Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MikroTik routers are forwarding owners’ traffic to unknown attackers

blog.netlab.360.com

Post reply on HN
Print view View original

21–30 of 151 posts

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#21

Post by CallMeZach »

kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

I like Mikrotik hap ac(at work) or hap ac lite (at home). they simply work. always.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#22

Post by yjftsjthsd-h »

kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

I know this doesn't help friends and non-technical folks, but I finally gave up and bought an APU[0], installed Debian, and configured dnsmasq+hostapd+iptables. With unattended updates, it was the most secure thing I could think of. Well, I suppose using openbsd would have been potentially more secure, but there were driver issues with the wireless card that I wanted.

[0] https://pcengines.ch/apu2.htm

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#23

Post by 24gttghh »

isostatic wrote: post #6

My home router has the following /ip firewall filter add action=accept chain=input connection-state=established add action=accept chain=input connection-state=related add action=accept chain=input dst-port=5000 protocol=udp add action=accept chain=input dst-port=6000 protocol=udp add action=accept chain=input dst-port=6001 protocol=udp add action=accept chain=input protocol=icmp add action=accept chain=input dst-port…

You could limit only certain ICMP types as well, and change your SSH port. And you can ask yourself: Do I really need access to my firewall from work?

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#24

Post by 24gttghh »

appleflaxen wrote: post #16
ccnafr wrote: post #3

Earlier quoted context omitted.

It's basically another take on this older report: https://www.trustwave.com/Resources/SpiderLabs-Blog/Mass-Mik...

that's a month old; has the compromise been going on that long? i guess so...

It's been occurring since at least March I think?

https://blog.mikrotik.com/security/winbox-vulnerability.html

https://forum.mikrotik.com/viewtopic.php?f=21&t=137572

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#25

Post by pingec »

kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

You can take a look here https://forum.openwrt.org/c/hardware-questions-and-recommend...

There are many brands and models that are compatible with OpenWRT. I have good experience with tp-link wr1043nd, wdr3600 but they are a bit old by now. I just ordered ZyXEL NBG6617 to test out.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#26

Post by rando444 »

kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

(1) Ask the manufacturer

(2) If you get the wrong router, just return it and get another.

(3) Buy a router at a brick and mortar store so you know what you're getting.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#28

Post by kuon »

yjftsjthsd-h wrote: post #22
kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

I know this doesn't help friends and non-technical folks, but I finally gave up and bought an APU[0], installed Debian, and configured dnsmasq+hostapd+iptables. With unattended updates, it was the most secure thing I could think of. Well, I suppose using openbsd would have been potentially more secure, but there were driver issues with the wireless card that I wanted. [0] https://pcengines.ch/apu2.htm

I second that. I don't use wireless and know OpenBSD well, so I went the OpenBSD route, but I am sure linux can be made to be very secure if configured properly.

It can sustain 500mbit/s with no issue. As this is my internet connection speed, I don't know if it can go any higher.

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#29

Post by TeMPOraL »

> After enabling the Mikrotik RouterOS HTTP proxy, the attacker uses a trick in the configuration by redirecting all the HTTP proxy requests to a local HTTP 403 error page, and in this error page a link for web mining code from coinhive.com is inserted. By doing this, the attacker hopes to perform web mining for all the proxy traffic on the users’ devices

> What is disappointing for the attacker though, the mining code does not work in this way, because all the external web resources, including those from coinhive.com necessary for web mining, are blocked by the proxy ACLs set by attackers themselves.

Smart enough to breach Mikrotik routers. Dumb enough to fuck up linking in coinhive JS. That screams "script kiddie buying delivery method on an open market".

Also, how is coinhive still a thing?

Re: MikroTik routers are forwarding owners’ traffic to unknown attackers

#30

Post by discreditable »

sokoloff wrote: post #19
kibwen wrote: post #14

Can anyone suggest a wireless router that someone can buy today that either ships with or can be flashed with OSS firmware? I've been trying to shop around for one compatible with DD-WRT or OpenWRT and been rather disheartened so far; every promising model I've found either requires you to play roulette with the specific hardware version of the router that you receive (which is never advertised on product pages), or…

I just last weekend retired a pair of Asus RT-AC66U routers/access points. They ran stable for years on Tomato (version tomato-RT-AC66U_AT-RT-AC6x-3.4-140-AIO-64K.trx) and I think all the hardware revisions work, but confirm that yourself. I retired them mostly because the Ubiquiti management is much easier and that hardware also affordable (though the software is not open, so not a fit for your use case).

Same case for me. I had an AC88U. I got tired of it because the 5GHz 802.11ac radio seemed like it'd be forever broken in OSS firmwares. I felt asuswrt was pretty crappy too. I went ubiquiti. Their management is nice, and they actually seem interested in fixing bugs in their firmware.
Post reply on HN