Cisco informed us on May 22nd of 2018, that a malicious tool was found on several manufacturer devices, including three devices made by MikroTik. We are highly certain that this malware was installed on these devices through a vulnerability in MikroTik RouterOS software, which was already patched by MikroTik in March 2017*. Simply upgrading RouterOS software deletes the malware, any other 3rd party files and closes the vulnerability. Let us know if you need more details. Upgrading RouterOS is done by a few clicks and takes only a minute.

To be safe against any kinds of attacks, make sure you secure access to your devices:
https://wiki.mikrotik.com/wiki/Manual:S ... our_Router

P.S: The name VPNfilter is only a code name of the malware that was found (more specifically, a fake executable name). The modus operandi of this tool has no relation to VPN tunnels. In basic terms, the malware could either sniff certain types of traffic and send it somewhere, or destroy the routers.

*: viewtopic.php?f=21&t=132499

Thanks for the heads-up.

Is there a specific version from which this malware is able to infect a mikrotik?
How about RouterOS 5.22 for example or 6.27?

Thanks for the heads-up.

Is there a specific version from which this malware is able to infect a mikrotik?
How about RouterOS 5.22 for example or 6.27?

The vulnerability in question was fixed in March 2017:

Current release chain:
What's new in 6.38.5 (2017-Mar-09 11:32):
!) www - fixed http server vulnerability;

And also Bugfix release chain:
What's new in 6.37.5 (2017-Mar-09 11:54):
!) www - fixed http server vulnerability;

Hi Normis,

Found this IT News Article today saying Mikrotik devices are in the list for being at risk to being Hacked. What’s your take on this article??
https://www.itnews.com.au/news/hackers- ... ces-491582

Hi Normis,

Found this IT News Article today saying Mikrotik devices are in the list for being at risk to being Hacked. What’s your take on this article??
https://www.itnews.com.au/news/hackers- ... ces-491582

please read the first post in this thread.

Hopefully my comment won't come through as rude, but to me it seems a bit irresponsible (or at least over-confident) to say "we are highly certain" without having an actual sample of the malware to analyze and confirm that it was exploiting the old vulnerability and not some new one you might not yet be aware of.

Also, with security threats constantly on the rise, it would be nice if there was a dedicated Security sub-forum or some kind of channel / RSS / mailing list which would discuss only security and which we could subscribe to be notified of things like this.

Hopefully my comment won't come through as rude, but to me it seems a bit irresponsible (or at least over-confident) to say "we are highly certain" without having an actual sample of the malware to analyze and confirm that it was exploiting the old vulnerability and not some new one you might not yet be aware of.

Also, with security threats constantly on the rise, it would be nice if there was a dedicated Security sub-forum or some kind of channel / RSS / mailing list which would discuss only security and which we could subscribe to be notified of things like this.

We do have in-depth analysis materials from the Cisco Talos team. They also said they think it is using the same vulnerability that was pubished/known. We also have conducted a thorough code review after the previous vulnerability.

Hopefully my comment won't come through as rude, but to me it seems a bit irresponsible (or at least over-confident) to say "we are highly certain" without having an actual sample of the malware to analyze and confirm that it was exploiting the old vulnerability and not some new one you might not yet be aware of.

Also, with security threats constantly on the rise, it would be nice if there was a dedicated Security sub-forum or some kind of channel / RSS / mailing list which would discuss only security and which we could subscribe to be notified of things like this.

We do have in-depth analysis materials from the Cisco Talos team. They also said they think it is using the same vulnerability that was pubished/known. We also have conducted a thorough code review after the previous vulnerability.

Thanks for the quick response, that is good to know and quite reassuring.

UPDATE:
FBI has seized and sinkholed toknowall.com domain, here is a copy of an affidavit (PDF).

Thanks for the prompt response Normis.

I assume people that were using the quickset dynamic dns vpn and appropriate firewall rules + updated fw would have been invunerable to these attacks ?

Thanks for the prompt response Normis.

I assume people that were using the quickset dynamic dns vpn and appropriate firewall rules + updated fw would have been invunerable to these attacks ?

Any RouterOS version with firewall on the www port from untrusted networks was always safe. The original vunlerability that was fixed in march 2017 was only affecting you, if the www port 80 (webfig) was open to untrusted networks.

