Community discussions

 
alexjhart
Member Candidate
Member Candidate
Posts: 190
Joined: Thu Jan 20, 2011 8:03 pm

Re: Statement on Vault 7 document release

Fri Mar 10, 2017 5:44 pm

Have Mikrotik reached out to Wikileaks
Yes, but as you can imagine, all the big tech companies are probably doing the same.
Normis, when you say you are reaching out to them, does this mean it has only been a one-way effort so far, or have you made two-way contact with them as other tech companies have (http://abcnews.go.com/Technology/wireSt ... g-46017600)?
-----
Alex Hart

The Brothers WISP
 
andriys
Forum Guru
Forum Guru
Posts: 1025
Joined: Thu Nov 24, 2011 1:59 pm
Location: Kharkiv, Ukraine

Re: Statement on Vault 7 document release

Sun Mar 12, 2017 6:55 pm

Hotspot is NOT affected by the vulnerability described in the Vault 7 leaks published on March 7.
What about SSTP? (I suddenly recalled SSTP uses HTTPS tunneling).
 
jarda
Forum Guru
Forum Guru
Posts: 7437
Joined: Mon Oct 22, 2012 4:46 pm

Re: Statement on Vault 7 document release

Sun Mar 12, 2017 8:14 pm

Aren't you mixing port with protocol?
 
andriys
Forum Guru
Forum Guru
Posts: 1025
Joined: Thu Nov 24, 2011 1:59 pm
Location: Kharkiv, Ukraine

Re: Statement on Vault 7 document release

Sun Mar 12, 2017 9:01 pm

Aren't you mixing port with protocol?
Nope. SSTP really tunnels traffic atop HTTPS. I don't know if it is possible to serve both SSL-protected WebFig and SSTP on the same IP simultaneously, but in case it is something should split the traffic, and that something may as well be vulnerable.
 
jarda
Forum Guru
Forum Guru
Posts: 7437
Joined: Mon Oct 22, 2012 4:46 pm

Re: Statement on Vault 7 document release

Sun Mar 12, 2017 9:52 pm

I used to run sstp tunnels on port 444 leaving 443 for https webfig until I moved from sstp to l2tp because of the udp. So definitely you can run both sstp and https in parallel.
 
Sob
Forum Guru
Forum Guru
Posts: 3267
Joined: Mon Apr 20, 2009 9:11 pm

Re: Statement on Vault 7 document release

Sun Mar 12, 2017 10:48 pm

I guess andriys meant also the same port. Which current RouterOS does not allow, but it should be technically possible.
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 23344
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Statement on Vault 7 document release

Mon Mar 13, 2017 10:32 am

Protocol and port has no relation to the published vulnerability. The vulnerability is specifically in the www server part, regardless of port used. SSTP is not affected.
No answer to your question? How to write posts
 
User avatar
bigcw
Frequent Visitor
Frequent Visitor
Posts: 95
Joined: Mon Sep 08, 2014 2:38 pm

Re: Statement on Vault 7 document release

Mon Mar 13, 2017 1:31 pm

Normis would you kindly comment on the following:

- If the http port is not firewalled but is locked down by access list is the system still vulnerable to attack from an IP other than those on the ACL?

- Is https affected? So far only http has been mentioned.

Thanks, Chris
Ecom International Network - Operators of AS61337 with POPs in Europe and North America - www.ecomltd.co.uk
Colocker Data Centre - The data centre with a difference! - www.colocker.com
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 23344
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Statement on Vault 7 document release

Mon Mar 13, 2017 1:47 pm

1. If the firewall prohibits opening the Webfig in the browser from an address, the server is safe
2. The vulnerability was in the server, regardless of protocol or port. If you could open Webfig, you could be vulnerable
No answer to your question? How to write posts
 
User avatar
bigcw
Frequent Visitor
Frequent Visitor
Posts: 95
Joined: Mon Sep 08, 2014 2:38 pm

