Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




26197 posts

Uber Geek
+1 received by user: 5796

Moderator
Trusted
Biddle Corp
Lifetime subscriber

Topic # 232107 29-Mar-2018 21:09
One person supports this post
Send private message quote this post

If anybody on here runs any Mikrotik hardware it's worth reminding you to keep it up to date and secured.

 

There is a major exploit in the wild today affecting hardware. I've seen compromised devices today and am aware of a number of devices found in NZ on a number of RSP's that have been compromised.

 

Full details are on the Mikrotik website - you should be running 6.38.5 at a *bare* minimum. 6.41.3 may also reduce exposure to this threat.

 

https://forum.mikrotik.com/viewtopic.php?f=21&t=132499

 

If you're running anything below 6.38.5 and had port 80 for Webfig open to the Internet there is a real possibility your router could have already been compromised.

 

 


Create new topic
3343 posts

Uber Geek
+1 received by user: 1112

Subscriber

  Reply # 1985702 29-Mar-2018 21:25
2 people support this post
Send private message quote this post

Its a bit of a worry that sites would be running less than 6.38.5.
And from the email MT sent out said it exploits webfig or winbox. Which I would also question why anyone would just expose those outright to the internet.
I can understand core routers not being upgraded, but they sure as hell shouldn't have config ports open to the world!

441 posts

Ultimate Geek
+1 received by user: 125

Subscriber

  Reply # 1985784 29-Mar-2018 22:54
2 people support this post
Send private message quote this post

Unfortunately there is a strong correlation between "can't configure a firewall" and "doesn't bother patching".

 

Some shodan stats for NZ.

 

958 - SNMP open
648 - Telnet open
189 - Telnet open but mapped to port 2323 (l33t!)
1148 - FTP open

 

I couldn't find an accurate way to measure webfig numbers, but plenty of these boxes had http servers on port 80 or 8080.

 

Here's a report including the versions reported by the FTP daemon.

 

https://www.shodan.io/report/u8fl5g3P


Create new topic



Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Amazon launches the International Shopping Experience in the Amazon Shopping App
Posted 19-Apr-2018 08:38


Spark New Zealand and TVNZ to bring coverage of Rugby World Cup 2019
Posted 16-Apr-2018 06:55


How Google can seize Microsoft Office crown
Posted 14-Apr-2018 11:08


How back office transformation drives IRD efficiency
Posted 12-Apr-2018 21:15


iPod laws in a smartphone world: will we ever get copyright right?
Posted 12-Apr-2018 21:13


Lightbox service using big data and analytics to learn more about customers
Posted 9-Apr-2018 12:11


111 mobile caller location extended to iOS
Posted 6-Apr-2018 13:50


Huawei announces the HUAWEI P20 series
Posted 29-Mar-2018 11:41


Symantec Internet Security Threat Report shows increased endpoint technology risks
Posted 26-Mar-2018 18:29


Spark switches on long-range IoT network across New Zealand
Posted 26-Mar-2018 18:22


Stuff Pix enters streaming video market
Posted 21-Mar-2018 09:18


Windows no longer Microsoft’s main focus
Posted 13-Mar-2018 07:47


Why phone makers are obsessed with cameras
Posted 11-Mar-2018 12:25


New Zealand Adopts International Open Data Charter
Posted 3-Mar-2018 12:48


Shipments tumble as NZ phone upgrades slow
Posted 2-Mar-2018 11:48



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.