Have Mikrotik reached out to Wikileaks

Yes, but as you can imagine, all the big tech companies are probably doing the same.

Hotspot is NOT affected by the vulnerability described in the Vault 7 leaks published on March 7.

Aren't you mixing port with protocol?

1. If the firewall prohibits opening the Webfig in the browser from an address, the server is safe

[chris@bacon ~]$ curl -vvv https://x.x.x.x
* About to connect() to x.x.x.x port 443 (#0)
*   Trying x.x.x.x... connected
* Connected to x.x.x.x (x.x.x.x) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -5938
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error

2. The vulnerability was in the server, regardless of protocol or port. If you could open Webfig, you could be vulnerable

What kind of ACL do you mean? Proper firewall will drop all connections, and will not allow the IP to try to negotiate SSL connections

[admin@XXXXXX] /ip firewall connection tracking> print
                   enabled: auto
...

Can you please state for the record whether routers are vulnerable to attack from an IP which is not listed in this ACL.

Hi,

It would be nice if Mikrotik can take some proactive steps. For example IOS/Junos devices has proper shell in devices, and as sysadmin i can inspect system integrity easily, including taking storage/filesystem dumps over dd, checksums for all filesystem files and etc, and i can run also scripts to check for changes over time.
With mikrotik i am totally blind, if someone plant in device backdoor, as they state in document - they dont need even to bother to hide it, it will reflect only on memory consumption, which is not reliable method at all to detect malware. And even Mikrotik will(and as far as i remember there is some) implement their own integrity check, be sure, they will find way around it, so vendor should provide a way for customer to implement integrity verification over several ways, as it more "raw" - it's better (more ways to detect it).

P.S. Please take appropriate steps with recursive DNS server. It is matter of time someone will open this subject, but lack of ACL and/or easiness of putting "allow all", together with lack of any default defensive methods (throttling of specific abusive requests) making Mikrotik units as a top dns amplification DDoS source.
For example severely throttling ips doing identical requests, requests with large answers and etc.

+1 good Idea, on the Shell access, and couldnt agree more on the DNS server issue.

v6.38.5 has just been released, with vulnerabilities closed. Everyone please upgrade.

Will you please also release a fix for 6.36.4 as it is the only version which works with my wireless-devices?

The fix for your wireless issue is fixed in 6.38.5 as well

*) wireless - improved compatibility with Intel 2200BG wireless card;

+1 good Idea, on the Shell access, and couldnt agree more on the DNS server issue.

As I understand it, if you want a shell on Mikrotik, wait for the code mentioned in vault7 to be released. That seems to do exactly what you want!

It is worth noting, that we never saw the release of any proof in these claims, let alone the tools mentioned. After a thorough code review, we could not find anything hinting to the described issues.

I'm not sure if this is still the case, but:

While I agree that a Mikrotik is "secure" by default (ships with firewall enabled and so on) and other vendors gets their exploits as well. Many vendors have their software contained in a single image file (e.g like Cisco, Juniper) that becomes replaced when updating the device. For what I understand RouterOS just appends updated files over old ones, opening the possibility for persistent root-kits (until modified files is replaced).

I think there is a lot of confusion what "reset configuration" do, this command wipes all '''configuration''' and thats it. It does not rely on script that you are talking about.
"Reset configuration" also has nothing to do with clearing linux file system, it is called "reset configuration" for a reason not "reset filesystem" etc.

Netinstall is the only tool that is wiping all filesystem and installing RouterOS on empty drive.

upgrade ≠ reset configuration

On upgrade system files are replaced with new ones.

And thats unfortunately a security flaw itself. Preferably the whole system should be replaced on update, but at least the the complete startup-chain (kernel -> init -> rc etc..)

Netinstall is not always possible. Can be very remote or hard to reach devices.

You are using the wrong symbol to explain to IT people, should use "!=" instead, then they will better understand

I wasn't asking for an explanation of netinstall.

upgrade ≠ reset configuration

On upgrade system files are replaced with new ones.

You are using the wrong symbol to explain to IT people, should use "!=" instead, then they will better understand

Does anyone know how to have "Configuration changes notifications" as mentioned in the talk?
Is this something that ROS can do natively (or with scripting) or you have to do that using syslog etc?

Does anyone know how to have "Configuration changes notifications" as mentioned in the talk?
Is this something that ROS can do natively (or with scripting) or you have to do that using syslog etc?

Usually a configuration management system does this for you.
Unimus does this out-of-the box and you can have it setup network-wide in 20 minutes.
(this is what I recommended in my talk)

You can't really do this in any good way natively in RouterOS or The Dude.
And while you could do this using Syslog, it would not be full-featured config change notifications.
(since over syslog you will get that something has changed, but not what)

In Unimus (and other NCM systems), you can get a full graphical diff email on config change notifications.
I really recommend having this in your network, it is super useful.

Usually a configuration management system does this for you.
Unimus does this out-of-the box and you can have it setup network-wide in 20 minutes.
(this is what I recommended in my talk)

You can't really do this in any good way natively in RouterOS or The Dude.
And while you could do this using Syslog, it would not be full-featured config change notifications.
(since over syslog you will get that something has changed, but not what)

In Unimus (and other NCM systems), you can get a full graphical diff email on config change notifications.
I really recommend having this in your network, it is super useful.

Thanks for the suggestion. Also, great talk!

I was wondering more about how it is actually done, rather than using a 3rd party service/software.
In the case of Unimus, does it periodically connect to the router and does a full export and produces the diffs you mentioned?

For Unimus, connect to router periodically (user configured scheduling), and retrieve "/export compact".
After that, strip all dynamic content in the output (timestamps, log messages, runtime comments, etc.).

Parse the config, check if anything changed against last retrieved config.
If a change is detected, build a diff, and render a full graphical HTML email with the diff.
Send email to configured notification contacts.

That is how Unimus does it, I can't speak to other NMC systems.

How is that different from /exporting the configuration and git it ?
Then compare different commits?

Cause the video on their homepage just looks like it.