Normis, do not citate the previous post.

As always, great job guys.

This is great news, but why have I had to dig this info out from the forum? Why isn't this statement on the Mikrotik home page, somewhere in the news section?

How do you know for sure it was the www exploit that was used instead of for example the more recent winbox exploit?

Hi, after the the linked news/thread back in March (viewtopic.php?f=21&t=132499) I checked patch levels - or at least thought I had.

On rechecking with the latest set of news today, it became clear to me that I've been applying upgrades incorrectly for a long time - I have only been upgrading the RouterOS packages (bang up to date now, and never far behind), not the Routerboard firmware, which was really old (3.x).

1/ Would this partial upgrade have potentially left me open to this attack? I'm hoping not, and that the firmware is basically just a bootloader.

2/ Particularly if the answer to the above is 'yes', it would be great to have reassurance that upgrading the firmware (which I have now done) as well as the packages would definitely clear the malware. I know Mikrotik has said 'yes' to this before. However, it would be good to have confirmation that - as far as Mikrotik is aware - the malware has not evolved the ability to protect itself against removal, given that we appear to be talking about a state actor that has had since March to develop this defence.

3/ (Unrelated to this thread, really) What level of general exposure would I have had from not updating firmware over a long period of time?

I have had a pretty restrictive set of firewall rules applied - there should be no access from the Internet for anything except L2TP VPN connections. Hopefully that would have mitigated the attack on its own. But it would be great to have an answer to 1/ that would apply even if I had made a mistake in those firewall rules, as it appears I'm incapable of applying an update

Cheers,

Martin

Exploit was in RouterOS, so if you upgraded only RouterOS and left old bootloader you are safe.

Thanks mrz for the fast reply.

Thanks for the update and the reminder (link) to the good security practices page!

BartosP are you working for juniper ;-P
CISCO has their own issues, they are not virginal.
https://www.bankinfosecurity.com/200000 ... ed-a-10788
https://www.scmagazine.com/cisco-patche ... le/740572/
https://www.fliegerfaust.com/cyber-atta ... 49185.html

BartosP are you working for juniper ;-P

Nokia-Alcatel-Lucent has strong presence in Poland with numerous competence centers, Juniper perhaps doesn't

Anyway, it's great to see prompt statement and clarification from Mikrotik on this threat.
I wonder if Mikrotik offers some mailing list for customers to receive alerts on security issues, detected vulnerabilities and remedies/corrections.

BartosP are you working for juniper ;-P

Nokia-Alcatel-Lucent has strong presence in Poland with numerous competence centers, Juniper perhaps doesn't

You mean Roland or PPoland They are on the slippery slope of being pwned by he who shall not be named!! No happy face! - makes me sad.

Can somebody please tell me what this log information is (in dark red below containing warning denied winbox/dude connect from?
** Is this log indicating remote IP addresses trying to get into my CHR via a potential vulnerability which has been discussed many times here ? **

This is from my public btest server. This btest server is the public 207.32.194.24 btest server that is always in use by other Mikrotik admins.
And note - I have the following /ip/service in my configuration:
/ip service
set telnet address=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,(((My-IP-Networks))) disabled=yes
set ftp address=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,(((My-IP-Networks)))
set www address=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,(((My-IP-Networks)))
set ssh address=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,(((My-IP-Networks))) disabled=yes
set www-ssl address=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,(((My-IP-Networks)))
set api address=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,(((My-IP-Networks)))
set winbox address=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,(((My-IP-Networks)))
set api-ssl address=192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,(((My-IP-Networks)))


