During a breach of CTWUG with bruteforcing the following user accounts were compromised on at least one router. Someone logged into these accounts on at least one router. Please consider these accounts compromised. If you use passwords for anything else please change it ASAP. This is not a complete list as these are the ones I found on routers running wms. I extracted this from central logs.
We are in the process of investigating this incident and will feedback once resolved. So please don’t investigate yourself. We will advise the outcome.
It logged into various routers using admin account (also ctwug account).
I can remove these accounts on all routers that have WMS installed. Would need to ensure that we have a backup account (user wms with ssh access and radius).
I can change these accounts on all rotuers that have WMS to a random password (unqiue to that router).
I can remove all accounts where the hacker logged in successfully (only WMS). Only leaving radius / wms user active. The reason is that he probably gained the credentials of any account on a rotuer where he logged in. The wms account is relatively safe as it is ssh key based. I will re-randomise the password for that account anyway.
I would say the best would be to do both 1 and 3. This would still leave non WMS routers as is. Not much I could do about it I think.
To do the above the @NetworkAdmins would need to help me restore access to routers where only radius would then be active. As it would lead to a lot of queries from people as they would lose access to their routers…
Well in theory the hacker has their login on that RB as well. People would need to ask @NetworkAdmins to add an account for them again. It’s a big step hence me asking for comments.
Also I really don’t want to get into the mechanics of this. I don’t want to discuss how it happened. But clearly many logins are on many routers. Most people will not be able to track these down and remove them. So this risk will remain with us for some time.
To remove them manually will be slow and time consuming and. knowing 75% of wuggers, will never be done.
@spin, this is more than likely on an RB where my username doesn’t have a password or where the password is the same as the username. Not likely that my password was bruteforce attacked. Feel free to remove this login from any/all RBs.
Many ways to do this. I’m sure there are ways to improve but also there is a time issue. I was not getting to it all. I’d rather people know especially if they use same paswords for other stuff.
I have seen this threat on the Forum and did change all my passwords on
most of my ospf rb’s aswell as individual rb’s.
Thank you for informing us of this breach
Maybe a bit of a branch-off to this thread. Bit of a warning for those with RB’s facing the Internet, I am seeing an incredible amount of attempts to get into RB’s via Winbox:
From around 08:00 this morning:
On another site (also from 08:00-ish) I did find a bit of humour in it, these are all Zimbabwe-based IP’s:
