system,info,account user admin logged out from 42.87.96.170 via web
05:59:26 system,error,critical login failure for user admin from 42.87.96.170 via web
Is there a known security issue? Can ipsec phase1 negotiation leak some information?
