Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

badpackets.net

Post reply on HN
Print view View original

31–40 of 76 posts

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#31

Post by philamonster »

Tharkun wrote: post #5

So ... which SoHo router manufacturer can we actually trust? It seems pretty common in this industry to either not supply security updates, or to only supply them for a very short amount of time.

https://blog.mikrotik.com/security/new-exploit-for-mikrotik-...

"Regardless of version used, all RouterOS versions that have the default firewall enabled, are not vulnerable"

I don't believe all MK devices OOTB had the WAN interface firewall'd (they do now though their wAP's run same license level 4 of RouterOS and do not have fw enabled on the ethernet port) though I do recall that being made very clear in both the documentation that came with the hardware and in any wiki/docs I looked at at the time I was first setting up my MK device.

The issue I have is the lack of communication with customers. I have not received any notification of this vuln since August 5th (well since patched in April) but they in general seem rather blase about the whole thing. I haven't followed the link to story but I follow BPR on Twitter and saw that it's around 421K according to censysio.

https://twitter.com/bad_packets/status/1050533001824595968

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#32

Post by lowry »

I have several hAP ac Mikrotik routers and upgrading them is a pain. You can not just download an image from their website, flash and reboot. If you do so, your router will likely be locked in a bootloop.

I managed to have consistent upgrades by using only the main package and Netinstall, but it is still a huge pain in the ass.

Mikrotik makes stable routers, but they messed up the upgrade process completely.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#33

Post by philamonster »

lowry wrote: post #32

I have several hAP ac Mikrotik routers and upgrading them is a pain. You can not just download an image from their website, flash and reboot. If you do so, your router will likely be locked in a bootloop. I managed to have consistent upgrades by using only the main package and Netinstall, but it is still a huge pain in the ass. Mikrotik makes stable routers, but they messed up the upgrade process completely.

Huh? With the exception of them converting all master > slave port configs to bridges in 6.41 I believe, I have never had any issues using System > Packages > Check for updates, selecting bugfix as opposed to current branch and downloading and installing in Winbox. SwOS devices I need to download a binary and upgrade through web (no Winbox) but still have never had any issues.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#34

Post by Tae3cahN »

SuoDuanDao wrote: post #12
have_faith wrote: post #4

If you have a currency that can be generated via compute power the incentive structure it creates is to take over as much compute power as you can. Does the incentive structure represent a serious design flaw in the system for widespread adoption?

I would say it's a consequence of computer power becoming commoditized - the flaw might be that using computer power in the past can be 'stored', unlike hijacking someone else's computer and renting it out as server space, there's a point in this kind of crime where one has the profits and got away with it. I just had this thought and want to get it down, apologies for the rant: I suspect that philosophically, the ba…

I think both types of currency are important. Humans have basic needs which need to be met in the shape of atoms and joules which are quite storable. We also have luxury wants which translate better to watts. This separation might also be useful in the context of UBI schemes. And more generally I have a gut feeling, but can't quite substantiate, that many fairness problems stem from using the same currency for both, forcing the lower classes to work multiple jobs just to make basic needs while the haves compete with them just to improve their lifestyle and status.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#35

Post by ciupicri »

Tharkun wrote: post #5

So ... which SoHo router manufacturer can we actually trust? It seems pretty common in this industry to either not supply security updates, or to only supply them for a very short amount of time.

> A patch was issued earlier this year by MikroTik, however the latest statistics (above) reveal device owners and network operators have chosen not to apply it.

So MikroTik did its part.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#36

Post by lowry »

anc84 wrote: post #20
thecatspaw wrote: post #7

Earlier quoted context omitted.

Turris omnia. Open source (both hardware and software), lets you ssh into it directly out of the box (well, after you have set a root password in the gui) They provide regular software updates, and it is imho a good hacker/tinkerer router.

300€ is about 5 times what I would consider a price to pay for a home router though.

This is about 5 times the price of hAP ac from Mikrotik, and hAP ac can do some things much faster due to hardware acceleration of some of its capabilities in Qualcomm QCA8337 switch chip.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#37

Post by lowry »

philamonster wrote: post #33
lowry wrote: post #32

I have several hAP ac Mikrotik routers and upgrading them is a pain. You can not just download an image from their website, flash and reboot. If you do so, your router will likely be locked in a bootloop. I managed to have consistent upgrades by using only the main package and Netinstall, but it is still a huge pain in the ass. Mikrotik makes stable routers, but they messed up the upgrade process completely.

Huh? With the exception of them converting all master > slave port configs to bridges in 6.41 I believe, I have never had any issues using System > Packages > Check for updates, selecting bugfix as opposed to current branch and downloading and installing in Winbox. SwOS devices I need to download a binary and upgrade through web (no Winbox) but still have never had any issues.

Try doing it through the web interface, you'll be unpleasantly surprised.

I just upgraded my last hAP ac from 6.39.2 to 6.42.9 through the web interface, entered the bootloop, then did the Netinstall of the system package only, then manually restored the configuration.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#38

Post by sathackr »

lowry wrote: post #32

I have several hAP ac Mikrotik routers and upgrading them is a pain. You can not just download an image from their website, flash and reboot. If you do so, your router will likely be locked in a bootloop. I managed to have consistent upgrades by using only the main package and Netinstall, but it is still a huge pain in the ass. Mikrotik makes stable routers, but they messed up the upgrade process completely.

I don't see it any more cumbersome than Juniper, Cisco, or any other enterprise hardware manufacturer(not saying that Mikrotik is enterprise hardware...) I manage several networks totaling 500+ Mikrotik routers.

Once or twice I have run into upgrade issues that had to be resolved with a technician on site (broke vlan configs)

Just once the update wiped the config.

This is out of several thousand successful updates. I've run into similar issues with other big router manufacturers.

Like most companies, you do not want to be on the 'bleeding edge' of their updates unless absolutely necessary. They do have a significant problem with regressions in their updates.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#39

Post by sathackr »

lowry wrote: post #37
philamonster wrote: post #33

Earlier quoted context omitted.

Huh? With the exception of them converting all master > slave port configs to bridges in 6.41 I believe, I have never had any issues using System > Packages > Check for updates, selecting bugfix as opposed to current branch and downloading and installing in Winbox. SwOS devices I need to download a binary and upgrade through web (no Winbox) but still have never had any issues.

Try doing it through the web interface, you'll be unpleasantly surprised. I just upgraded my last hAP ac from 6.39.2 to 6.42.9 through the web interface, entered the bootloop, then did the Netinstall of the system package only, then manually restored the configuration.

I exclusively use the web interface and haven't seen this after thousands of upgrades.

Upload the package to the router(make sure it completes)

Reboot the router.

Upgrade the bios "Routerboard firmware"

Reboot the router.

And done.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#40

Post by miahi »

lowry wrote: post #32

I have several hAP ac Mikrotik routers and upgrading them is a pain. You can not just download an image from their website, flash and reboot. If you do so, your router will likely be locked in a bootloop. I managed to have consistent upgrades by using only the main package and Netinstall, but it is still a huge pain in the ass. Mikrotik makes stable routers, but they messed up the upgrade process completely.

I also have several hAP ac routers and had no issue upgrading them. I only had a problem with an older routerboard (first time I tried upgrading my first ever Mikrotik), but that was because I did not know how the upgrade works and I cut off the power during the reboot (I was under the impression I have to reboot it manually).

I never use the web interface though - winbox is way better.

Post reply on HN