Community discussions

 
Sob
Forum Guru
Forum Guru
Posts: 4411
Joined: Mon Apr 20, 2009 9:11 pm

Re: Security announcement blog

Thu Aug 02, 2018 5:35 pm

Maybe it's just me (and @R1CH, I guess), but aren't we slowly crossing the ridiculous boundary? Wouldn't it be better to just admit that this WinBox bug was as bad as it can get, instead of trying to redefine security? You have my word, I'll forgive you.

I mean, whitelist for OpenVPN (assuming that it's used mainly for road warriors, so by design nobody knows from where will clients need to connect)? So maybe a 24/7 operator and clients phoning in IP adresses they need to whitelist? Maybe port knocking, but unless it's something more complex (and not easily doable with RouterOS), it's just security through obscurity. What will be next? One company I'm involved with has some client portal on https and of course open to whole world, 10k clients or so. Security depends only on username and password, kind of similar to WinBox. By the same logic, should I suggest a whitelist to them too? Or perhaps an unconditional drop on tcp/443? No doubt it would be secure then. :)
People who quote full posts should be spanked with ethernet cable. Some exceptions for multi-topic threads may apply.
 
msatter
Forum Guru
Forum Guru
Posts: 1176
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Security announcement blog

Thu Aug 02, 2018 5:45 pm

RouterOS calls home each day or week to check if there is something wrong. If so every http session gets a page displayed that an update is needed because the router is below the minimal required version.

If ignored then after two weeks the router only functions when you are initiating an update. After the update all the functions are restored.
What a terrible idea :shock:
It is a terrible idea but we have to start somewhere. It is a responsibility to each of us and hacked routers can do a lot of damage.
Two RB760iGS (hEX S) in series. One does PPPoE and both do IKEv2.
Running:
RouterOS 6.46Beta / Winbox 3.19 / MikroTik APP 1.3.1
Having an Android device, use https://github.com/M66B/NetGuard/releases (no root required)
 
User avatar
Cha0s
Forum Veteran
Forum Veteran
Posts: 882
Joined: Tue Oct 11, 2005 4:53 pm

Re: Security announcement blog

Thu Aug 02, 2018 6:49 pm

Yes we have to start somewhere. How about users start to read how networks work and don't make stupid mistakes like disabling a firewall?

Where to start....

You talk about doing MITM essentially to modify forwarded traffic. That's preposterous! And what about TLS? Everything moves to TLS. Doing it on http is not even viable.

You also talk about call home. I don't know what exactly are you referring to, but AFAIK the only 'call home' that ROS does (not CHR) is when using the IP > Cloud feature (which I generally don't use).
How does invading our privacy by calling home (so MikroTik knows our IPs and our exact router model/serial for starters) will make things better?

And the worst of all: Forcing me to update to a potentially unwanted version (because of bugs, because of removed functionality, or because there is no need frankly) is monumentally stupid. It's as stupid as Microsoft's forced win10 updates.

Remove functionality until you upgrade? Are you out of your mind? :shock:
I know the Netherlands have good weed, but man, you must be high as a kite to suggest such things! :lol:
 
msatter
Forum Guru
Forum Guru
Posts: 1176
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Security announcement blog

Thu Aug 02, 2018 7:59 pm

To go to a HTTPS page you most of the time need a initiate that on http.
Even the handshake on 80/443 is giving away that someone is looking at a screen that can be warned.

Call home is the term for a device/application getting in touch with where it comes from. The IP address is to me not a significant problem. We share it and much more when we request a firmware/routerOS. Or do you have a separate IP to have your firmware/RouterOS updates.

Which type device or settings of any kind is not shared with Mikrotik and the page just contains the information that the router needs to know. There can be more information on that page that not applies to that router. You could use exiting download page and add in plain text the minimal requered routerOS version.

If you are not waning to update you router you forbid the router to visit the mikrotik page like I do Windows 10. It is then not Mikrotiks fault that your router is turned evil.

My Windows 10 does not use it's own mechanism to update and I use WSUS for that.

