Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

badpackets.net

Post reply on HN
Print view View original

61–70 of 76 posts

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#61

Post by hendry »

philamonster wrote: post #57
hendry wrote: post #47

IMHO Mikrotik are being sloppy by introducing breaking changes to their stable channel. Hence ISPs are reluctant to update automatically, fearing some subtle bridge/VLAN change which is sadly set to happen again (6.43 -> 6.44!). Also doesn't help that the underlying Linux stable kernel updates more than once a week. Every Internet connected device needs some automatic update functionality by default. It's tricky for…

Are these changes coming in bugfix channel as well? I'm currently in holding pattern going from 6.40.9 to 6.42.9 due to master > slave to bridge change which occurred in March I believe. Point is bugfix seems to be less affected by major changes like this (first I have experienced in 3 years).

tbh I think you should be good with bugfix. I've not tried, just going on what others have said to me.

I'm a stable updating kindof guy.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#62

Post by NoErx »

hkt wrote: post #25

Does anyone know if Ubiquiti's edgerouters are any good?

I have an EdgeRouter X and I'm searching for a replacement.

EdgeRouter X issues:

* 3.10 kernel. This is out of LTS support.

* Poor IPv6 support. The GUI has practically 0 support and you instead have to learn EdgeOS config, and it's awkward.

I'm happy to use EdgeRouter X as a switch, so I'm looking for a SBC that can act as router/firewall and run vanilla Debian.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#64

Post by tagno25 »

hendry wrote: post #47

IMHO Mikrotik are being sloppy by introducing breaking changes to their stable channel. Hence ISPs are reluctant to update automatically, fearing some subtle bridge/VLAN change which is sadly set to happen again (6.43 -> 6.44!). Also doesn't help that the underlying Linux stable kernel updates more than once a week. Every Internet connected device needs some automatic update functionality by default. It's tricky for…

I would use the built in install function to automatically reboot after the update is downloaded. Your current schedule will reboot the router even if there is no update available.

I have a script I have been running for a year without issue. It check for an update, and then if there is an update installs it. https://gist.github.com/tagno25/b207786b02b89700860028e4e247...

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#65

Post by NoErx »

NoErx wrote: post #62
hkt wrote: post #25

Does anyone know if Ubiquiti's edgerouters are any good?

I have an EdgeRouter X and I'm searching for a replacement. EdgeRouter X issues: * 3.10 kernel. This is out of LTS support. * Poor IPv6 support. The GUI has practically 0 support and you instead have to learn EdgeOS config, and it's awkward. I'm happy to use EdgeRouter X as a switch, so I'm looking for a SBC that can act as router/firewall and run vanilla Debian.

Scratch that. Upon reading VyOS's docs for the EdgeOS config (which has relatively poorer docs), it has strong advantages: commit/rollback, single config file, and Ansible has an EdgeOS module included by default to coordinate that.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#66

Post by aequitas »

lowry wrote: post #32

I have several hAP ac Mikrotik routers and upgrading them is a pain. You can not just download an image from their website, flash and reboot. If you do so, your router will likely be locked in a bootloop. I managed to have consistent upgrades by using only the main package and Netinstall, but it is still a huge pain in the ass. Mikrotik makes stable routers, but they messed up the upgrade process completely.

Only issue I sometimes had with updates is limited memory (on the lowend hap lite devices). Often a reboot before upgrade download was enough to solve that.

But the standard upgrade procedure is to put the new firmware image in the filesystem root (scp, update button via UI, etc) and reboot the device.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#67

Post by mverwijs »

hendry wrote: post #47

IMHO Mikrotik are being sloppy by introducing breaking changes to their stable channel. Hence ISPs are reluctant to update automatically, fearing some subtle bridge/VLAN change which is sadly set to happen again (6.43 -> 6.44!). Also doesn't help that the underlying Linux stable kernel updates more than once a week. Every Internet connected device needs some automatic update functionality by default. It's tricky for…

Underlying Linux kernel updates? I thought their OS was built from scratch?

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#69

Post by auslander »

ajnin wrote: post #24
Tharkun wrote: post #5

So ... which SoHo router manufacturer can we actually trust? It seems pretty common in this industry to either not supply security updates, or to only supply them for a very short amount of time.

I bought a mini PC with 4 Gigabit Ethernet ports and Wifi, i5, 4G RAM, 32G SSD (probably way overkill for a router but I can do other stuff on it) on Aliexpress for about 250 USD and put Debian on it. I heard it works well with pfsense too.

Try OPNsense, it has hardened GUI server, and is stable as hell.

Re: 200,000+ MikroTik routers worldwide compromised to inject cryptojacking malware

#70

Post by r1ch »

mverwijs wrote: post #67
hendry wrote: post #47

IMHO Mikrotik are being sloppy by introducing breaking changes to their stable channel. Hence ISPs are reluctant to update automatically, fearing some subtle bridge/VLAN change which is sadly set to happen again (6.43 -> 6.44!). Also doesn't help that the underlying Linux stable kernel updates more than once a week. Every Internet connected device needs some automatic update functionality by default. It's tricky for…

Underlying Linux kernel updates? I thought their OS was built from scratch?

RouterOS is a proprietary set of programs (all the way from an init replacement) on top of Linux (a super old version of Linux at that, Kernel 3.x from 2012 IIRC) with a bunch of patches to hack in all the necessary hardware support.
Post reply on HN