<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Seattle-ER1 has been rolled back to a snapshot and is serving OPP
again. If your tunnel is still down, please complain.<br>
<br>
--Bart<br>
<br>
<br>
<div class="moz-cite-prefix">On 3/24/2018 5:28 PM, Tom Hayward
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAFXO5Z1=2GwnN5DLE=qQU7WOhRUSY=+3rTwz_e8R=T_GvYKjHw@mail.gmail.com">
<div dir="ltr">This morning I discovered a bunch of failed login
attempts to HamWAN routers coming from other HamWAN routers.
When checking the list of logged in users, there weren't any.
Apparently something was able to remotely execute code on HamWAN
routers without logging in. I think it may be related to this: <a
href="https://forum.mikrotik.com/viewtopic.php?t=119255"
moz-do-not-send="true">https://forum.mikrotik.com/viewtopic.php?t=119255</a>.
Nigel and I worked to identify the traffic and patch the hole.
We were able to stop it through a combination of firewall rules,
disabling services, and upgrading software.
<div><br>
</div>
<div>One casualty is that upgrading the software on Seattle-ER1
broke the OPP IPsec configuration. We haven't figured out how
to fix this, so OPP is down for now.</div>
<div><br>
</div>
<div>To protect your equipment from this exploit, you can
disable unnecessary services like this:</div>
<div><br>
</div>
<div>
<div><font face="monospace, monospace">/ip service disable
telnet,ftp,www,api,winbox,api-ssl</font></div>
</div>
<div><br>
</div>
<div>Make sure to do this from SSH so that you know it's working
before disabling Winbox!</div>
<div><br>
</div>
<div>This is a reminder of the importance of strict firewall
rules. Nigel is a wise man.</div>
<div><br>
</div>
<div>Tom</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
PSDR mailing list
<a class="moz-txt-link-abbreviated" href="mailto:PSDR@hamwan.org">PSDR@hamwan.org</a>
<a class="moz-txt-link-freetext" href="http://mail.hamwan.net/mailman/listinfo/psdr">http://mail.hamwan.net/mailman/listinfo/psdr</a>
</pre>
</blockquote>
<br>
</body>
</html>