Mikrotik RB3011 Internet Dropping

[NDavid]

Hello,

I have been having issues with internet connections at two different locations since last Friday. Each location is serviced with a cable modem (dynamic IP) and an RB3011 router. I noticed some strange behavior Friday and when I logged in to the routers, I found they had been accessed and firewall rules were changed, new users were added, and scripts were installed. I removed everything I could find and changed the passwords on both. I then reset both to factory reset, updated Router OS to the newest release, and changed the passwords before restoring from an old configuration backup.

Both routers worked briefly, then began dropping connection every 10-20 minutes. I first thought it was a DNS issue, but was unable to ping any IPs, such as Google. I checked the router logs and found nothing. The DHCP lease from the ISP still has hours remaining.

The ISP has checked the modems and said everything is fine on their end. They did make a comment that they could see two devices receiving DHCP addresses from the modem at once point, but I was unable to find anything or confirm this. To recover from whatever is happening, a simple release/renew from the router's DHCP client gets everything back up and running again for a short time.

I don't see anything obvious in the router settings and don't know what I'm missing. I have reset the configurations in both routers and restored to a working backup, but have had no luck. This is really starting to cause major problems... Any ideas?

Thanks!

 

[System Error Message]

Your routers were hacked and its either 1 of the 2 cases. 1) your firewall config had holes or 2) your seller had installed a backdoor .

Upgrade the routerboot or the low level/backup firmwares to a newer one as well. When you update the firmware and go to system , somewhere around there you'll have the option to update the firmware.

I know there have been vulnerabilities before that let malware to access the router but that has been patched and would've been gone through a firmware update and reset.

 

[coxhaus]

Once a router has been hacked I loose faith, especially 2.

 

[NDavid]

I have now updated the Routerboard firmware on both. I didn't realize there was a separate firmware update process besides the RouterOS updates. Until this experience, I was unaware of the vulnerabilities that were discovered in Winbox from April and I had been using an older version of Winbox. I have updated this as now and will be working on improving my firewall rules.

I will see how the day goes and hopefully won't continue to have problems. Thanks for the help.

 

[System Error Message]

Once a router has been hacked I loose faith, especially 2.

some sellers install backdoors into routers into many brands, doesnt matter if its mikrotik, ubiquiti, asus or so on. With mikrotik they'll need to use openwrt to gain access to dev shell in order to install their backdoor (gone if you upgrade the routerboot and firmware). Ubiquiti, asus and other routers all use a linux based OS as well and they can do the same with cisco, it will happen to any router brand. Mikrotik took notice of this and a full upgrade and reset will fix it. Netgear and tp link come with backdoors designed into the router itself rather than installed by seller .

You will find a lot of dishonest people who will install backdoors onto routers they sell people, its a huge problem and not much can be done, simply report the seller to mikrotik and probably the cops.

 

[sfx2000]

Once a router has been hacked I loose faith, especially 2.

Microtik was targeted with a zer0-day hack on the Winbox management software running on Windows - one finds these devices common in areas of conflict, and there's a lot of nation-state effort there to disrupt connectivity.

These things do happen, unfortunately...

 

[sfx2000]

it will happen to any router brand

Exactly - keep firmware up to date - even non-linux platforms...

 

[coxhaus]

If you buy from a Cisco partner your router is not going to be loaded with bad stuff.

I can't believe how many people are running old non-supported routers. I see it all the time. They may be running the latest firmware but the router has not had support in years.

 

[sfx2000]

If you buy from a Cisco partner your router is not going to be loaded with bad stuff.

Are you sure?

https://www.tomshardware.com/news/cisco-backdoor-hardcoded-accounts-software,37480.html

'Nuff said...

 

[coxhaus]

These back doors were not loaded by Cisco partners selling the product. There are security flaws in all devices. Cisco publishes these security flaws using Cisco Security Vulnerability. Cisco Security Vulnerability web pages covers both the PRO IOS and the small business gear. If you want to look up problems this is where you go for Cisco gear. Here is an example of it for an old Cisco RV180 router.
https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20160803-rv180_1.html

Here is the one from sfx2000's post on Tom's hardware
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-xesc

Cisco keeps you updated with the latest security. This is much better than most companies.

 

[sfx2000]

Cisco keeps you updated with the latest security. This is much better than most companies.

@coxhaus - check your Cisco security bulletins - they rained down a shedload of patches, including some of the RV series.

 

[coxhaus]

@coxhaus - check your Cisco security bulletins - they rained down a shedload of patches, including some of the RV series.

I watch them all the time. Our world is full of security holes now days. It is nice that Cisco tracks them. All hardware vendors should. We should not have to be the experts on someone else's hardware.

 

[System Error Message]

I watch them all the time. Our world is full of security holes now days. It is nice that Cisco tracks them. All hardware vendors should. We should not have to be the experts on someone else's hardware.

even mikrotik patches security holes whenever one is found, they too are on it unlike dlink that purposely leave their routers vulnerable until it gets so bad that they patch it up.