Yes weed is the stuff that attracks many people to the Neterlands and of course the canals in Giethoorn. I use neither.
Two RB760iGS (hEX S) in series. One does PPPoE and both do IKEv2.
Running:
RouterOS 6.46Beta / Winbox 3.19 / MikroTik APP 1.3.1
Having an Android device, use https://github.com/M66B/NetGuard/releases (no root required)
 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 1702
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: Security announcement blog

Thu Aug 02, 2018 8:23 pm

"Mikrotik call home" :) .... crazy idea.
And what about routers which has "unsafe" ROS version but are hidden behind other firewall with good security? Should they magically be banned? What about connections with low bandwith? Should it be "eaten" by regular ROS verion checks?

Tha main idea of routers like Mikrotik where you HAVE TO configure it yourself is FREEDOM. You are not pushed to do things "the right way"
Real admins use real keyboards.
 
msatter
Forum Guru
Forum Guru
Posts: 1176
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Security announcement blog

Thu Aug 02, 2018 8:38 pm

Then that good firewall takes the burden on them by not allowing to have that unsafe router to call home. The must not be a button to switch itall of and only a firewall rule can block it.

It is like you are jumping out of a plain on a parachute and start cutting lines. Nobody can help you by knotting the correct lines together. There is no reserve chute when your router is hacked.

When I advise a RouterOS device I always tell that it has a very steep learning ramp and the best is to use the default config first and grow from there.

You have all the freedom but Mikrotik has the fallout from this freedom.
Two RB760iGS (hEX S) in series. One does PPPoE and both do IKEv2.
Running:
RouterOS 6.46Beta / Winbox 3.19 / MikroTik APP 1.3.1
Having an Android device, use https://github.com/M66B/NetGuard/releases (no root required)
 
jerdtex
just joined
Posts: 3
Joined: Sun Jul 08, 2018 9:20 pm

Re: Security announcement blog

Sat Aug 04, 2018 1:24 am

It's better to always use a proven solution

--------------------------------------------------------------------------------------------
https://stylufka.pl/modne-fryzury-meski ... -sie-nosi/
https://mobi-prawnik.pl/
Last edited by jerdtex on Mon Jul 01, 2019 9:13 pm, edited 2 times in total.
 
mt99
just joined
Posts: 24
Joined: Wed Jan 03, 2018 6:07 pm

Re: Security announcement blog

Wed Aug 08, 2018 10:55 pm

 
User avatar
BartoszP
Forum Guru
Forum Guru
Posts: 1702
Joined: Mon Jun 16, 2014 1:13 pm
Location: Poland

Re: Security announcement blog

Wed Aug 08, 2018 11:03 pm

What is the conclusion?
Real admins use real keyboards.
 
msatter
Forum Guru
Forum Guru
Posts: 1176
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Security announcement blog

Thu Aug 09, 2018 12:42 am

I made a filter that act as a honeypot for port 8291 and I caught some fish and added that to my drop line in RAW and log when there is a revisit in that CIDR.

I have the 146.185.222.0/24 (Barbarich Viacheslav Yuryevich) CDIR trying every 30 seconds to approach a port. It is still going it tried port: 34441,6436,8168,3961,37818,4566,3126,3497,3911,2989,7993,4600,9608,22676,42264,52463....... with addresses ending on 222.29 222.32 222.37 222.7 222.11 222.28 222.35 and address 146.185.222.32 is used the most.

More addresses and ports are coming in but time to post it.

Update:

After a night sleep it is still going on so I am going it to add this CIDR to the list that is blocks but not log it and I have 809 log entries of that address range coming along. It was probably not looking specific for port 8291 like some others did. Reset the counter to see if there are more returning port 8291 sniffers.
Two RB760iGS (hEX S) in series. One does PPPoE and both do IKEv2.
Running:
RouterOS 6.46Beta / Winbox 3.19 / MikroTik APP 1.3.1
Having an Android device, use https://github.com/M66B/NetGuard/releases (no root required)
 
User avatar
Cha0s
Forum Veteran
Forum Veteran
Posts: 882
Joined: Tue Oct 11, 2005 4:53 pm

Re: Security announcement blog

Tue Aug 14, 2018 5:00 pm

To go to a HTTPS page you most of the time need a initiate that on http.
Those days are almost gone. HSTS
Plus, all major browsers have their own predefined list of major websites that support https and will connect only to https even if you only type the domain in the address bar.
https://hstspreload.org/

What you suggest will break TLS faster than you can spell out its initials.
 
