5 ms·
"There's no easy way to determine if a router has been infected. It's not yet clear if running the latest firmware and changing default passwords prevents infec
by degenerate 8y ago
"There's no easy way to determine if a router has been infected. It's not yet clear if running the latest firmware and changing default passwords prevents infections in all cases."
Antivirus provider Symantec issued its own advisory Wednesday that identified the targeted devices as:
Linksys E1200
Linksys E2500
Linksys WRVS4400N
Netgear DGN2200
Netgear R6400
Netgear R7000
Netgear R8000
Netgear WNR1000
Netgear WNR2000
QNAP TS251
QNAP TS439 Pro
TP-Link R600VPN
- jlgaddis 8y agoMikrotik devices were reportedly affected as well, although I haven't seen any specific model identified (they all run pretty much the same software, although various models are based on different CPU architectures).
- TeMPOraL 8y agoI've read three articles about this today (this one included), and they all specified the same Mikrotik models: - Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072
- jlgaddis 8y agoYou're right, I just got down to the bottom of the article and those models are listed there. I don't recall what article I read a day or two ago, but I don't believe it mentioned the specific models.
- dboreham 8y agoAs GP says, MT boxes all run the same software. The latest release (6.42.3) dated May 24 has suspiciously few bugfixes listed in the changelog. Probably worth updating on the basis the vulnerability fix is in there too.
- pilsetnieks 8y agoThe original Cisco article mentions that these aren't all of the vulnerable models, just the ones they've seen. There isn't anything fundamentally different between a 1009 and a 1016.
- sudouser 8y agodamn, enterprise I used to work at uses mikrotik for critical services...
- pilsetnieks 8y agoSo critical that they'd leave the web interface running on public IPs without firewalling? If not then they're probably safe.
- dboreham 8y agoIs it known that the vulnerability is in the web UI? I ask because the CERT report advised to disable/ACL web UI but it didn't (afaik) say that this was the attach vector. They might have just thrown that in as sound general advice.
- frankzinger 8y agoFrom their official forum post[1]: "Your devices are safe if the port 80 is firewalled, or if you have upgraded to v6.38.5 or newer." [1] https://forum.mikrotik.com/viewtopic.php?f=21&t=132499 https://forum.mikrotik.com/viewtopic.php?f=21&t=132499
- MikusR 8y agoUsing a vulnerability fixed last March.
- ehsankia 8y agoWhat about if you were running a custom firmware like Tomato? I'm surprised there's still so little info on this.