Re: Statement on Vault 7 document release

Mon Mar 13, 2017 1:55 pm

1. If the firewall prohibits opening the Webfig in the browser from an address, the server is safe
This does not answer the question. Does the ACL prevent access sufficiently to prevent the attack being possible or is it critical that the firewall is used?
[chris@bacon ~]$ curl -vvv https://x.x.x.x
* About to connect() to x.x.x.x port 443 (#0)
*   Trying x.x.x.x... connected
* Connected to x.x.x.x (x.x.x.x) port 443 (#0)
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -5938
* Closing connection #0
* SSL connect error
curl: (35) SSL connect error
^^ the above is a connection attempt from an IP not in the ACL. As you can see, a connection is opened but SSL fails. Is this sufficient to protect the router?
2. The vulnerability was in the server, regardless of protocol or port. If you could open Webfig, you could be vulnerable
Thank you. I will assume https is vulnerable too.
Ecom International Network - Operators of AS61337 with POPs in Europe and North America - www.ecomltd.co.uk
Colocker Data Centre - The data centre with a difference! - www.colocker.com
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 23344
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Statement on Vault 7 document release

Mon Mar 13, 2017 2:09 pm

What kind of ACL do you mean? Proper firewall will drop all connections, and will not allow the IP to try to negotiate SSL connections.

I always mean firewall, and have answered this many times above already. Firewall will protect you, if you cannot open Webfig.
No matter what ACL you have implemented. Open the Webfig address. If you see Webfig, your ACL is not working. If you don't, you are safe from the exploit.
No answer to your question? How to write posts
 
User avatar
bigcw
Frequent Visitor
Frequent Visitor
Posts: 95
Joined: Mon Sep 08, 2014 2:38 pm

Re: Statement on Vault 7 document release

Mon Mar 13, 2017 2:24 pm

What kind of ACL do you mean? Proper firewall will drop all connections, and will not allow the IP to try to negotiate SSL connections
I am referring to 'address' (called 'available from' in webfig) at /ip service.

Can you please state for the record whether routers are vulnerable to attack from an IP which is not listed in this ACL.

Also I have another question which I think is relevant. We have connection tracking set to 'auto' as such:
[admin@XXXXXX] /ip firewall connection tracking> print
                   enabled: auto
...
Will adding a drop rule to the firewall switch connection tracking on? We are concerned about the performance impact this may have on heavily loaded routers*.

Chris

*by heavily loaded I mean CCR1036's running several gigabits per second 24/7
Ecom International Network - Operators of AS61337 with POPs in Europe and North America - www.ecomltd.co.uk
Colocker Data Centre - The data centre with a difference! - www.colocker.com
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 23344
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Statement on Vault 7 document release

Mon Mar 13, 2017 2:35 pm

Can you please state for the record whether routers are vulnerable to attack from an IP which is not listed in this ACL.
the "available-from" setting works slightly different than a firewall drop rule, but will still protect you from an attack described in the vault7 documents. Even if there was an attempt for an SSL connection, it was dropped way before the exploit was possible. TLDR: yes you are still safe.
No answer to your question? How to write posts
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 23344
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Statement on Vault 7 document release

Mon Mar 13, 2017 2:39 pm

In more detail:
* About to connect() to x.x.x.x port 443 (#0)
*  Trying x.x.x.x... connected
* Connected to x.x.x.x (x.x.x.x) port 443 (#0)
Your device initiated a connection, and received ACK. That's all. RouterOS closed connection and did not communicate any further.
This part is what your device is attempting (and failing):
* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
* NSS error -5938
* Closing connection #0
* SSL connect error
No answer to your question? How to write posts
 
User avatar
bigcw
Frequent Visitor
Frequent Visitor
Posts: 95
Joined: Mon Sep 08, 2014 2:38 pm

Re: Statement on Vault 7 document release

Mon Mar 13, 2017 2:42 pm

That is exactly the confirmation I was looking for. Thanks.

Chris
Ecom International Network - Operators of AS61337 with POPs in Europe and North America - www.ecomltd.co.uk
Colocker Data Centre - The data centre with a difference! - www.colocker.com
 
smytht
Trainer
Trainer
Posts: 87
Joined: Wed Jun 06, 2007 6:35 pm
Location: Tipperary / Dublin & Ireland
Contact:

Re: Statement on Vault 7 document release

Thu Mar 16, 2017 1:01 am

Hi,

It would be nice if Mikrotik can take some proactive steps. For example IOS/Junos devices has proper shell in devices, and as sysadmin i can inspect system integrity easily, including taking storage/filesystem dumps over dd, checksums for all filesystem files and etc, and i can run also scripts to check for changes over time.
With mikrotik i am totally blind, if someone plant in device backdoor, as they state in document - they dont need even to bother to hide it, it will reflect only on memory consumption, which is not reliable method at all to detect malware. And even Mikrotik will(and as far as i remember there is some) implement their own integrity check, be sure, they will find way around it, so vendor should provide a way for customer to implement integrity verification over several ways, as it more "raw" - it's better (more ways to detect it).