R1CH
Forum Veteran
Forum Veteran
Posts: 879
Joined: Sun Oct 01, 2006 11:44 pm

Re: Security announcement blog

Wed Aug 22, 2018 11:56 pm

It's been a full business day and the blog is still not updated with the news about what these four security bugs from the latest RouterOS release actually are. This seems to be a step backwards, before the blog the changelog said things like "www) fixed vulnerability" so admins at least knew the www service was affected and could take necessary steps to limit access if a RouterOS upgrade wasn't immediately possible.

Now we have private CVE numbers and no information to go on, meanwhile hackers are likely reverse engineering the patches to find the vulnerabilities. I appreciate the effort to be more public about security issues but the disclosure about these four issues so far is really not giving me a good feeling.
 
npyoung
Frequent Visitor
Frequent Visitor
Posts: 81
Joined: Thu Jun 10, 2004 2:40 am
Location: Applegate, OR, USA
Contact:

Re: Security announcement blog

Thu Aug 23, 2018 6:44 am

I am furious angry!
My router had admin disabled and most of the services such as SSH/Telnet etc. The username I used was a long name and the password had 16 chars. I had a proper configuration on firewall, lots of scripts etc. YET...
Today I went on Google and got the CAPTCHA. I knew right of the bat that something is not good.

Logged to Mikrotik. First I spotted that most of FW rules were gone, then SOCKS enabled! Scripts are gone except some mikrotik.php thing. First thing... plug out internet cable.

After panic was over, went on LTE Internet to see what is going on. In 2 minutes I find that Mikrotik got compromised. I mean seriously?!

OK I think... many systems have security bugs. In fact this is the first one I have ever had through a Mikrotik. But what made me super angry wasnt't that there was a bug but Your replies to people saying "You should keep up to date" or "You should check our announcements" --EOT.


If the issue is there since April and you have my bloody email as I am registered on this forum, why I have not received an email saying "We have found a security vulnerability, so please update your Router OS immediately"? Seriously, why? I mean my IP worked as free SOCKS tunnel for god knows how long and god knows what went through it.

I just don't login to a router OS every day to check if everything is fine. You should not expect people to do that, you should not expect people to keep the router OS up to date (for many reasons e.g. the RouterBoard sits on the mast high up in the mountains and you simply don't do upgrade unless you are psychically there in case of something goes wrong), you should not expect people to look at your BLOG all of the time. It should be on your cards to let your customers know about such events.

EDIT: Please add newsletter widget to this "BLOG". I don't use RSS feeds.
Add me to this. I should have gotten an email instead of having to find out the hard way. Now we have 40-50 user CPE's, many mounted in trees that are probably unusable. Can't log into them to fix them. What a disaster!
 
npyoung
Frequent Visitor
Frequent Visitor
Posts: 81
Joined: Thu Jun 10, 2004 2:40 am
Location: Applegate, OR, USA
Contact:

Re: Security announcement blog

Thu Aug 23, 2018 6:55 am

Getting down to fixing this cluster. Is the reset button disabled? Or can a person go to each router site, hit the reset button and put an upgraded OS on it, and the new setup? Or is the hardware now trash?
 
npyoung
Frequent Visitor
Frequent Visitor
Posts: 81
Joined: Thu Jun 10, 2004 2:40 am
Location: Applegate, OR, USA
Contact:

Re: Security announcement blog

Thu Aug 23, 2018 7:00 am

Is there a way to log into these compromised devices remotely? The devices that were compromised today are not reachable using telnet, ssh, or winbox. They are still running, presumably performing their Internet access function, but I've lost control of them. Maybe MT, having seriously dropped the ball in not informing a customer of 18 years that this was a problem, could suggest a comeback path?
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 24077
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Security announcement blog

Thu Aug 23, 2018 7:56 am

npyoung, just make sure you have not removed your mikrotik.com account or put mikrotik.com in some spam filter, because MikroTik did send mails about this and other vulnerabilities.
Also, since the issue was patched back in april, I suggest to also check our communication channels more often (social networks, forum).
No answer to your question? How to write posts
 
npyoung
Frequent Visitor
Frequent Visitor
Posts: 81
Joined: Thu Jun 10, 2004 2:40 am
Location: Applegate, OR, USA
Contact:

Re: Security announcement blog

Thu Aug 23, 2018 9:51 am

npyoung, just make sure you have not removed your mikrotik.com account or put mikrotik.com in some spam filter, because MikroTik did send mails about this and other vulnerabilities.
Also, since the issue was patched back in april, I suggest to also check our communication channels more often (social networks, forum).
Ok, I'm glad to hear that, but I'm pretty screwed now that I didn't get it.

Now that I have 40 infected Dynadishes, what can be done? They seem to still be functioning, but I cannot get into them from Winbox. Port 80 sort of works, the login page comes up, but then it shuts down after entering user/pass. Any ideas? Does the exploit allow for a hard reset of the dish, or are they now scrap?
 
npyoung
Frequent Visitor
Frequent Visitor
Posts: 81
Joined: Thu Jun 10, 2004 2:40 am
Location: Applegate, OR, USA
Contact:

Re: Security announcement blog

Thu Aug 23, 2018 1:51 pm

npyoung, just make sure you have not removed your mikrotik.com account or put mikrotik.com in some spam filter, because MikroTik did send mails about this and other vulnerabilities.
Also, since the issue was patched back in april, I suggest to also check our communication channels more often (social networks, forum).
Having been through this sort of thing with UBNT before, I have to say there's a world of difference in the response. UBNT almost immediately had a fix for infected devices, followed by improvement in their excellent NMS tool, AirControl, which allows an operator to keep all the devices up on their FW. (The Dude is a pale shadow of this software.) None of this, "well, you should have been brushing your teeth after each meal" and blaming the customer. I've been a customer of MT for 18 years now, and I've been impressed by how solid a product it is. But, I'm thinking at this point, after this very expensive fiasco, it's time to part ways, especially as it appears from the silence on a fix that I'd need to purchase new hardware. I'll be purchasing new hardware all right, but just not from MT!
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 24077
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Security announcement blog

Thu Aug 23, 2018 1:54 pm

This is a public user forum, official support is not provided here, but we do try to post useful responses.
Have you tried contacting support@mikrotik.com?

You only mention that you can't access these devices. This could be because of any number of reasons. At least you should try to connect from both interfaces, not only ethernet, but also from the wireless side.
No answer to your question? How to write posts
 
raxxeh
just joined
Posts: 1
Joined: Mon Mar 12, 2018 9:30 am

Re: Security announcement blog

Sat Aug 25, 2018 8:53 am

Doesn't always work Normis.

Please provide an itemized breakdown including disclosure on the blog of what these exploits entailed.
 
User avatar
hknet
Frequent Visitor
Frequent Visitor
Posts: 88
Joined: Sun Jul 17, 2016 6:05 pm
Location: Vienna, Austria
Contact:

Re: Security announcement blog

Sat Aug 25, 2018 10:04 am

RSS is good, but will be nice to have some mailing list for security announcement and firmware update
+1 for security announcement mailinglist
+2
 
msatter
Forum Guru
Forum Guru
Posts: 1176
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Security announcement blog

Sat Aug 25, 2018 4:17 pm

Two RB760iGS (hEX S) in series. One does PPPoE and both do IKEv2.
Running:
RouterOS 6.46Beta / Winbox 3.19 / MikroTik APP 1.3.1
Having an Android device, use https://github.com/M66B/NetGuard/releases (no root required)
 
User avatar
boldsuck
Frequent Visitor
Frequent Visitor
Posts: 56
Joined: Sun Sep 01, 2013 1:07 am
Location: Germany

Re: Security announcement blog

Sun Aug 26, 2018 5:48 pm

@npyoung
Is there a way to log into these compromised devices remotely? The devices that were compromised today are not reachable using telnet, ssh, or winbox.
Telnet?! (You're kidding, right?) ;-)
or winbox from WAN?!

I think you should read basic about the security configuration of your router.
Here is a very good introduction:
https://www.manitonetworks.com/networki ... figuration

Take the time to read. Winbox or Web service vulnerability can not harm your routers then.

