MikroTik Winbox: the flaw that gave away router passwords

On April 23, 2018, the router maker MikroTik fixed a flaw in RouterOS, the operating system of its routers. Through Winbox, the service for managing a router remotely, anyone on the internet could download the router’s user database without logging in. It held the names and passwords of the administrators. Four months after the fix, the Chinese security lab Netlab 360 still counted about 370,000 vulnerable MikroTik devices. By then, attackers had taken over more than 200,000 MikroTik devices to hide their own traffic, to spy on owners and to mine cryptocurrency.

How it worked

Winbox is a small Windows program that administrators use to configure MikroTik routers. It talks to a matching service on the router through network port 8291. A port is a numbered entry point through which a device offers a service. MikroTik stresses that the fault lay in this service in RouterOS itself, not in the Windows program.

The service did not check the file paths in incoming requests properly. A crafted path could step out of the folder the service was meant to use, a mistake known as path traversal. An attacker could ask for any file without logging in, including the user database. The passwords in it could be decoded. MikroTik promised to harden the database so that “deciphering will no longer be possible in the same manner.”

With the password, an attacker could log in like a normal administrator and change any setting. MikroTik’s advisory describes one possible trace: a failed login in the log, followed by a successful one from an unknown address. Beyond that, there was “no sure way” to tell whether a router had been attacked.

In October 2018, the security firm Tenable showed that the flaw was worse than thought. The same kind of request could also write files anywhere on the router. Tenable used this to create a file that switches on a root shell, a command line with full control over the system beneath RouterOS. According to Tenable, an attacker without a password could reach it.

Reach and damage

The best count comes from Netlab 360. On August 23 and 24, 2018, the lab scanned the internet. More than 5 million devices had port 8291 open, and 1.2 million of them were MikroTik devices. Of those, 370,000, or 30.83 %, were still vulnerable.

Attackers had found many of them first. By internet address, Netlab counted 239,000 devices on which attackers had switched on a SOCKS4 proxy. Through this relay, they could send their own traffic so that it seemed to come from the router. On 7,500 routers, the attackers had turned on the built-in traffic capture. They sent copies of the owners’ traffic to their own servers. They were most interested in the ports used for email and file transfers. The largest numbers of these spied-on routers were in Russia (1,628), Iran (637) and Brazil (615).

Others wanted money. On July 31, 2018, the security firm Trustwave noticed a sudden surge of Coinhive in Brazil. Coinhive is a script that uses the computers of website visitors to mine a cryptocurrency. The pages came from MikroTik routers. The attackers had used the router’s web proxy, a function that relays web requests, to serve error pages with the script. Shodan, a search engine for devices on the internet, listed more than 70,000 such devices in Brazil. All had the same Coinhive key, so they all mined for one account. A similar search engine, Censys, found more than 170,000 MikroTik devices with that key.

Many routers stayed in attackers’ hands for years. In September 2021, Qrator Labs and the Russian internet company Yandex described a new botnet called Mēris. Qrator Labs is a firm that defends websites against DDoS attacks. A botnet is a network of hijacked devices. In a DDoS attack, they flood a service with requests until it fails. On September 5, 2021, Mēris hit Yandex with 21.8 million requests per second. According to the researchers, this was the largest such attack in internet history up to then. The devices seemed to come from a single manufacturer, MikroTik. The botnet’s internals pointed to 250,000 infected devices. MikroTik stated that there was no new vulnerability. As far as it had seen, “these attacks use the same routers that were compromised in 2018.”

In March 2022, Microsoft reported that the criminals behind the TrickBot malware used hacked MikroTik routers to hide their command servers. One way in was this flaw, on routers with old versions. Cisco Talos found the malware VPNFilter on hundreds of thousands of network devices in 2018. It also heavily targeted MikroTik devices, especially in Ukraine. Talos named this flaw as one possible way in, but had no definitive proof.

No source puts a figure on the damage. What the eavesdroppers collected, and what the attacks from hijacked routers cost their victims, is unknown.

The fix and the response

MikroTik writes that it discovered and fixed the flaw on April 23, 2018. It released RouterOS 6.42.1 for the current branch, 6.40.8 for the bugfix branch and 6.43rc4 for test versions. All versions from 6.29 to 6.42 were affected. According to press reports, users of a Czech technology forum had noticed break-ins shortly before. By the same accounts, MikroTik needed less than a day from the users’ reports to the fix. The flaw’s public ID, CVE-2018-14847, was only published on August 2, 2018.

The update closed the hole but did not undo what attackers had already taken. MikroTik told owners to change their passwords after the update and to block the Winbox port from the internet. It also told them to check the configuration for settings they did not recognize, such as a SOCKS proxy or unknown scripts. In August 2018, a botnet was attacking routers through the flaw. MikroTik then pointed out that the fix had been out since April. In 2021 it repeated: “If somebody got your password in 2018, just an upgrade will not help.”

The National Vulnerability Database rates the flaw 9.1 out of 10 on CVSS 3.1, “critical”. An attacker needs no password and can read and change data, but the flaw itself does not shut down the router. On December 1, 2021, the US cyber agency CISA added it to its catalog of vulnerabilities known to be exploited. US federal agencies had to fix it by June 1, 2022. The sources document no emergency directive and no highest national warning level.