11:00:33 warning denied winbox/dude connect from 213.57.88.215
11:00:39 warning denied winbox/dude connect from 168.194.108.144
11:00:47 warning denied winbox/dude connect from 94.230.25.2
11:00:51 warning denied winbox/dude connect from 213.177.66.226
11:00:52 warning denied winbox/dude connect from 43.229.63.228
11:00:53 warning denied winbox/dude connect from 198.233.88.218
11:01:00 warning denied winbox/dude connect from 191.6.164.82
11:01:01 warning denied winbox/dude connect from 191.6.164.154
11:01:03 warning denied winbox/dude connect from 213.57.88.215
11:01:05 warning denied winbox/dude connect from 94.230.25.2
11:01:16 warning denied winbox/dude connect from 119.18.39.159
11:01:17 warning denied winbox/dude connect from 94.230.25.2
11:01:21 warning denied winbox/dude connect from 213.177.66.226
11:01:27 warning denied winbox/dude connect from 94.142.173.34
11:01:33 warning denied winbox/dude connect from 213.57.88.215
11:01:48 warning denied winbox/dude connect from 94.230.25.2
11:01:57 warning denied winbox/dude connect from 213.57.88.215
11:01:58 warning denied winbox/dude connect from 168.194.108.144
11:02:01 warning denied winbox/dude connect from 191.6.164.82
11:02:01 warning denied winbox/dude connect from 191.6.164.154
11:02:03 warning denied winbox/dude connect from 213.57.88.215
11:02:08 warning denied winbox/dude connect from 198.233.88.218
11:02:13 warning denied winbox/dude connect from 119.18.39.159
11:02:17 warning denied winbox/dude connect from 94.230.25.2
11:02:21 warning denied winbox/dude connect from 213.177.66.226
11:02:22 warning denied winbox/dude connect from 43.229.63.228
11:02:33 warning denied winbox/dude connect from 213.57.88.215
11:02:44 warning denied winbox/dude connect from 94.142.173.34
11:02:46 warning denied winbox/dude connect from 119.18.39.159
11:02:51 warning denied winbox/dude connect from 213.177.66.226
11:03:01 warning denied winbox/dude connect from 191.6.164.82
11:03:02 warning denied winbox/dude connect from 191.6.164.154
11:03:03 warning denied winbox/dude connect from 94.230.25.2
11:03:03 warning denied winbox/dude connect from 213.57.88.215
11:03:17 warning denied winbox/dude connect from 119.18.39.159
11:03:21 warning denied winbox/dude connect from 213.57.88.215
11:03:24 warning denied winbox/dude connect from 94.230.25.2
11:03:24 warning denied winbox/dude connect from 168.194.108.144



Or - is this a log from my btest fw rules which auto-blocks lengthy btest connections then later auto-removes them. I do see some of the above IP address in my fw Connections list (which are auto added & auto removed an hour later).


North Idaho Tom Jones

Good evening, I have a hAP ac lite 6.38.4 or 6.38.5 router I do not remember exactly, Firware 3.27, now updated to the latest version (6.42.2, Firware 6.42.2)
The question in the next I was phoned by the cyberpolicy and said that my router is infected with a virus, that I need to reset my device and set it up which I do not really want to do.
Will I have enough passwords and firmware updates?

Bartoz, email me as that is a separate discussion.................

The question in the next I was phoned by the cyberpolicy and said that my router is infected with a virus, that I need to reset my device and set it up which I do not really want to do.
Will I have enough passwords and firmware updates?

That´s a fraud/fake call, google for that one that wants you to pay him.

Can somebody please tell me what this log information is (in dark red below containing warning denied winbox/dude connect from?
** Is this log indicating remote IP addresses trying to get into my CHR via a potential vulnerability which has been discussed many times here ? **

Or - is this a log from my btest fw rules which auto-blocks lengthy btest connections then later auto-removes them. I do see some of the above IP address in my fw Connections list (which are auto added & auto removed an hour later).
North Idaho Tom Jones

.
In Dude you can add your server to a map and this makes it very easy to choose when you do a bandwidth test. When on a Dude map I think it then probes your server, but not with malicious intent. So you'll see bandwidth tests and attempted winbox/dude connections from the same host.

Can somebody please tell me what this log information is (in dark red below containing warning denied winbox/dude connect from?
** Is this log indicating remote IP addresses trying to get into my CHR via a potential vulnerability which has been discussed many times here ? **

This is from my public btest server. This btest server is the public 207.32.194.24 btest server that is always in use by other Mikrotik admins.
. . .

North Idaho Tom Jones

Tom, let me apologize. I defined your btest server as a host in my local DNS, and gave it a box in my dude configuration, so I could more easily run infrequent tests when needed without having to remember all your IP information. Apparently, this causes grief in your log, because my IP is one of the ones you listed. Also apparently, a whole lot of other MikroTik admins have done the same thing I did, and they are generating all the other IP addresses. In order to run MikroTik speed tests, I had to tell the Dude that you were a MikroTik device, and it looks like that causes it to bother you with Dude queries.