I think you'll have to visit your routers local if they're really compromised.
Make a factory reset and play your backup.
Do not forget to create a backup after each upgrade!

Hint:
No SSH login via password only with ssh key.
╰_╯ Ciao Marco!
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 1302
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Randburg
Contact:

Re: Security announcement blog

Tue Sep 04, 2018 4:25 pm

CVE-2018-14847 - https://thehackernews.com/2018/09/mikro ... cking.html

Is the above a new vulnerability, tried searching the blog for the CVE Article number, but can't find it on the Mikrotik Security Blog or change logs
MTCNA, MTCTCE, MTCRE & MTCINE
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 24077
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Security announcement blog

Tue Sep 04, 2018 4:31 pm

CVE-2018-14847 - https://thehackernews.com/2018/09/mikro ... cking.html

Is the above a new vulnerability, tried searching the blog for the CVE Article number, but can't find it on the Mikrotik Security Blog or change logs
same old. we did not assign that CVE, so we don't mention it:
https://blog.mikrotik.com/security/winb ... ility.html
No answer to your question? How to write posts
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 1302
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Randburg
Contact:

Re: Security announcement blog

Tue Sep 04, 2018 4:48 pm

Thought so, thx Normis
MTCNA, MTCTCE, MTCRE & MTCINE
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 24077
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Security announcement blog

Wed Sep 05, 2018 9:07 am

ite is quite slow here because it has an IPv6 address in DNS but IPv6 does not actually work for this server.
can you see if this works now?
blog works fine over ipv6, make sure your ipv6 is configured correctly and you can ping 2a02:610:7501:1000::195
No answer to your question? How to write posts
 
pe1chl
Forum Guru
Forum Guru
Posts: 5563
Joined: Mon Jun 08, 2015 12:09 pm

Re: Security announcement blog

Wed Sep 05, 2018 10:47 am

ite is quite slow here because it has an IPv6 address in DNS but IPv6 does not actually work for this server.
can you see if this works now?
blog works fine over ipv6, make sure your ipv6 is configured correctly and you can ping 2a02:610:7501:1000::195
It is a copy/paste of an earlier exchange in this topic (page 1) between you and me. No idea why!
That IPv6 problem was solved immediately back then.
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 24077
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Security announcement blog

Wed Sep 05, 2018 10:49 am

ite is quite slow here because it has an IPv6 address in DNS but IPv6 does not actually work for this server.
can you see if this works now?
blog works fine over ipv6, make sure your ipv6 is configured correctly and you can ping 2a02:610:7501:1000::195
It is a copy/paste of an earlier exchange in this topic (page 1) between you and me. No idea why!
That IPv6 problem was solved immediately back then.
probably spammer
No answer to your question? How to write posts
 
pe1chl
Forum Guru
Forum Guru
Posts: 5563
Joined: Mon Jun 08, 2015 12:09 pm

Re: Security announcement blog

Wed Sep 05, 2018 10:50 am

probably spammer
I think so, I now notice the same behaviour in another topic. Better ban that user.
 
msatter
Forum Guru
Forum Guru
Posts: 1176
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Security announcement blog

Wed Sep 05, 2018 10:58 am

:-)
Two RB760iGS (hEX S) in series. One does PPPoE and both do IKEv2.
Running:
RouterOS 6.46Beta / Winbox 3.19 / MikroTik APP 1.3.1
Having an Android device, use https://github.com/M66B/NetGuard/releases (no root required)
 
usx
newbie
Posts: 25
Joined: Sun Oct 27, 2013 7:30 pm

Re: Security announcement blog

Wed Sep 12, 2018 12:53 am

That blog is so freaking awesome!

BUGFIX UPDATE 6.40.9 RELEASED -- https://blog.mikrotik.com/software/bugf ... eased.html

Well, that was the first and last blog entry about a release...

We really need an email subscription list for all new releases/bugfixes/secvulns. Is that really so hard to do??? Isn't security the core of your business???

I used to get some emails from you guys about new releases, but then from one day to another they ceased to be sent out / reach me.

RouterOS v6.34 RC (The Dude and CHR) from 12/9/2015 was the last one which I received.

