Community discussions

MikroTik App
 
Rossen
just joined
Topic Author
Posts: 2
Joined: Fri Apr 14, 2023 8:08 am

Mikrotik products packaging

Fri Apr 14, 2023 8:38 am

Hi guys,
Apologies if this is not the correct place for this topic, but I wasn't sure where to post it.

Last week I purchased a Hap Ax3 and a RB260GS switch from two different local online stores in my country.
Both of the devices didn't have plastic wrap or even stickers on the outer brown boxes. Meaning anyone from those stores could have had physical access to the devices.
Since this is my first time buying MT products - is this normal for the brand, like a green initiative or should I be worried?

Both products looked brand new and neatly packaged. I was so happy to dig into the new devices (I have been waiting for the hap ax3 since last year) that I started using them, but now I am starting to worry if they could have been compromised. I am not somebody important and I know this is bordering on paranoid, but I guess it is a question of principle.

Is it even possible for someone with physical access to do something to those devices (one runnning RouterOS and the other switchOS) and what would be the best way for me to check? By doing something I mean installing a backdoor, a rootkit, a sniffer or any other kind of malware. I checked for weird services, firewall rules, dns entries and everything seems to be the defaults, but I am not very advanced in networking.

Should I reflash the firmware just to be sure? Would that even help? Or should I complain and return the products? I really don't want to, since they are both awesome :)
The signal strength of the ax3 is amazing and the options I get from the software are great. I am coming from openWRT, which is great in its own right, but so far I think I like RouterOS better!

Thank you in advance for your feedback.
 
User avatar
normis
MikroTik Support
MikroTik Support
Posts: 26322
Joined: Fri May 28, 2004 11:04 am
Location: Riga, Latvia

Re: Mikrotik products packaging

Fri Apr 14, 2023 9:15 am

Yes, MikroTik boxes are always simply cardboard without any wrap, for environmental reasons.
You can do a boot-reset to be sure that devices are not tampered with, although I don't see what is the worst case. RouterOS is not Windows, you can't install secret applications on it. Only modify the configuration, which you are able to see and edit anyway.
Connect and do a command line command "/export" to see what is configured there.
 
User avatar
Buckeye
Forum Veteran
Forum Veteran
Posts: 887
Joined: Tue Sep 11, 2018 2:03 am
Location: Ohio, USA

Re: Mikrotik products packaging

Fri Apr 14, 2023 10:09 am

You can connect with winbox, open a new terminal and issue /system/resource/print or use system->resource from "GUI". Look at write-sect-total.

When I got my new 5009 it had

[admin@MikroTik] > /system/resource/print
uptime: 38m10s
version: 7.6 (stable)
build-time: Oct/17/2022 10:55:40
factory-software: 7.4.1
free-memory: 837.9MiB
total-memory: 1024.0MiB
cpu: ARM64
cpu-count: 4
cpu-frequency: 350MHz
cpu-load: 0%
free-hdd-space: 993.6MiB
total-hdd-space: 1025.0MiB
write-sect-since-reboot: 267
write-sect-total: 267
bad-blocks: 0%
architecture-name: arm64
board-name: RB5009UG+S+
platform: MikroTik
[admin@MikroTik] >
 
User avatar
Amm0
Forum Guru
Forum Guru
Posts: 3254
Joined: Sun May 01, 2016 7:12 pm
Location: California

Re: Mikrotik products packaging

Fri Apr 14, 2023 5:11 pm

The signal strength of the ax3 is amazing and the options I get from the software are great. I am coming from openWRT, which is great in its own right, but so far I think I like RouterOS better!
That's one for @normis's office wall...

Should I reflash the firmware just to be sure? Would that even help?
If you're worried, they do have tool to reformat/reflash the device with a known package from www.mikrotik.com. See the "netinstall" tool to do this:
https://help.mikrotik.com/docs/display/ROS/Netinstall
 
User avatar
rextended
Forum Guru
Forum Guru
Posts: 11982
Joined: Tue Feb 25, 2014 12:49 pm
Location: Italy
Contact:

Re: Mikrotik products packaging

Fri Apr 14, 2023 6:20 pm

Do not uselessly worry, your smartphone and your computer have more rootkit than the RouterBOARD....
 
Rossen
just joined
Topic Author
Posts: 2
Joined: Fri Apr 14, 2023 8:08 am

Re: Mikrotik products packaging

Wed Apr 19, 2023 7:13 am

Thank you very much for the replies! I am definitely more at ease now.
My concerns came from a few videos on youtube, which show unboxings of ac3 and there is clearly a yellow anti-tamper sticker. Like this one: https://www.youtube.com/watch?v=6KDD2wmvyj0
I know this is a different model and maybe it is no longer done or differs from country to country?

