MikroTik Routers Under Siege: Critical Flaw Allows Unauthenticated SSH Hijack

Urgent Security Alert: MikroTik Routers Vulnerable to Unauthenticated SSH Hijack

A severe security vulnerability is currently being exploited in MikroTik routers, allowing attackers to gain full administrative control without any authentication. This critical flaw targets the Secure Shell (SSH) remote-access service on devices exposed to the internet, as highlighted by a recent warning from CERT Polska, with successful attacks confirmed since at least September 2nd.

While the full scope of victims and the identities of the attackers remain undisclosed, the urgency for MikroTik users to act is paramount. The vendor has already released security updates for its RouterOS, which CERT Polska confirms are effective in preventing the observed attacks.

The “MikroTrick” Unveiled: A Gateway to Unfettered Access

The exploit, dubbed “MikroTrick” by CERT Polska, leverages a combination of two undisclosed flaws to bypass authentication mechanisms on internet-accessible SSH services. This grants malicious actors complete administrative privileges, posing a significant threat to network integrity and data security. It’s crucial to note that while home MikroTik devices typically block public access to management ports by default, this protection relies on the default firewall rules remaining intact.

Affected RouterOS Versions and Immediate Patch Guidance

MikroTik has issued patches across various RouterOS channels. Users are strongly advised to update their devices immediately using the official RouterOS downloads. Here’s a summary of the affected ranges and corresponding fixes:

• RouterOS 6 Series:

  • Affected Range: From 6.0.0 below 6.49.21
  • Security Fix: 6.49.21 (RouterOS 6 security release)

• RouterOS 7 Series (Long-Term Channel):

  • Affected Range: From 7.0.0 below 7.23.4
  • Security Fix: 7.23.4 (Use 7.23.5 for regression fix addressing IPv6 DHCP issues while retaining security update)

• RouterOS 7 Series (Stable Channel):

  • Affected Range: From 7.24 below 7.24.2
  • Security Fix: 7.24.2 (Stable channel security release)

• RouterOS 7 Series (Development Channel):

  • Security Fix: 7.25beta3

The status of whether a fix was publicly available before the initial attacks, which would classify this as a zero-day exploit, remains unverified.

Crucial Mitigation Steps Before Updating

For those unable to apply updates immediately, CERT Polska recommends implementing temporary restrictions to minimize exposure:

• Disable Exposed Services: Turn off services like SSH, WWW/WWW-SSL, and bandwidth-test if they are accessible from the internet.
• Restrict Access: Limit access to management networks to trusted sources only.
• Avoid Unpatched Devices: Do not initiate Transport Layer Security (TLS) connections or use RouterOS’s built-in SSH clients from any unpatched device.

These measures are temporary and do not replace the necessity of installing the security updates.

Detecting and Recovering from a Compromise

After updating, or even without an explicit warning, it is vital to check your router for signs of compromise:

• Check “Flagged” Status:

  MikroTik RouterOS flags a device if startup checks detect suspicious configurations. Inspect this status by running /system/device-mode/print and reviewing logs for anomalies.

• Inspect Configuration:

  Look for unknown users, unauthorized scripts, or other unrecognized changes. CERT Polska specifically highlights unexpected highly privileged ‘ops’ accounts and account-creation logs containing ‘ssh:-2@’ as red flags.

If a compromise is suspected, follow these critical recovery steps:

1. Preserve Evidence: Do not clear the “Flagged” status immediately. Isolate the router from the network and preserve its logs and configuration. CERT Polska provides a preservation guide (in Polish) for exporting these files.
2. Factory Reset: Restore the device to factory settings.
3. Rebuild with Trust: Rebuild your configuration using a trusted, verified setup. Avoid restoring a full backup from a potentially compromised device.
4. Change All Secrets: Update all passwords, keys, and other sensitive credentials in use.

The Hacker News has reached out to CERT Polska and MikroTik for further comments on this evolving situation. Stay informed and protect your network by following official security advisories.

For more details, visit our website.

Source: Link