12 ms·

Pulling MikroTik into the Limelight Demystifying and Jailbreaking RouterS

aix1 4y ago
Nice work. Pity all the images in the article are broken.
- dgl 4y ago
  and also the GitHub repo with the presentation link is a 404.
  - sliken 4y ago
    Maybe a DRM takedown?
    - bpbp-mango 4y ago
      seems like a url rewrite issue
- __comedian 4y ago
  apologies, website migration and resource issue. Images and links are fixed now
sliken 4y ago
Seems like MikroTik and Ubiquiti haven't been particularly good on documenting how their routers work, what each process does, and how to debug/verify what they are doing. I've been particularly worried about Ubiquiti, since they seem to be ignoring the MIPS based EdgeRouter line. The various consumer NAS vendors have been a nightmare security wise, and it's far from clear that the prosumer routers from Ubiquiti and MikroTik are any better. Should it really require reverse engineering to figure out how a Linux box passes packets? I gave up on Ubiquiti and bought a tiny $120 router ($140 with a nice metal case) that's a NanoPi R6s. Pretty impressive specifications. 8GB ram, 8 cores (4 fast Ax76 and 4 slow A55s) and no fans. Has 2x2.5GBe and 1x1GBe for networking. I've installed a port of OpenWRT called FriendlyElec and Ubuntu 22.04.1 LTS. I didn't bother cross compiling, it's plenty fast for native compiles. I've been impressed so far. It compiles Rust about half as fast as my Quad core Xeon server from years ago, and is SEVEN times faster than a RPi 4 8GB! I have an Apple M1 mini around that manages the same compile in 13 minutes. A nice bonus is neither network or storage is USB attached, unlike the RPi. Burned it in overnight, running all 8 cores flat out, with no problems. Haven't decided what to use, maybe shorewall or just raw nftables/iptables. Similarly there's 4 and 6 port 2.5 Gbe boxes with various N5000 and N6000 celerons at around $200. ServerTheHome has reviewed many of them, they seem to be evolving nicely, better cases, better heat sinks, better 2.5Gbe Intel chips, etc. Run *WRT, pfsense, or whatever else floats your boat. STH even demod running the firewall under proxmox on one of these cheap 4-6 port 2.5GBe widgets. Would be nice to keep your complete config in git or the config management widget of your choice (often Puppet or Ansible). Guess I'm just getting less trusting in my old age.
- Arnavion 4y ago
  Don't know about the Linux distros, but one problem with the FreeBSD versions (pfSense, OPNsense) is the mostly nonexistent WiFi support because there's no driver support for PCIe cards. You end up needing to hook up a COTS Wifi AP, which has all the same problems that a COTS router would've had. But other than that, yeah I don't see any reason to use a COTS router when I can just make one. My current router is my old desktop PC that became redundant when I built a new one, sitting as a bare motherboard on a test bench to take up very little space, running OPNsense.
  - johnklos 4y ago
    How does a common wireless AP have the same issues as a common consumer NAT router? Do APs have to worry about NAT state tables? Are they exposed to the Internet? Do they have to be configured to NAT/forward special edge case devices, like Nintendo / Sony games consoles? Complaining about the lack of wifi drivers is pretty silly if you don't understand the advantages of a simple bridging wireless AP.
    - Arnavion 4y ago
      >Are they exposed to the Internet? They're exposed to WiFi. They have terrible security in baked-in firmware that can't be updated without connecting them to vendor clouds, if at all. FragAttack was just last year. >Complaining about the lack of wifi drivers is pretty silly if you don't understand the advantages of a simple bridging wireless AP. Ah yes, because one can think of three things that APs are not affected by, therefore APs are bullet-proof.
      - johnklos 4y ago
        Cloud-based APs? Seriously? Nobody who actually takes security seriously would use cloud-based APs. Even using cloud services to download firmware updates would be shady as heck. You just made my point for me. If you have to download binary blobs to your hardware, like wifi interfaces, you can have issues. Would you rather have vendor-dependent devices inside your firewall / NAT router, or just connected to the same network as your firewall / NAT router? Nobody said APs are bulletproof, silly. Only people who don't know better would suggest or even imply that having separate APs is somehow worse. You want to keep the less secure stuff over which you have less control out of the important systems.
halfsquatch 4y ago
Slide deck from the con's site: https://cfp.recon.cx/media/2022/submissions/TZUFS8/resources/Pulling_MikroTik_into_the_Limelight_qHAG1WT.pdf https://cfp.recon.cx/media/2022/submissions/TZUFS8/resources... Slide deck from margin.re: https://margin.re/content/files/2022/11/Pulling_MikroTik_into_the_Limelight-RECon-2022.pdf https://margin.re/content/files/2022/11/Pulling_MikroTik_int... Blurb about the presentation at the con's site: https://cfp.recon.cx/media/2022/submissions/TZUFS8/resources/Pulling_MikroTik_into_the_Limelight_qHAG1WT.pdf https://cfp.recon.cx/media/2022/submissions/TZUFS8/resources... Blurb about the presentation at margin.re: https://margin.re/pulling-mikrotik-into-the-limelight-2/ https://margin.re/pulling-mikrotik-into-the-limelight-2/