The question in the next I was phoned by the cyberpolicy and said that my router is infected with a virus, that I need to reset my device and set it up which I do not really want to do.
Will I have enough passwords and firmware updates?

That´s a fraud/fake call, google for that one that wants you to pay him.

The fact is that it was the police and they did not demand money from me, the provider gave them to them because the IP address is reserved for the director

The question in the next I was phoned by the cyberpolicy and said that my router is infected with a virus, that I need to reset my device and set it up which I do not really want to do.
Will I have enough passwords and firmware updates?

That´s a fraud/fake call, google for that one that wants you to pay him.

The fact is that it was the police and they did not demand money from me, the provider gave them to them because the IP address is reserved for the director

Your writing is difficult to understand. Do not give property or access to property to anyone, even the police. They have to have a legal warrant from your country's court system and that would have been sent to company officers, so it would be company officer telling you to do anything.

Direct all formal communications with third parties to management and Directors responsible in your company. Third parties have no business telling employees to do anything.

Factory reset your router using the reset button, then upgrade to the latest firmware. Done. When security is an issue, this is always the correct procedure on any networking device. The only thing that changes is the timing (some may be expert enough to do forensic analysis first).

I read his post differently. It seems some local cyber crime agency called him and told him that there is suspicious activity coming from his router. They suggested him to upgrade his router.

Well ...

1. Upgrade or reinstall
2. Protect it properly, as you should have done a long time ago: https://wiki.mikrotik.com/wiki/Manual:S ... our_Router
3. Make sure that the virus is not actually in your LAN, for outside observer this might look like coming from the router, but may be in a Windows computer inside your network

Can somebody please tell me what this log information is (in dark red below containing warning denied winbox/dude connect from?
** Is this log indicating remote IP addresses trying to get into my CHR via a potential vulnerability which has been discussed many times here ? **

This is from my public btest server. This btest server is the public 207.32.194.24 btest server that is always in use by other Mikrotik admins.
. . .

North Idaho Tom Jones

Tom, let me apologize. I defined your btest server as a host in my local DNS, and gave it a box in my dude configuration, so I could more easily run infrequent tests when needed without having to remember all your IP information. Apparently, this causes grief in your log, because my IP is one of the ones you listed. Also apparently, a whole lot of other MikroTik admins have done the same thing I did, and they are generating all the other IP addresses. In order to run MikroTik speed tests, I had to tell the Dude that you were a MikroTik device, and it looks like that causes it to bother you with Dude queries.

If it's not an attack , then I am OK with it.
I don't run Dude and I did not know if this was something I should be taking action on.
Thanks for your reply
For me - a good thing is , that if somebody was able to gain control of this 207.32.194.24 btest server , that this server is 100 percent outside of my business ISP/WISP networks.
North Idaho Tom Jones

As the hack could have been sniffing traffic, our other systems may be at risk. So we don't have to audit all of our other systems now, how can we tell whether our particular device was compromised? This is very important. This could be extremely costly for our organization.

Just added the Talos IPs to prevent further spread. Pretty scary how it infiltrates a busy box based OS.

Thank you Mikrotik for patching this so quickly. In addition I added the following IPs to my Drop DDOS list. This is not a DDOS but any suspicious traffic I get I place it on this filter.

So modify how you like but this is the list of known IPs that needed to be blocked to prevent the stage 2 of this VPNfilter attack.
Hope this helps out.

Sincerely,
DesertAdmin

Technical details of the worm here : https://blog.talosintelligence.com/2018 ... ilter.html

Technical details of the worm here : https://blog.talosintelligence.com/2018 ... ilter.html

Funny how it says that it is hard to defend against it because it is hard to upgrade router firmware on the devices.
I am quite happy with how extremely easy it is to upgrade RouterOS on a MikroTik device.

According to what I have read about all this, it seems that all the recent attacks rely on the "webfig" vulnerability in the <6.38.5 versions of RouterOS.
But I guess Talos isn't going to promote the MikroTik brand by saying that upgrading their devices is super easy to do.

The amount of "Cisco devices are safe thanks to X and..." at the end of the article makes me feel a little confused though.
Why do they need all those fancy sounding features? Just freaking setup a reasonable firewall/ACL and protect your devices like everyone else.

