{"id":74131,"date":"2020-03-14T14:42:14","date_gmt":"2020-03-14T11:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik"},"modified":"2020-03-14T14:42:14","modified_gmt":"2020-03-14T11:42:14","slug":"obnovite-routeros-na-vashem-mikrotik","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","title":{"rendered":"Update RouterOS on your MikroTik","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Update
\nOn the evening of March 10, Mail.ru support began receiving complaints from users about the inability to connect to the Mail.ru IMAP\/SMTP servers through mail programs. Some connections were failing, while others displayed a certificate error. This error was caused by the server delivering a self-signed TLS certificate.
\n<\/a><\/noindex>\u00a0
\n\"Update
\nIn two days, over 10 complaints came from users across various networks and devices, making it unlikely that the issue was with just one provider's network. A more detailed analysis revealed that the imap.mail.ru server (as well as other mail servers and services) was being compromised at the DNS level. Further, with active help from our users, we discovered that the root cause was an incorrect record in their router's cache, which also served as a local DNS resolver, with many (but not all) cases involving MikroTik devices, which are very popular in small corporate networks and among small Internet providers.<\/p>\n

What's the problem<\/h2>\n

\nIn September 2019, researchers found <\/a><\/noindex>several vulnerabilities in MikroTik RouterOS (CVE-2019-3976, CVE-2019-3977, CVE-2019-3978, CVE-2019-3979) that allowed for DNS cache poisoning attacks, i.e., the ability to modify DNS records in the router's DNS cache. Notably, CVE-2019-3978 allows an attacker to initiate a request themselves through port 8291 (UDP and TCP) without waiting for anyone from the internal network to request a record from their DNS server. MikroTik fixed the vulnerability in RouterOS versions 6.45.7 (stable) and 6.44.6 (long-term) on October 28, 2019; however, according to research <\/a><\/noindex>most users have not installed the patches at this time.<\/p>\n

It is evident that this issue is currently being actively exploited in real-time.<\/p>\n

Why is this dangerous<\/h2>\n

\nAn attacker can alter the DNS record of any host that a user within the internal network accesses, intercepting traffic to it. If sensitive information is transmitted without encryption (for example, over http:\/\/ without TLS) or if the user agrees to accept a fake certificate, the attacker can capture all data sent through the connection, such as login or password. Unfortunately, experience shows that if a user has the option to accept a fake certificate, they will likely do so.<\/p>\n

Why SMTP and IMAP servers, and what protected users?<\/h2>\n

\nWhy did attackers try to intercept SMTP\/IMAP traffic from mail applications instead of web traffic, even though most users access email via a browser over HTTPS?<\/p>\n

Not all email programs that use SMTP and IMAP\/POP3 protect the user from mistakes, allowing them to send their login and password over an insecure or compromised connection, even though according to the standard RFC 8314<\/a><\/noindex>, adopted in 2018 (and implemented in Mail.ru much earlier), they should protect the user from password interception over any unprotected connection. Additionally, OAuth protocol is still rarely used in email clients (though it is supported by Mail.ru email servers), and without it, login and password are transmitted in each session.<\/p>\n

Browsers may be somewhat better protected against Man-in-the-Middle attacks. On all critical mail.ru domains, in addition to HTTPS, HSTS (HTTP Strict Transport Security) policy is enabled. With HSTS enabled, modern browsers do not give users a simple option to accept a fake certificate, even if the user wants to. Besides HSTS, users were protected by the fact that since 2017, Mail.ru's SMTP, IMAP, and POP3 servers prohibit password transmission over an unprotected connection; all our users used TLS for access via SMTP, POP3, and IMAP, so login and password can only be intercepted if the user agrees to accept a forged certificate.<\/p>\n

For mobile users, we always recommend using the Mail.ru apps to access email, as working with email in them is safer than in browsers or built-in SMTP\/IMAP clients.<\/p>\n

What needs to be done<\/h2>\n

\nIt is necessary to update the MikroTik RouterOS firmware to a secure version. If for some reason this is not possible, it's necessary to filter the traffic by port 8291 (tcp and udp); this will complicate the exploitation of the issue, though it won't eliminate the possibility of passive injection into the DNS cache. Internet service providers should filter this port on their networks to protect corporate users.\u00a0<\/p>\n

All users who accepted the compromised certificate should urgently change their email passwords and those for other services where this certificate was accepted. We will notify users who access their email through vulnerable devices.<\/p>\n

P.S. There is another related vulnerability described in the post. LukaSafonov<\/a><\/noindex> "Backport vulnerability in RouterOS jeopardizes hundreds of thousands of devices<\/a><\/noindex>\".
\n
Source: habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0436\u0430\u043b\u043e\u0431\u044b \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043d\u0430 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a IMAP\/SMTP \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Mail.ru \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0447\u0430\u0441\u0442\u044c \u043a\u043e\u043d\u043d\u0435\u043a\u0442\u043e\u0432 \u043d\u0435 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u043b\u0430, \u0430 \u0447\u0430\u0441\u0442\u044c \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u041e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u00ab\u0441\u0435\u0440\u0432\u0435\u0440\u00bb \u043e\u0442\u0434\u0430\u0435\u0442 \u0441\u0430\u043c\u043e\u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 TLS. \u00a0 \u0417\u0430 \u0434\u0432\u0430 \u0434\u043d\u044f \u043f\u0440\u0438\u0448\u043b\u043e \u0431\u043e\u043b\u0435\u0435 10 \u0436\u0430\u043b\u043e\u0431 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":74132,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-74131","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Update RouterOS on your MikroTik | ProHoster","description":"On the evening of March 10, the Mail.ru support service began.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 RouterOS \u043d\u0430 \u0432\u0430\u0448\u0435\u043c MikroTik | ProHoster","og:description":"\u0412\u0435\u0447\u0435\u0440\u043e\u043c 10 \u043c\u0430\u0440\u0442\u0430 \u0441\u043b\u0443\u0436\u0431\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 Mail.ru \u043d\u0430\u0447\u0430\u043b\u0430.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/obnovite-routeros-na-vashem-mikrotik","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-14T11:42:14+00:00","article:modified_time":"2020-03-14T11:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"74131","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:20:27","updated":"2022-09-30 20:30:09","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/74131","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=74131"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/74131\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/74132"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=74131"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=74131"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=74131"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}