BTW, today you got a lot of bad reputation at Security Now from Steve Gibson. Rightly so!
 
CsXen
Frequent Visitor
Frequent Visitor
Posts: 88
Joined: Wed Sep 10, 2014 8:31 pm
Location: Budapest - Hungary

Re: Security announcement blog

Wed Sep 12, 2018 9:03 am

Hi. I looked into some of our routers log... and found some strange activity.
aug/25 17:52:12 system,info verified routeros-mipsbe-6.42.7.npk
aug/25 17:52:12 system,info installed routeros-mipsbe-6.42.7
aug/25 17:52:12 system,info router rebooted
[...]
aug/25 18:16:47 system,info script removed by admin
aug/25 18:17:07 system,info script removed from scheduler by admin
[...]
(passwords changed here)
[...]
sep/01 22:07:44 firewall,info ---WinBox port--- input: in:ether1 out:(unknown 0), src-mac 6c:9c:ed:34:bb:71, proto TCP (SYN), 5.101.6.170:56680-> xxx.xxx.xxx.xxx:8291, len 40
[...]
sep/10 00:36:04 firewall,info ---WinBox port--- input: in:ether1 out:(unknown 0), src-mac 6c:9c:ed:34:bb:71, proto TCP (SYN), 5.101.6.170:53804->xxx.xxx.xxx.xxx:8291, len 40
[...]
sep/10 01:53:20 firewall,info ---WinBox port--- input: in:ether1 out:(unknown 0), src-mac 6c:9c:ed:34:bb:71, proto TCP (SYN), 5.101.6.170:50515->xxx.xxx.xxx.xxx:8291, len 40
[...]
sep/10 10:53:08 firewall,info ---WinBox port--- input: in:ether1 out:(unknown 0), src-mac 6c:9c:ed:34:bb:71, proto TCP (SYN), 5.101.6.170:50832->xxx.xxx.xxx.xxx:8291, len 60
[...]
sep/11 07:02:10 system,info,account user test logged in from 5.101.6.170 via api
sep/11 07:02:10 system,error,critical login failure for user admin from 5.101.6.170 via api
sep/11 07:02:11 system,info,account user test logged out from 5.101.6.170 via api
[...]
sep/11 15:42:48 system,info,account user test logged in from 5.101.6.170 via api
sep/11 15:42:49 system,error,critical login failure for user admin from 5.101.6.170 via api
sep/11 15:42:50 system,info,account user test logged out from 5.101.6.170 via api

I logged only the NEW connections.
So, what did I forgot ? Or have we another backdoor in 6.42.7 somewhere to steal passwords (which is looong and hard to bruteforce I think).

Best regards: CsXen
 
nescafe2002
Long time Member
Long time Member
Posts: 615
Joined: Tue Aug 11, 2015 12:46 pm
Location: Netherlands

Re: Security announcement blog

Wed Sep 12, 2018 9:12 am

Did the user 'test' already exist? Did you change the password of user 'test' or only 'admin'? What rights does user 'test' have?
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 24077
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Security announcement blog

Wed Sep 12, 2018 9:43 am

BUGFIX UPDATE 6.40.9 RELEASED -- https://blog.mikrotik.com/software/bugf ... eased.html

Well, that was the first and last blog entry about a release...
What other releases did you expect? There have been no other releases!
No answer to your question? How to write posts
 
usx
newbie
Posts: 25
Joined: Sun Oct 27, 2013 7:30 pm

Re: Security announcement blog

Wed Sep 12, 2018 12:44 pm

What other releases did you expect? There have been no other releases!
6.43 for Stable and 6.44beta6 for Testing. I'm on the stable channel because I got automatically inserted into it. Don't you see the flaw? Aren't those releases as well? Or are we Stable and Testing users not special enough, like those fancy Long-term ones?

7 devices are on Stable because I never changed their setting. The last one if it i bought this year.
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 24077
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Security announcement blog

Wed Sep 12, 2018 12:53 pm

Why would you put every beta release on a security announcement blog?
Please subscribe to the releases RSS or Email list, those exists for 10 years or more.

