Hacker News Reader

Comment by degenerate | Hacker News Reader

"There's no easy way to determine if a router has been infected. It's not yet clear if running the latest firmware and changing default passwords prevents infections in all cases."

Antivirus provider Symantec issued its own advisory Wednesday that identified the targeted devices as:

Linksys E1200

Linksys E2500

Linksys WRVS4400N

Netgear DGN2200

Netgear R6400

Netgear R7000

Netgear R8000

Netgear WNR1000

Netgear WNR2000

QNAP TS251

QNAP TS439 Pro

TP-Link R600VPN

View on HN

What about if you were running a custom firmware like Tomato? I'm surprised there's still so little info on this.

Mikrotik devices were reportedly affected as well, although I haven't seen any specific model identified (they all run pretty much the same software, although various models are based on different CPU architectures).

I've read three articles about this today (this one included), and they all specified the same Mikrotik models:

- Mikrotik RouterOS for Cloud Core Routers: Versions 1016, 1036, and 1072

You're right, I just got down to the bottom of the article and those models are listed there.

I don't recall what article I read a day or two ago, but I don't believe it mentioned the specific models.

As GP says, MT boxes all run the same software. The latest release (6.42.3) dated May 24 has suspiciously few bugfixes listed in the changelog. Probably worth updating on the basis the vulnerability fix is in there too.

The original Cisco article mentions that these aren't all of the vulnerable models, just the ones they've seen. There isn't anything fundamentally different between a 1009 and a 1016.

damn, enterprise I used to work at uses mikrotik for critical services...

So critical that they'd leave the web interface running on public IPs without firewalling? If not then they're probably safe.

Is it known that the vulnerability is in the web UI? I ask because the CERT report advised to disable/ACL web UI but it didn't (afaik) say that this was the attach vector. They might have just thrown that in as sound general advice.

From their official forum post[1]:

"Your devices are safe if the port 80 is firewalled, or if you have upgraded to v6.38.5 or newer."

[1] https://forum.mikrotik.com/viewtopic.php?f=21&t=132499

Using a vulnerability fixed last March.

Reply on news.ycombinator.com