MikroTrick: attacks on MikroTik routers via internet-exposed SSH

On September 5, Poland's incident response team CERT Polska issued a warning about attacks on MikroTik routers. The attackers exploit the SSH remote-access service, exposed to the internet, to gain full administrative control over a device without passing authentication. Successful attacks have been recorded since at least September 2.

That said, the warning names neither the number of victims nor the identity of the attackers — a point noted by The Hacker News, which examined the document on September 6. CERT dubbed the pair of vulnerabilities MikroTrick, but the public disclosure does not explain which flaws exactly make up the chain or how they combine into a takeover of administrator privileges.

Who is at risk and what to do

MikroTik has released patched versions of RouterOS. The branches considered vulnerable are those prior to 6.49.21, prior to 7.23.4 and prior to 7.24.2; in the development channel the flaw was fixed in 7.25beta3. It is separately noted that the 7.23.5 release in the long-term channel additionally fixes an IPv6 DHCP regression introduced in 7.23.4, while preserving the protection. CERT recommends installing the updates from the official site immediately, and then checking the configuration for unauthorized changes.

Home users are partly saved by the factory settings: by default, MikroTik's firewall rules block public access to the management ports — provided they have not been touched.

Until the update is installed, CERT advises disabling internet-exposed services or restricting access to them to trusted management networks — this applies above all to SSH, the web interface (WWW/WWW-SSL) and bandwidth-test. In addition, from an unpatched device you should not initiate TLS connections or use RouterOS's built-in SSH client.

Signs of a breach and recovery

RouterOS marks a device as Flagged if it finds a suspicious configuration at startup, and disables the corresponding entries. After updating, you should review the logs, run /system/device-mode/print and manually look for unknown users and scripts. The warning signs pointed out by CERT are unexpected accounts with broad privileges and account-creation records containing the string ssh:-2@.

If compromise is suspected, the recommendation is to isolate the router, preserve the logs and configuration (without clearing the flag until the analysis is complete), reset the device to factory settings and rebuild the configuration from scratch from a trusted source — but not to blindly restore a full backup from a potentially infected device. Passwords, keys and other secrets should be changed.

A separate question is whether this was a 0-day. The 7.25beta3 changelog is dated September 2, while the fixes themselves were announced on September 3. These dates are not enough to establish whether a public patch existed before the attacks began, so the vulnerability's status as a “zero-day” remains unconfirmed. The Hacker News reached out to CERT Polska and MikroTik for comment.

Source: The Hacker News