The blog is for long-term stable releases and security announcements or other monumenally important things, not every nightly build release.
No answer to your question? How to write posts
 
usx
newbie
Posts: 25
Joined: Sun Oct 27, 2013 7:30 pm

Re: Security announcement blog

Thu Sep 13, 2018 5:24 pm

Email list
Now we're talking. I was subscribed to it until it stopped sending me emails, without me unsubscribing. Where can I find that list? That solves the complete issue. I just thought they've dropped the list.

Is it this one? https://mikrotik.com/client/ecom_notify.php
I got that link from my last email from 2015, but removed the unregn query string parameter.

I can't find any "official" link to the URL I mentioned above. It appears to be part of the "Account" section, but I have no account on the mikrotik.com website (only on the forum).

Oh jesus christ. It's in big red at the bottom of the page... I'm a genius... as in stable genius...
 
CsXen
Frequent Visitor
Frequent Visitor
Posts: 88
Joined: Wed Sep 10, 2014 8:31 pm
Location: Budapest - Hungary

Re: Security announcement blog

Fri Sep 14, 2018 10:09 am

Did the user 'test' already exist?
Yes, it exists (not "test", I changed the name to "test" for anonymizing purposes).
Did you change the password of user 'test' or only 'admin'?
Yes, every user has changed password.
What rights does user 'test' have?
Fortunately only "login", "read" and "reboot"... probably this is the reason, that intruder can not made any alterings in the config.

Best regards: CsXen
 
msatter
Forum Guru
Forum Guru
Posts: 1176
Joined: Tue Feb 18, 2014 12:56 am
Location: Netherlands / Nīderlande

Re: Security announcement blog

Fri Sep 14, 2018 11:45 am

Email list
Now we're talking. I was subscribed to it until it stopped sending me emails, without me unsubscribing. Where can I find that list? That solves the complete issue. I just thought they've dropped the list.

Is it this one? https://mikrotik.com/client/ecom_notify.php
I got that link from my last email from 2015, but removed the unregn query string parameter.

I can't find any "official" link to the URL I mentioned above. It appears to be part of the "Account" section, but I have no account on the mikrotik.com website (only on the forum).

Oh jesus christ. It's in big red at the bottom of the page... I'm a genius... as in stable genius...
I subscribed to both and I got the same e-mail with an other link to confirm. I used dedicated e-mail addresses so I will know which one is used.
Two RB760iGS (hEX S) in series. One does PPPoE and both do IKEv2.
Running:
RouterOS 6.46Beta / Winbox 3.19 / MikroTik APP 1.3.1
Having an Android device, use https://github.com/M66B/NetGuard/releases (no root required)
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 24077
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Security announcement blog

Fri Sep 14, 2018 11:47 am

We also have RSS for those that use it. Both in the Blog and also for releases.
No answer to your question? How to write posts
 
ssaki
just joined
Posts: 2
Joined: Wed Nov 08, 2017 12:40 pm

Re: Security announcement blog

Mon Oct 08, 2018 7:37 am

 
User avatar
maznu
Member Candidate
Member Candidate
Posts: 197
Joined: Tue May 05, 2015 11:12 am
Location: Manchester, UK
Contact:

Re: Security announcement blog

Mon Oct 08, 2018 10:09 am

Thankfully those CVEs appear to be fixed in 6.40.9 and 6.42.7.

Good to see that MikroTik is taking RouterOS security seriously with those CVEs. Meanwhile, I'm still waiting for MikroTik to confirm when Ticket#2018041622003823 (unauthenticated remote crash, does not require any management interface to be open to the attacker) will be fixed.
Marek
 
User avatar
vecernik87
Long time Member
Long time Member
Posts: 642
Joined: Fri Nov 10, 2017 8:19 am

Re: Security announcement blog

Mon Oct 08, 2018 11:08 am

...Meanwhile, I'm still waiting for MikroTik to confirm when Ticket#2018041622003823 (unauthenticated remote crash, does not require any management interface to be open to the attacker) will be fixed.
I have no idea what vulnerability is it about and to be honest, I don't want to know. However, if what you say is true, then there is such issue for almost half year? Sounds almost unbelievable.
Did you get any reply since you reported it?
Can it be prevented with firewall?
Maybe you need to publish it to generate some pressure...
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 24077
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Security announcement blog

