Do NOT visit...trojan at URL!
That stinks. I tried to help the community by providing a warning and I get downvoted. What is the motivation to help? From now on I will not issue any warnings.
MikroTik routers are forwarding owners’ traffic to unknown attackers
141–150 of 151 posts
Re: MikroTik routers are forwarding owners’ traffic to unknown attackers
#142Re: MikroTik routers are forwarding owners’ traffic to unknown attackers
#143Earlier quoted context omitted.
Also change the winbox port if you need it to be enabled.
That's a way not to be the low-hanging fruit, but if someone wants this port they're going to find it.
Of course. But the attack mentioned above looks to have simply targeted the default port. Ideally : use a non-default port, and source-IP-based firewalling, and keep firmware up to date.
Re: MikroTik routers are forwarding owners’ traffic to unknown attackers
#144Earlier quoted context omitted.
Ubiquiti EdgeOS based edgerouters are what I prefer as a greybeard sysadmin type who has dealt with everything under the sun. It's VyOS (Vyatta) based, they are now complying with gpl afaik, and their hardware is really good for the price/performance ratio. The edgerouter-x or lite can be found for ~$99 and is a great piece of gear. Another option would be your own hardware with pfsense (bsd) or ipfire(linux). Even f…
The ERL family is pretty bad as a router, in my experience. There is a longstanding firmware issue that introduces packet loss for routed packets (it doesn't multiplex across the dual cores correctly, which leads to out of order packets). If you really want to use Ubiquiti, I would suggest using an ER-X which is cheaper, doesn't have this problem, and is quadcore. The best option in my opinion is something Intel base…
I think this is batch based. Ubiquiti has had prod line issues intermittently, especially in the earlier batches. I would suggest trying to contact them for a replacement if you are getting packet loss.
Re: MikroTik routers are forwarding owners’ traffic to unknown attackers
#145Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…
Ubiquiti EdgeOS based edgerouters are what I prefer as a greybeard sysadmin type who has dealt with everything under the sun. It's VyOS (Vyatta) based, they are now complying with gpl afaik, and their hardware is really good for the price/performance ratio. The edgerouter-x or lite can be found for ~$99 and is a great piece of gear. Another option would be your own hardware with pfsense (bsd) or ipfire(linux). Even f…
I like the software but for some reason my SFP port intermittently went out for exactly 2 minutes. I tested it with a couple of different SFP modules to be sure that wasn't the problem and contacted Ubiquiti support, assuming I could get an RMA.
For whatever braindead reason, they told me that they wouldn't give me an RMA because they don't "support" 3rd party SFP modules. They wouldn't loan me one to fix the problem, they wouldn't agree to reimburse me if it didn't fix the problem, nothing. Buy their module or deal with broken equipment.
I bought one of their SFP modules and to nobody's surprise the problem persisted. At the same time I bought a Mikrotik hAP and again to nobody's surprise, all the SFP modules that "failed" worked with zero problems.
At that point Ubiquiti finally granted me an RMA but at that point I went and got a refund instead.
After that support experience, I'll never buy Ubiquiti or recommend it again.
I'd much rather recommend PC-Engines: https://www.pcengines.ch/. They're x86 based so you can run whatever on them, cheap and have really good performance.
Re: MikroTik routers are forwarding owners’ traffic to unknown attackers
#146Earlier quoted context omitted.
The ERL family is pretty bad as a router, in my experience. There is a longstanding firmware issue that introduces packet loss for routed packets (it doesn't multiplex across the dual cores correctly, which leads to out of order packets). If you really want to use Ubiquiti, I would suggest using an ER-X which is cheaper, doesn't have this problem, and is quadcore. The best option in my opinion is something Intel base…
I think this is batch based. Ubiquiti has had prod line issues intermittently, especially in the earlier batches. I would suggest trying to contact them for a replacement if you are getting packet loss.
[deleted]
Re: MikroTik routers are forwarding owners’ traffic to unknown attackers
#147It's worth pointing out that the default configuration of almost every Mikrotik router these days comes with a firewall that blocks inbound access to all ports. Admins have to go out of their way to expose winbox to the internet (as many did - including myself - under the belief the protocol was somewhat secure running over TLS). Unfortunately NIH syndrome runs at an all time high at Mikrotik. Even the RouterOS webse…
This explains a lot. Mikrotik boxes are really quirky. They basically have user-facing bugs, symptoms of which can have no explanation except for them fronting some massive clusterfuck on the inside. They used to do bizarre things with timestamps of freshly copied files, when the modified time would oscillate around some convergence point. Some wierd directory names (like .popup ?) were reserved for no apparent reaso…
I've been using MT gear for about 10 years now. I actually think the devices themselves are very solid once they're up and running. I've had some running for years without any issues (try that with most other SOHO router brands!), though reboots are much more frequent these days due to security updates. I do agree though that the software side of things can be a bit quirky and the recent security issues are a worrying glimpse into the quality of their code. In general I wish the platform was more open (you can't even get a shell without rooting the device), but it's something I can live with at this price point.
Unfortunately given their affordability and feature set, Mikrotik routers are often times administered by people who don't really have a solid grasp of networking. I've seen some downright awful advice posted on their user forums over the years, stuff that could easily cause connectivity issues under the right circumstances. Who knows how much of that gets copy/pasted into configs after a quick Google search.
Re: MikroTik routers are forwarding owners’ traffic to unknown attackers
#148Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…
The Netgear Nighthawk series is almost always available on Amazon and is generally well supported by dd-wrt. Specifically, the best deals can be had on the oldest model, the R6700v3, from an Amazon warehouse deal for $70. This is what I use, and it works without issue with dd-wrt. You'll need to flash it 3 times. The best device is probably the R7800 model. It uses a very fast, non-Broadcom (OpenWRT-supported), moder…
Quick word of caution on the r6700 series: Be careful to avoid the r6700v2 if interested in third-party firmwares. v2 is incompatible for chip-related reasons I don't fully understand, or was as of just a couple months ago. Easy to miss the v2 part when shopping on Amazon, which is how I ended up with my current doorstop.
Re: MikroTik routers are forwarding owners’ traffic to unknown attackers
#149Earlier quoted context omitted.
that's a month old; has the compromise been going on that long? i guess so...
It's been occurring since at least March I think? https://blog.mikrotik.com/security/winbox-vulnerability.html https://forum.mikrotik.com/viewtopic.php?f=21&t=137572
No. That's when the vulnerability was discovered.
The cryptojacking attacks on routers began a month ago. Qihoo is just reporting on an ongoing campaign. But I didn't see anything different from the Trustwave report, except that attackers misconfigured some routers to send traffic into a blackhole for some reason.
Re: MikroTik routers are forwarding owners’ traffic to unknown attackers
#150Earlier quoted context omitted.
Afaik winbox is the only way to reconfigure the device in case of serious IP misconfiguration, or if layer 3 networking does not work for some reason (I just had to debug a switching loop...), as winbox can connect by MAC, rather than IP.
In such a situation I would probably hard reset and upload a saved configuration... certainly not ideal.
My equipment is hidden in walls and hard to reset. However, in this case, the problem was at the physical layer, not software configuration, so a reset would not have accomplished anything.
Since I do not use Windows, I had to emulate Winbox in Wine... pretty awful experience, but in the end it worked while everything else failed.
I would just prefer some sort of unix tool that ssh can use to connect to the equipment through layer 2.