- tibbydudeza 4y ago
  Thanks.
deleted 4y ago
[deleted]
tapper 4y ago
I never run anything that can't be flashed with OpenWrt!
- xx_ns 4y ago
  A lot of MikroTik devices run OpenWRT just fine. I never really see the point in it - RouterOS is an excellent.. well, router OS.
  - zoobab 4y ago
    I try to avoid proprietary OSes.
  - tapper 4y ago
    Not going to run that locked down crap on my network.
  - squarefoot 4y ago
    No doubt about the quality, I already have some Routerboards around and will be purchasing some of their ceiling APs and a couple switches at the new house soon. All the worries come from the software being closed; I'm not painting Mikrotik evil, it's just that closed software and firmware are the ultimate place in which place spyware, especially where all software is FOSS. Routers and firewalls are the devices seeing every single piece of data on the network, thus is mandatory for them to be trustworthy, a quality the good reputation of their manufacturer can indeed suggest, but not guarantee.
    - ElectricalUnion 4y ago
      > Routers and firewalls are the devices seeing every single piece of data on the network, thus is mandatory for them to be trustworthy If you're transmitting (and trusting) plaintext data around, you have bigger issues that just the trustworthiness of your router.
acd 4y ago
Why do we have to jailbreak thins using opensource software? EU right to repair, should be extended to right to patch, hack, tinker.
- bestham 4y ago
  The EU is actively hindering consumers from getting into the radio of wifi-APs with the Radio Equipment Directive.
  - zoobab 4y ago
    Blame the Germans, those were the ones responsible for the FCC Radio Lockdown. The EU imposed software radio lockdown, there was a public consultation about it where most of the answers from industry and users were negative, but they kept on pushing for it. The same kind of consultation happened in the US, with the same kind of ignorance.
  - avidiax 4y ago
    Same thing with the FCC. We could have cooperative use of the airwaves and true open-source, open-hardware radios, but there's too much money to be made auctioning spectrum and assuring that most of it is is 99.99% unutilized. Would be horrible if people had cheap 5-10W handhelds that use advanced codecs, or could run 5mw of power on any part of the spectrum.
- execveat 4y ago
  AFAIK, for a long they were pretty hostile and there's still this webpage which asks a $45 wire transfer in order to receive a CD with open source components used in the routerOS: https://mikrotik.com/downloadterms.html https://mikrotik.com/downloadterms.html That might have changed now, but I still can't find an official repo. You could look for older versions like this: https://github.com/robimarko/routeros-GPL https://github.com/robimarko/routeros-GPL or try to contact them directly (or sue if you think you have a standing).
  - JustFinishedBSG 4y ago
xx_ns 4y ago
I recently discovered a vulnerability and jailbroke RouterOS 7.4 (beta). As far as I know, this is the latest jailbreak for RouterOS (as of today): https://nns.ee/blog/2022/08/05/routeros-container-rce.html https://nns.ee/blog/2022/08/05/routeros-container-rce.html
- execveat 4y ago
  Awesome work! Also, thanks for pointing out that RouterOS supports Docker now, there's no way this is the only vuln in that implementation.
  - michalhosna 4y ago
    It is a feature with warning everywhere. You'll need physical access to the device to enable docker. I think is still a very nice feature to release even if it's no complete and fully secure yet. > your router is as secure as anything you run in container; > if you run container, there is no security guarantee of any kind; > running a 3rd party container image on your router could open a security hole/attack vector/attack surface; https://help.mikrotik.com/docs/display/ROS/Container#Container-Disclaimer https://help.mikrotik.com/docs/display/ROS/Container#Contain...
    - xx_ns 4y ago
      I think the key difference here is that it enabled root access to the host RouterOS, which is generally not something that RouterOS permits, enables, or allows. It's why the word "jailbreaking" can even be used in a RouterOS context - it's similar to jailbreaking iOS or rooting an Android phone, where the end-user is NOT meant to have root access to the device.
  - bobleeswagger 4y ago
    It started with Synology, I'm not sure I like the world where docker runs on anything.
bulbosaur123 4y ago
Some guy yesterday was trying to crack this on /g/ board with ChatGPT. Search the threads archive and you might find something related to this code.
zoobab 4y ago
Slides are here, their link on the paghe to the PDF did not work https://margin.re/content/files/2022/11/Pulling_MikroTik_into_the_Limelight-RECon-2022.pdf https://margin.re/content/files/2022/11/Pulling_MikroTik_int...
zevlag 4y ago
Here is the archive.org link now that the original link is 404'ing. https://web.archive.org/web/20221208070504/https://margin.re/2022/06/pulling-mikrotik-into-the-limelight/ https://web.archive.org/web/20221208070504/https://margin.re...
- withzombies 4y ago
  It's back

