PoC Attack Escalates MikroTik Router Bug to ‘As Bad as It Gets’ | Hacker News Reader

PoC Attack Escalates MikroTik Router Bug to ‘As Bad as It Gets’

threatpost.com

33 pointsccnafr11 comments

> The licupgr binary has an sprintf that an authenticated user can use to trigger a stack buffer overflow.

The printf family is responsible for so many problems. Few people seem to know how to use it safely, or when to use something else.

> only approximately 30 percent of vulnerable modems have been patched, which leaves approximately 200,000 routers...

Welcome to the botnet. Combining the two bugs gives root, and that's a large enough collection of devices to target.

>Few people seem to know how to use it safely, or when to use something else.

I was taught printf should only be used for quick n dirty debugging.

Please just use a decent logging library and debugger... it will up you productivity, you will learn important skills and you will write cleaner code and you will prevent issues like this one.

This isn't as bad as it sounds - it only works if the attacker has access to the management interface. If you're exposing that unfettered to the web at large, imo you deserve what you get.

Domain Reflection is a thing, load a webpage on domain www.example.bad with low DNS TTL, then repoint it to common IPs for management interfaces, make AJAX call. Of course a lot of routers try to filter it but it works in a surprising amount of installs to this day.

Another entry point could be other devices in your network that have been taken over to some extend (or maybe even an app on your phone).

I used Microtik routers for a few years, I felt nerdy and in control and all that. Until one day one of them bricked itself completely while updating itself. I replaced it with a off-the-shelf consumer one and realised immediately that it was a LOT faster than the fancy Microtik. Experience of One of course, but well, I never bought another.

I have no experience with Microtik, but you dont seem to be comparing like generations. A newer router will beat an older one just due to the march of technology.

I had the same experience with Mikrotik routers. Same generation devices. Also suffered from random drops of the network. Very good transmission distance when it worked.

Had several as well. Ended up going back to DDWRT routers with Ubiquiti APs. The interface is much more intuitive and the routers seemed faster. Don't really miss winbox. It took a lot more work with MicroTik/Winbox to do the same with DDWRT. 'The Dude' interface was cool, but just didn't really have time to manage or explore more. DDWRT was so much easier :/

Except that, because of NetInstall, it's almost impossible to brick a Mikrotik. If you still have the bootloader, you aren't bricked.

And further, there are Mikrotiks for nearly any use case, from <100M to 10G. These things have speed ratings for a reason. I run a quadcore ARM unit now, and it's blazing fast, way overpowered for what I use it for. Before that I ran a dual-core PowerPC unit, that easily did 1G (unless you were throwing IPSec at it), for around $100.

tl;dr this is the "proof of concept":

GET /ssl_conn.php?usrname=%s&passwd=%s&softid=%s&level=%d&pay_typ'e=%d&board=%d HTTP/1.0

Attackers will not be able to use that, nor will they care. There are already plenty of routers vulnerable to RCE on the Internet.

Reply on news.ycombinator.com