What for the hackers Mikrotik and how I hid 100 thousand. RouterOS from the botnet

RouterOS is a very powerful tool in the hands of professionals and responsible professionals. But in the hands of newbies or those who do everything on “this will do,” Mikrotik begins to live his life and turns into a botnet node.

Back in May 2018, I wrote an article with recommendations on how to protect my Mikrotik .

Oddly enough, but there are still thousands of “open” Mikrotik routers on the network and the botnet’s army is growing.
')
In my free time from work and rest, I searched for vulnerable devices throughout the network and made settings in accordance with my recommendations, that is, I added firewall rules that blocked access to the router from outside the local network. In the comments I wrote information about the vulnerability and left the address of the telegram channel @router_os, where I could ask questions of interest (they should have appeared to a normal admin).



From May to today, I “wrenched” more than 100 thousand Mikrotik devices out of the botnet's clutches.

Given that I can not speak at MUM 2018 in Moscow , I decided to publish my report on habr.com

There are many analytics on the network exactly how RouterOS is used by hackers (for example, here ). But my article is based personally on my experience.

Admins and their reaction

All over the world, the admins of routers sooner or later found such easter eggs.




Most quietly closed the hole. Someone was not too lazy to write “thanks”. But there were those who loudly indignant without understanding.


For all the time I wrote no more than 50 people ...

Since the user response was minimal, I came to the conclusion that the overwhelming majority would not even notice that something was wrong on the router. Therefore, I began to refine my script, which, in addition to the firewall rules, will remove the backdoors known to me that the attackers have left.

It is logical that my method does not suit everyone. But I have not thought of another approach to this task yet.

Hackers love RouterOS

In most cases, I got on a device that is already infected by someone. I, unfortunately, did not immediately begin to analyze their contents. This is what I found and what will be a sure sign that your router has been compromised.

Web Proxy and Socks

The most commonplace use of the router is through standard web and socks proxies. If you do not use them, but they are on, then just turn them off.

/ip proxy set enabled=no
/ip socks set enabled=no

But in order to just not turn it off, the hacker adds a script to the scheduler, which the proxy will turn on after a while:


You can find a webproxy/error.html file that proxy slips you, and he in turn calls the miner.

Extra parameters appear here:

/ip proxy access print
/ip socks access print

Script can do anything

In 90% of the leaky Mikrotik there are scripts /system script and for them the schedule of execution /system scheduler .

According to the schedule, the script is downloaded, which is later executed.



Thus, attackers always have the opportunity to “feed” a new script and, for example, conduct a large-scale DDOS attack.



Therefore, check these places carefully. On pure RouterOS these places are empty.

DST-NAT

Much to my surprise, but there are a lot of such devices on which traffic through /ip firewall nat is wrapped.


A good way to hide your real ip.

VPN

As without him. RouterOS can raise various types of vpn, but hackers most often use pptp and L2TP.

Therefore, check the /ppp secret section

Even if this section is empty, smart hackers can log in via Radius.
Check for records /radius print
If you did not configure anything, then it should be empty. Otherwise it is worth clearing:
/radius remove numbers=[/radius find ]
And prohibit the use of Radius
/ppp aaa set use-radius=no use-circuit-id-in-nas-port-id=no
Disable the use of Radius for authorization on the device
/user aaa set use-radius=no

If you do not use vpn, then disable it.
/interface l2tp-server server set enabled=no
/interface pptp-server server set enabled=no
/interface sstp-server server set enabled=no

DNS static

Without the fig, it also did not do. On routers in / ip dns static you can detect this


Everything is very simple: you enter the address of the site that you know into the address bar, and you actually get to the attacker's server.

Delete content

/ip dns static remove numbers=[/ip dns static find]

Cuts admin rights

UPD: There is also a group of routers where the hacker cuts off the rights of the admin and starts his own with full rights (for example, router and cnt), or simply selects the rights and updates the firmware to the latter.





As a solution to this problem: through netinstall make a downgrade to the vulnerable firmware and use the exploit.

Packet sniffer

Colleagues from Kaspersky Lab mentioned the theft of traffic by means of its redirection to an unknown node.

You can turn it off like this:
/tool sniffer stop
/tool sniffer set streaming-enabled=no filter-ip-protocol="" filter-port="" filter-interface="" filter-stream=no


The problem of Mikrotik products

Absolutely secure systems do not exist. And the massive distribution of Mikrotik products also led to a massive study of these devices.
Since the functionality of RouterOS allows you to perform a huge number of tasks, it is interesting for hackers as well.

Due to the fact that the product is developing very dynamically, the rate at which new “holes” appear is also great. Despite this, the company Mikrotik promptly releases patches for their systems.

Output

To date, the only right solution for protecting RouterOS is a correctly configured firewall, which works according to the principle “everything is forbidden that is not explicitly allowed”.
And all because Mikrotik uses the classic Linux firewall, which has been honed over the years by an army of specialists.

If you need access to the device from the global network, use the principle of " port knocking ". The principle of “fail2ban” does not always justify itself, since it still detects the device.

Global solutions

Lamer mode

Since the devices are very cheap, they are bought by users who do not have special knowledge. Mikrotik needs to develop a “lamer” interface, which has the minimum number of settings, like most SOHO routers. And it should be the default. And the advanced mode, the user must turn on consciously. The current “Quick set” is not good enough. Moreover, due to the abundance of buttons, the user may not notice this function.

Bug analyzer

You also need a module that analyzes the current configuration for possible vulnerabilities and notifies the user if he believes that the router may be compromised. This module should load the “knowledge base” that Mikrotik employees fill out on the basis of common errors. And in the case of serious vulnerabilities to include "emergency" mode.
If I could systematize some of the threats, then the developers and even more so ...

FireWall - as a service providers

The market of "smart" devices is developing very rapidly and they are far from well protected. Most of the people who acquire them also do not have special knowledge to protect their gadgets by themselves.

Therefore, it is time for Internet providers to create a commercial service for the protection of such gadgets. Tritely user in your account indicates which ports to open from the Internet.
Also, providers can create a centralized database of existing devices and their normal needs. The user indicates in the PC what devices he uses. In case of non-standard behavior of such a device, notify the user.
I believe that the market is already ripe for such a service.

This service has the following advantages:

1. For provider another item of income
2. Reducing stray traffic
3. We reduce the recruitment of devices in the botnet
4. Popularization of developing services "smart home"
5. Users can no longer bother with their safety.

A little bit about yourself

I will try to answer questions that will surely be asked.

1. I work in positions not related to Mikrotik and networks in general.
2. However, I have a MTCNA certificate.
3. Mikrotik is my hobby. Everything that I do - I just like it. So to say "for fun."
4. Why not get a job on the profile? Those who in our city buys mikrotik pay a salary much. Those who can pay me a decent ZP - buy cisco.
5. In the comments in the firewall, I pointed out my wallets, but since May I have only been given $ 40. They wrote telegrams from different countries, saying that they do not have wmz, but still “thank you”.

PS:

Share your experience how else hackers can use Mikrotik.