P.S. Please take appropriate steps with recursive DNS server. It is matter of time someone will open this subject, but lack of ACL and/or easiness of putting "allow all", together with lack of any default defensive methods (throttling of specific abusive requests) making Mikrotik units as a top dns amplification DDoS source.
For example severely throttling ips doing identical requests, requests with large answers and etc.
+1 good Idea, on the Shell access, and couldnt agree more on the DNS server issue.
I Hope this Helps,
Tom Smyth,
Cant we all just get along and exchange Ideas... Now that is an Idea!
 
User avatar
bigcw
Frequent Visitor
Frequent Visitor
Posts: 95
Joined: Mon Sep 08, 2014 2:38 pm

Re: Statement on Vault 7 document release

Sat Mar 18, 2017 12:13 am


+1 good Idea, on the Shell access, and couldnt agree more on the DNS server issue.
As I understand it, if you want a shell on Mikrotik, wait for the code mentioned in vault7 to be released. That seems to do exactly what you want!
Ecom International Network - Operators of AS61337 with POPs in Europe and North America - www.ecomltd.co.uk
Colocker Data Centre - The data centre with a difference! - www.colocker.com
 
fathhi2022
just joined
Posts: 3
Joined: Sat Apr 15, 2017 4:55 am

Hacked Mikrotik System

Sat Apr 15, 2017 7:09 am

Hello,

The microtik system has been compromised by a security vulnerability in the system and many networks have been hijacked and money has been claimed to restore them

There are hundreds of Yemeni network officials serving thousands of customers in Yemen
You can help us find solutions to this problem. We are very dissatisfied, or we will use an alternative system

This is the only video uploaded by the hacker
https://www.youtube.com/watch?v=e19wz5G ... ture=share

As well as the existence of many images of some networks that hacked on Facebook

https://www.facebook.com/kerrar.masik

we are waiting
Thanks,
MikroTik Support
 
jarda
Forum Guru
Forum Guru
Posts: 7437
Joined: Mon Oct 22, 2012 4:46 pm

Re: Statement on Vault 7 document release

Sat Apr 15, 2017 8:29 am

 
notToNew
Member Candidate
Member Candidate
Posts: 125
Joined: Fri Feb 19, 2016 3:15 pm

Re: Statement on Vault 7 document release

Wed May 03, 2017 9:49 am

v6.38.5 has just been released, with vulnerabilities closed. Everyone please upgrade.
Will you please also release a fix for 6.36.4 as it is the only version which works with my wireless-devices?
The fix for your wireless issue is fixed in 6.38.5 as well
*) wireless - improved compatibility with Intel 2200BG wireless card;
Thank you, tested this on 50+ Devices and: it works, thank you!
Even non Intel Webcams which had problems work now!
--------------------------------------------------------------------------------------------
CCR1036-12G-4S, several 952Ui-5ac2nD, ...
 
User avatar
TomjNorthIdaho
Forum Veteran
Forum Veteran
Posts: 823
Joined: Mon Oct 04, 2010 11:25 pm
Location: North Idaho
Contact:

Re: Statement on Vault 7 document release

Fri Sep 22, 2017 4:01 am


+1 good Idea, on the Shell access, and couldnt agree more on the DNS server issue.
As I understand it, if you want a shell on Mikrotik, wait for the code mentioned in vault7 to be released. That seems to do exactly what you want!
With many various older versions of Linux, BSD & Unix , I have personally seen and experienced several different services attacked which crashed that TCP/IP service and dumps the attacker out into a shell. There have been hundreds of service buffer-exploits which drop you into a shell - or starts running a embedded program that was injected into the buffer-exploit attack.

North Idaho Tom Jones
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 23344
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Statement on Vault 7 document release

Fri Sep 22, 2017 8:53 am

It is worth noting, that we never saw the release of any proof in these claims, let alone the tools mentioned. After a thorough code review, we could not find anything hinting to the described issues.
No answer to your question? How to write posts

Who is online

Users browsing this forum: tornado57 and 6 guests