Mon Oct 08, 2018 11:29 am

That ticket talks about packet flood over IPv6, I think. I did not read the whole ticket, there are many emails. Ticket number is from the first mail.
No answer to your question? How to write posts
 
User avatar
vecernik87
Long time Member
Long time Member
Posts: 642
Joined: Fri Nov 10, 2017 8:19 am

Re: Security announcement blog

Wed Oct 10, 2018 6:38 am

Thats why I asked Maznu to give bit clearer description. I may not be a blind fanboy but I still believe you guys are doing your best and I find it hard to believe you would leave real reported vulnerability without reaction.
If it is just flood attack which overwhelms router and cause restart due to for example watchdog timer which can't get ping reply, then I wouldn't call it vulnerability.
He does not need to share detailed info if he is concerned that it is real threat. However if he blame you for missing reponse, he might share a bit...
 
User avatar
normis
MikroTik Support
MikroTik Support
Topic Author
Posts: 24077
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Security announcement blog

Wed Oct 10, 2018 9:26 am

Yes, it is exactly that. Denial of service from some type of IPv6 packet flood, where router runs out of resources. It was answered, that we accept this as a bug, but we would not call it a vulnerability, because there are many ways how to exhaust resources of any device.
No answer to your question? How to write posts
 
anuser
Member
Member
Posts: 370
Joined: Sat Nov 29, 2014 7:27 pm

Re: Security announcement blog

Wed Oct 10, 2018 10:03 pm

Talking about IPv6 attacks. Get https://github.com/vanhauser-thc/thc-ipv6 and try it in your subnet with different options while some clients will immediately have 100% of cpu usage. And you cannot block all of those attacks on even modern switching hardware.
 
User avatar
maznu
Member Candidate
Member Candidate
Posts: 197
Joined: Tue May 05, 2015 11:12 am
Location: Manchester, UK
Contact:

Re: Security announcement blog

Fri Oct 12, 2018 10:23 am

Yes, it is exactly that. Denial of service from some type of IPv6 packet flood, where router runs out of resources. It was answered, that we accept this as a bug, but we would not call it a vulnerability, because there are many ways how to exhaust resources of any device.
If I send IPv6 packets at a gigabit across a gigabit-capable router with the same src+dst addresses, everything is fine. Your routers route packets just fine.

But if I send IPv6 packets at a gigabit across the same router — but the packets have DIFFERENT DST addresses — then the router crashes.

NOTE: This is NOT IPv6 neighbour exhaustion — the router being "attacked" does not need to be directly connected to the DST addresses. It is caused by the router *transitting* those packets. It took many emails for your team to realise this, because they were deflecting this as "resource exhaustion" caused by IPv6 ND. Your team finally accepted that this is a problem for routers in between the SRC and DST subnets.
Marek
 
User avatar
maznu
Member Candidate
Member Candidate
Posts: 197
Joined: Tue May 05, 2015 11:12 am
Location: Manchester, UK
Contact:

Re: Security announcement blog

Fri Oct 12, 2018 10:30 am

Can it be prevented with firewall?
It can be firewalled by not routing any IPv6. But if you have a RouterOS device anywhere in the path between one subnet and another subnet, even if not directly connected to that router, and it is forwarding IPv6 packets, it is vulnerable to being crashed.
Maybe you need to publish it to generate some pressure...
I'm starting to believe that this is the only way forward, sadly.

A router should be able to *route* packets. It should not crash just because lots of different addresses were used. The quickest way to demonstrate/test the vulnerability is to use a "flooding tool" — but we see organisations are starting to scan IPv6 address space, which if done quickly enough, will cause a crash for an IPv6 transit provider.

I don't believe IPv6 ND should crash RouterOS either — that's also a denial of service security issue in my mind. But the ticket I refer to affects all RouterOS devices between the source and destination, regardless of whether the attacker or target subnet are directly connected to the victim router.

Several forum members have been involved in this discovery: viewtopic.php?f=2&t=125841&p=654538

Please, MikroTik, consider this to be a denial of service vulnerability.
Marek

Who is online

Users browsing this forum: No registered users and 9 guests