aix1 4y ago

Nice work. Pity all the images in the article are broken.

dgl 4y ago
and also the GitHub repo with the presentation link is a 404.
- sliken 4y ago
  Maybe a DRM takedown?
  - bpbp-mango 4y ago
    seems like a url rewrite issue
__comedian 4y ago
apologies, website migration and resource issue. Images and links are fixed now

Seems like MikroTik and Ubiquiti haven't been particularly good on documenting how their routers work, what each process does, and how to debug/verify what they are doing. I've been particularly worried about Ubiquiti, since they seem to be ignoring the MIPS based EdgeRouter line. The various consumer NAS vendors have been a nightmare security wise, and it's far from clear that the prosumer routers from Ubiquiti and MikroTik are any better. Should it really require reverse engineering to figure out how a Linux box passes packets? I gave up on Ubiquiti and bought a tiny $120 router ($140 with a nice metal case) that's a NanoPi R6s. Pretty impressive specifications. 8GB ram, 8 cores (4 fast Ax76 and 4 slow A55s) and no fans. Has 2x2.5GBe and 1x1GBe for networking. I've installed a port of OpenWRT called FriendlyElec and Ubuntu 22.04.1 LTS. I didn't bother cross compiling, it's plenty fast for native compiles. I've been impressed so far. It compiles Rust about half as fast as my Quad core Xeon server from years ago, and is SEVEN times faster than a RPi 4 8GB! I have an Apple M1 mini around that manages the same compile in 13 minutes. A nice bonus is neither network or storage is USB attached, unlike the RPi. Burned it in overnight, running all 8 cores flat out, with no problems. Haven't decided what to use, maybe shorewall or just raw nftables/iptables. Similarly there's 4 and 6 port 2.5 Gbe boxes with various N5000 and N6000 celerons at around $200. ServerTheHome has reviewed many of them, they seem to be evolving nicely, better cases, better heat sinks, better 2.5Gbe Intel chips, etc. Run *WRT, pfsense, or whatever else floats your boat. STH even demod running the firewall under proxmox on one of these cheap 4-6 port 2.5GBe widgets. Would be nice to keep your complete config in git or the config management widget of your choice (often Puppet or Ansible). Guess I'm just getting less trusting in my old age.