I also stumbled upon discussions like this:https://security.stackexchange.com/ques ... sed-router
It is about buying a used router, but it is the same principle. They talk about a lot of ways to compromise a device once you have physical access to it. Although in retrospect it does seem a little overparanoid and I am glad to learn that routerOS is secured on many of the vectors described. Although I was just reading the documentation on running containers where it states this:

Disclaimer
you need physical access to the router to enable support for the container feature, it is disabled by default;
once the container feature is enabled, containers can be added/configured/started/stopped/removed remotely!
if the router is compromised, containers can be used to easily install malicious software in your router and over network;
your router is as secure as anything you run in container;
if you run container, there is no security guarantee of any kind;
running a 3rd party container image on your router could open a security hole/attack vector/attack surface;
an expert with knowledge how to build exploits will be able to jailbreak/elevate to root;
and this:
Security risks:
when a security expert publishes his exploit research - anyone can apply such an exploit;
someone will build a container image that will do the exploit AND provide a Linux root shell;
by using a root shell someone may leave a permanent backdoor/vulnerability in your RouterOS system even after the docker image is removed and the container feature disabled;
if a vulnerability is injected into the primary or secondary routerboot (or vendor pre-loader), then even netinstall may not be able to fix it;

That last line is a bit scary. Needless to say I checked and I only have routeros and wifiwave2 packages installed. I also confirmed that there are no scripts scheduled to run on boot time in the system scheduler. But aren't containers (and maybe scripts) a way to run arbitrary code on routerOS?

I don't see anything wrong in the report from /export, though I cannot claim that I understand everything. It is awesome that such an option exists! BTW I have disabled all services, besides the webserver on port 80. And /system/resource/print gives me this:
uptime: 5d20h58m5s
version: 7.8 (stable)
build-time: Feb/24/2023 09:03:00
factory-software: 7.5
free-memory: 660.8MiB
total-memory: 960.0MiB
cpu: ARM64
cpu-count: 4
cpu-frequency: 864MHz
cpu-load: 0%
free-hdd-space: 95.2MiB
total-hdd-space: 128.5MiB
write-sect-since-reboot: 6168
write-sect-total: 22038
bad-blocks: 0%
architecture-name: arm64
board-name: hAP ax^3
platform: MikroTik
I did update to 7.8 so maybe that is why write-sect-total is that high?

Do not uselessly worry, your smartphone and your computer have more rootkit than the RouterBOARD....
I never meant to imply there was anything wrong with the RouterBOARD, but after it left the factory :) After all this is the device that now protects me and my family from the internet :)

I will look into Netinstall, but will probably refrain from flashing for now, since I see there is no reason. Going on this rabbit hole has given me a big incentive to better educate myself and keep finding out new things about routerOS :)
 
User avatar
Buckeye
Forum Veteran
Forum Veteran
Posts: 887
Joined: Tue Sep 11, 2018 2:03 am
Location: Ohio, USA

Re: Mikrotik products packaging

Wed Apr 19, 2023 7:36 am

I had seen another thread Know if the product is new - rb5009 where someone thought they had been sold a used router, and I saw the note about checking total write sectors, and that is one of the first things I did after taking my RB5009 out of the "unsealed" box.

Note you have over 6000 since it was last rebooted, about 28% of the total writes. So I am reasonably sure you have an unused router.

and my RB5009 also came with 7.6 loaded but "factory software 7.4.1". Remember what "factory software" means, the lowest version of software compatible with the hardware version/revision. And ROS won't allow you to load any version lower than the "factory software".

For what it is worth, I recently bought a Raspberry Pi Debug Probe (an official Raspberry Pi Foundation product based on the RP2040 microcontroller, which has a 3.3V TTL UART connection as well as an ARM CMSIS-DAP two wire serial debug connection) at the local MicroCenter, and it was in an unsealed box as well. Raspberry Pi usually came is a "glued tab" red box, but this came in white 125mm x 40mm x 32mm box with just a tucked tab box, with no easy way to see if someone pinched part of the contents. But this box did have a list of contents that you could verify before buying. This is semi-related to MikroTik, because I am hoping I can use this as a console connection for the RB5009, but no progress yet, it is still in the unsealed box.

Who is online

Users browsing this forum: No registered users and 13 guests