Technical details of the worm here : https://blog.talosintelligence.com/2018 ... ilter.html

Nice article but ...

" Mikrotik RouterOS Versions for Cloud Core Routers:
1016
1036
1072
"
Dosn't mean a thing. They are mention router hardware version, not RouterOS versions which are important in this case.

Please read this article:
http://linkcom.lviv.ua/%D1%83%D0%B2%D0%B0%D0%B3%D0%B0/
https://www.facenews.ua/news/2018/407644/

They are stating that all versions prior 6.42.1 are vulnerable.

Can we confirm the RouterOS versions please?

We have 5.26 on hundreds of 750GL's. Is it a firmware issue or an RouterOS issue? It does not seem clear from this thread.

Also, what about GR2 and GR3/Hex? What versions are invulnerable?

Thanks,

Jerry

I have never used webfig for my routers. Winbox only and I only allow specific IP's that access. I should be fine yeah? Most of my routers are currently at 6.41.

As stated before. All RouterOS devices were affected under following conditions:

1) Webfig was open on untrusted networks (default firewall protects you, so this applies if you manually configured the firewall or removed the default);
2) You had an older RouterOS version, before these releases:

Current release chain:
What's new in 6.38.5 (2017-Mar-09 11:32):
!) www - fixed http server vulnerability;
And also Bugfix release chain:
What's new in 6.37.5 (2017-Mar-09 11:54):
!) www - fixed http server vulnerability;

What to do:

1) Upgrade RouterOS
2) Change your password
3) Configure firewall and other security measures according to this guide: https://wiki.mikrotik.com/wiki/Manual:S ... our_Router

NEVER LEAVE YOUR DEVICE OPEN TO THE INTERNET, WITHOUT SPECIFIC FIREWALL ACCESS RULES

Please read this article:
http://linkcom.lviv.ua/%D1%83%D0%B2%D0%B0%D0%B3%D0%B0/
https://www.facenews.ua/news/2018/407644/

They are stating that all versions prior 6.42.1 are vulnerable.

Thats not correct.

Thanks for the prompt response Normis.

I assume people that were using the quickset dynamic dns vpn and appropriate firewall rules + updated fw would have been invunerable to these attacks ?

Any RouterOS version with firewall on the www port from untrusted networks was always safe. The original vunlerability that was fixed in march 2017 was only affecting you, if the www port 80 (webfig) was open to untrusted networks.

Firewall will as allways disable fastpath in your system. Setting source ip's allowed on the service is more direct lo level approach witch does not disable fastpath.

Hi Normis,

I still do not have a reply regarding 5.26 on R750GL, can you comment?

Best regards.

Firewall will as allways disable fastpath in your system. Setting source ip's allowed on the service is more direct lo level approach witch does not disable fastpath.

Unfortunately, the DNS server does not allow restrictions using ip / services.

What's faster:
- no fastpath and IP firewall rule for blocking DNS;
or
- bridge interface, ipv4 fastpath and bridge filter rule for blocking access?

Hi Normis,

I still do not have a reply regarding 5.26 on R750GL, can you comment?

Best regards.

I did reply that your version is below the one with the fix. If you have an exposed webfig interface to untrusted network, UPGRADE IMMEDIATELY

Good afternoon!
A few thoughts about this problem.
We also suffered an attack, lost more than 50 routers, and many had a firmware version of 6.42.2.
Access to the router is preserved, but the user admin has read-only privileges. In this case, a new root user appears in the system.
Analysis of the situation showed that it is not possible to restore the router through a netinstall, because the protected-routerboot option is enabled. To flash the equipment, you need to see the time set in the field of the reformat hold button, then we fix the reset button for this period of time and supply power to the router. Through the terminal (console cable), we confirm the formatting of the flash. Further through netinstall we restore the firmware. We go to winbox and restore from backup.

You describe a different attack vector. We have seen this before. It was a brute-force password guess attack to the FTP (If I remember correctly). This is not a vulnerability. Simply limit access to the device services from unknown networks.

If you have read only access with Winbox, you can see the "reformat hold time" setting, then you can wipe the device and reconfigure it. Follow manual about protected RouterBOARD on how to use the button to wipe all config: https://wiki.mikrotik.com/wiki/Manual:R ... bootloader