MikroTik Firewall & NAT Bypass Exploitation from WAN to LAN

JACOB BAINES | February 21, 2019

article image
In Making It Rain with MikroTik, I mentioned an undisclosed vulnerability in RouterOS. The vulnerability, which I assigned CVE-2019–3924, allows a remote, unauthenticated attacker to proxy crafted TCP and UDP requests through the router’s Winbox port. Proxied requests can even bypass the router’s firewall to reach LAN hosts. The proxying behavior is neat, but, to me, the most interesting aspect is that attackers on the WAN can deliver exploits to (nominally) firewall protected hosts on the LAN. This blog will walk through that attack. If you want to skip right to the, sort of complicated, proof of concept video then here it is To demonstrate this vulnerability, I need a victim. I don’t have to look far because I have a NUUO NVRMini2 sitting on my desk due to some previous vulnerability work. This NVR is a classic example of a device that should be hidden behind a firewall and probably segmented away from everything else on your network.

Spotlight

iQuate

iQuate provides a digital management platform to allow enterprises to seamlessly automate application dependency mapping and asset discovery to enable digital transformation in cloud and on premise environments without the use of disruptive agents or hardware.

OTHER ARTICLES

New nubia Red Magic 5G teaser shows off interesting "Slow Door Video" capture mode

Article | March 6, 2020

nubia and its CEO Ni Fei, in particular, have really been going the extra mile to hype-up the upcoming Red Magic 5G phone. Earlier teasersfocused on 5G connectivity, 144Hz display refresh rate, raw performance and active cooling, but now attention shifts a bit as we draw ever closer to the phone's March 12 announcement date. Clearly, Ni Fei wants fans to know that beyond a hardcore gaming experience, the Red Magic 5G will also deliver a capable camera. The latest teaser video shows off a cool feature called Slow Door Video, which we are guessing is a rather crude translation. Also crudely translated, the text of the post itself reads.

Read More

A SMART FUTURE: HOW 5G AND SMART DEVICES WILL CHANGE THE WORLD

Article | March 2, 2020

When one thinks of 5G, they think of cellphones and how communication will improve with faster internet. It will do so for sure, but that’s a very limited way of thinking about this great technological feat. What 5G will inexplicably revolutionize is the way we interact with machines and how integrated they become with our lives. Combined with AI, and smart devices we’re looking at a whole new way of life. So, let us look at what it all means for the future. Before we move further, we must look at what 5G is and how it is different from 4G. First off, this new technology comes with OFDM encoding which is part of an air interface design especially modeled to be flexible such that it meets the needs of other tech pieces with different bandwidths as well as scale for future applications. Compared to 4G, it will be able to operate on larger channels and that too, with lower latency. This means more people can work online at the same time easily with low lag times.

Read More

Incumbent vendors cannot ignore the market-disrupting implications of AT&T’s and Swisscom’s outsourced 5G mobile cores

Article | July 1, 2021

At the tail-end of June, both AT&T and Swisscom announced plans to outsource their 5G mobile core networks to cloud service providers. AT&T’s announcement was with Microsoft Azure. Swisscom’s was with AWS. With the AT&T deal, Azure will be acquiring IP and engineering expertise from AT&T that it can resell to other operators. It was reported that Azure will offer jobs to current AT&T employees, as well. This move suggests Microsoft understands how critical it will be to retain talent that has deep networking knowledge. Swisscom’s deal does not appear to include AWS acquiring any Swisscom assets or employees, but the operator did say it will be using AWS for its own IT applications.

Read More

HOW PRIVATE 5G NETWORKS CAN CHANGE THE WORLD

Article | June 9, 2021

In an increasingly digital world where every pillar of information is now online, lightning-fast connectivity, rock-solid reliability, and impenetrable security are transforming into essentials within the network industry. 5G transforms the connected ecosystem and pushes the boundaries of connectivity to lay the foundation of a faster, more secure, and sustainable future.

Read More

Spotlight

iQuate

iQuate provides a digital management platform to allow enterprises to seamlessly automate application dependency mapping and asset discovery to enable digital transformation in cloud and on premise environments without the use of disruptive agents or hardware.

Events