Arnavion 4y ago
Don't know about the Linux distros, but one problem with the FreeBSD versions (pfSense, OPNsense) is the mostly nonexistent WiFi support because there's no driver support for PCIe cards. You end up needing to hook up a COTS Wifi AP, which has all the same problems that a COTS router would've had. But other than that, yeah I don't see any reason to use a COTS router when I can just make one. My current router is my old desktop PC that became redundant when I built a new one, sitting as a bare motherboard on a test bench to take up very little space, running OPNsense.
- johnklos 4y ago
  How does a common wireless AP have the same issues as a common consumer NAT router? Do APs have to worry about NAT state tables? Are they exposed to the Internet? Do they have to be configured to NAT/forward special edge case devices, like Nintendo / Sony games consoles? Complaining about the lack of wifi drivers is pretty silly if you don't understand the advantages of a simple bridging wireless AP.
  - Arnavion 4y ago
    >Are they exposed to the Internet? They're exposed to WiFi. They have terrible security in baked-in firmware that can't be updated without connecting them to vendor clouds, if at all. FragAttack was just last year. >Complaining about the lack of wifi drivers is pretty silly if you don't understand the advantages of a simple bridging wireless AP. Ah yes, because one can think of three things that APs are not affected by, therefore APs are bullet-proof.
    - johnklos 4y ago
      Cloud-based APs? Seriously? Nobody who actually takes security seriously would use cloud-based APs. Even using cloud services to download firmware updates would be shady as heck. You just made my point for me. If you have to download binary blobs to your hardware, like wifi interfaces, you can have issues. Would you rather have vendor-dependent devices inside your firewall / NAT router, or just connected to the same network as your firewall / NAT router? Nobody said APs are bulletproof, silly. Only people who don't know better would suggest or even imply that having separate APs is somehow worse. You want to keep the less secure stuff over which you have less control out of the important systems.

halfsquatch 4y ago

Slide deck from the con's site: https://cfp.recon.cx/media/2022/submissions/TZUFS8/resources/Pulling_MikroTik_into_the_Limelight_qHAG1WT.pdf https://cfp.recon.cx/media/2022/submissions/TZUFS8/resources... Slide deck from margin.re: https://margin.re/content/files/2022/11/Pulling_MikroTik_into_the_Limelight-RECon-2022.pdf https://margin.re/content/files/2022/11/Pulling_MikroTik_int... Blurb about the presentation at the con's site: https://cfp.recon.cx/media/2022/submissions/TZUFS8/resources/Pulling_MikroTik_into_the_Limelight_qHAG1WT.pdf https://cfp.recon.cx/media/2022/submissions/TZUFS8/resources... Blurb about the presentation at margin.re: https://margin.re/pulling-mikrotik-into-the-limelight-2/ https://margin.re/pulling-mikrotik-into-the-limelight-2/

tibbydudeza 4y ago
Thanks.

deleted 4y ago

[deleted]

tapper 4y ago

I never run anything that can't be flashed with OpenWrt!

xx_ns 4y ago
A lot of MikroTik devices run OpenWRT just fine. I never really see the point in it - RouterOS is an excellent.. well, router OS.
- zoobab 4y ago
  I try to avoid proprietary OSes.
- tapper 4y ago
  Not going to run that locked down crap on my network.
- squarefoot 4y ago
  No doubt about the quality, I already have some Routerboards around and will be purchasing some of their ceiling APs and a couple switches at the new house soon. All the worries come from the software being closed; I'm not painting Mikrotik evil, it's just that closed software and firmware are the ultimate place in which place spyware, especially where all software is FOSS. Routers and firewalls are the devices seeing every single piece of data on the network, thus is mandatory for them to be trustworthy, a quality the good reputation of their manufacturer can indeed suggest, but not guarantee.
  - ElectricalUnion 4y ago
    > Routers and firewalls are the devices seeing every single piece of data on the network, thus is mandatory for them to be trustworthy If you're transmitting (and trusting) plaintext data around, you have bigger issues that just the trustworthiness of your router.

acd 4y ago

Why do we have to jailbreak thins using opensource software? EU right to repair, should be extended to right to patch, hack, tinker.

bestham 4y ago
The EU is actively hindering consumers from getting into the radio of wifi-APs with the Radio Equipment Directive.
- zoobab 4y ago
  Blame the Germans, those were the ones responsible for the FCC Radio Lockdown. The EU imposed software radio lockdown, there was a public consultation about it where most of the answers from industry and users were negative, but they kept on pushing for it. The same kind of consultation happened in the US, with the same kind of ignorance.
- avidiax 4y ago
  Same thing with the FCC. We could have cooperative use of the airwaves and true open-source, open-hardware radios, but there's too much money to be made auctioning spectrum and assuring that most of it is is 99.99% unutilized. Would be horrible if people had cheap 5-10W handhelds that use advanced codecs, or could run 5mw of power on any part of the spectrum.
execveat 4y ago
AFAIK, for a long they were pretty hostile and there's still this webpage which asks a $45 wire transfer in order to receive a CD with open source components used in the routerOS: https://mikrotik.com/downloadterms.html https://mikrotik.com/downloadterms.html That might have changed now, but I still can't find an official repo. You could look for older versions like this: https://github.com/robimarko/routeros-GPL https://github.com/robimarko/routeros-GPL or try to contact them directly (or sue if you think you have a standing).
- JustFinishedBSG 4y ago

xx_ns 4y ago

I recently discovered a vulnerability and jailbroke RouterOS 7.4 (beta). As far as I know, this is the latest jailbreak for RouterOS (as of today): https://nns.ee/blog/2022/08/05/routeros-container-rce.html https://nns.ee/blog/2022/08/05/routeros-container-rce.html

execveat 4y ago
Awesome work! Also, thanks for pointing out that RouterOS supports Docker now, there's no way this is the only vuln in that implementation.
- michalhosna 4y ago
  It is a feature with warning everywhere. You'll need physical access to the device to enable docker. I think is still a very nice feature to release even if it's no complete and fully secure yet. > your router is as secure as anything you run in container; > if you run container, there is no security guarantee of any kind; > running a 3rd party container image on your router could open a security hole/attack vector/attack surface; https://help.mikrotik.com/docs/display/ROS/Container#Container-Disclaimer https://help.mikrotik.com/docs/display/ROS/Container#Contain...
  - xx_ns 4y ago
    I think the key difference here is that it enabled root access to the host RouterOS, which is generally not something that RouterOS permits, enables, or allows. It's why the word "jailbreaking" can even be used in a RouterOS context - it's similar to jailbreaking iOS or rooting an Android phone, where the end-user is NOT meant to have root access to the device.
- bobleeswagger 4y ago
  It started with Synology, I'm not sure I like the world where docker runs on anything.

bulbosaur123 4y ago

Some guy yesterday was trying to crack this on /g/ board with ChatGPT. Search the threads archive and you might find something related to this code.

zoobab 4y ago

Slides are here, their link on the paghe to the PDF did not work https://margin.re/content/files/2022/11/Pulling_MikroTik_into_the_Limelight-RECon-2022.pdf https://margin.re/content/files/2022/11/Pulling_MikroTik_int...

zevlag 4y ago

Here is the archive.org link now that the original link is 404'ing. https://web.archive.org/web/20221208070504/https://margin.re/2022/06/pulling-mikrotik-into-the-limelight/ https://web.archive.org/web/20221208070504/https://margin.re...

withzombies 4y ago
It's back