{"id":5520,"date":"2018-04-26T00:56:00","date_gmt":"2018-04-25T22:56:00","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=5520"},"modified":"2018-04-25T22:56:38","modified_gmt":"2018-04-25T20:56:38","slug":"patch-your-mikrotik-routers-there-are-attacks-in-the-wild","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2018\/04\/26\/patch-your-mikrotik-routers-there-are-attacks-in-the-wild\/","title":{"rendered":"Patch your MikroTik routers, there are attacks in the wild"},"content":{"rendered":"

[German<\/a>]Users of micro-routers should urgently update their firmware. Because a vulnerability that became known two days ago is already being exploited for attacks. <\/p>\n

<\/p>\n

Vulnerability known, update available<\/h2>\n

Two days ago Mikrotik released a Security Advisory Vulnerability exploiting the Winbox port<\/a> (see also my German blog post Mikrotik-Router: Sicherheitsl\u00fccke im Winbox-Port<\/a> about this vulnerability). <\/p>\n

The vulnerability was discovered by Mikrotik and affects all RouterOS versions from v6.29 to.43rc3. The vulnerability allowed a special tool to connect to the Winbox port and request the system user's database file.<\/p>\n

\"MikroTik-Router<\/p>\n

The manufacturer has already released the router OS versions v6.42.1 and v6.43rc4 on April 23, 2018, which close this vulnerability. <\/p>\n

Download<\/a><\/p>\n

First attacks observed<\/h2>\n

Bleeping Computer reported here<\/a> that exactly this vulnerability is already being exploited. According to a Czech forum, a zero-day exploit was discovered with which the user database can be read.  <\/p>\n

\"Logs<\/a>
(Source: Bleeping Computer)<\/p>\n

If the attacker succeeds in accessing the user data and decrypting the data, he can then log into the system via the web interface of the router. The hacks followed a similar pattern. The attacker produces two failed Winbox logon attempts and one successful login (screenshot above). Then he changes some services in the router and logs off to come back a few hours later.<\/p>\n

All attacks were conducted using Winbox, a remote management service MikroTik offers with its routers to allow users to configure devices over a network or the Internet. The Winbox service (port 8291) is delivered with all MikroTik devices by default.<\/p>\n

Zero-Day was not used on a massive scale<\/h2>\n

The good news is that so far all attacks have only been performed from one IP address, indicating that this was the work of a single hacker. The IP address 103.1.221.39 of the attacker, which all attacked users reported, was assigned in Taiwan.<\/p>\n

However, you should update immediately and change the login passwords for the router access as a precaution. <\/p>\n","protected":false},"excerpt":{"rendered":"

[German]Users of micro-routers should urgently update their firmware. Because a vulnerability that became known two days ago is already being exploited for attacks.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[448,580],"tags":[587,69,195],"class_list":["post-5520","post","type-post","status-publish","format-standard","hentry","category-devices","category-security","tag-router","tag-security","tag-update"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/5520","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=5520"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/5520\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=5520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=5520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=5520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}