MikroTik Security

MikroTik
Network Security By: Rofiq Fauzi
Jakarta, April 28, 2016
ID-NETWORKERS | WWW.IDN.ID
1

ROFIQ FAUZI
CONSULTANT
CERTIFIED TRAINER
http://www.mikrotik.com/consultants/asia/indonesia
• 2005, Network Engineer at WISP.
• 2007, Network & Wireless Engineer at INDOSAT Central Java Area
• 2008, IT Network & Telco Procurement at INDOSAT HQ
• 2012-Now, MikroTik Consultant & Certified Trainer at ID-
Networkers (PT Integrasi Data Nusantara).
• 2013-Now, Network Manager at WISP Indomedianet, Indonesia
• 2013-Now, Network Consulting Engineer at Connexin Limited, Hull,
UK
http://www.mikrotik.com/training/partners/asia/indonesia
2

ID NETWORKERS
In the Most Prestigious Networking Certification
EXPERT LEVEL TRAINERS & CONSULTANS
OVERVIEW
We are young entrepreneurs, we are only one training
partner & consultant who has expert level trainers in the
most prestigious networking certification, CCIE Guru ,
JNCIE Guru and MTCINE guru, which very limited
number in Indonesia even Asia. Proven that hundred of
our students pass the certification exam every year. We
are the biggest certification factory in Indonesia.
WEBSITE
www.idn.id | www.trainingmikrotik.com
3

SECURITY?
SECURITY GUARD Source image http://akarpadinews.com/
4

INTERNET SECURITY THREATS
o Information gathering
o Sniffing and eavesdropping
o Spoofing
o Session hijacking and man-in-
the-middle attacks 0 SQL
injection
o ARP Poisoning
o Password-based attacks
o Denial of service attack
o Compromised-key attack
o Malware attacks
o Target Footprinting
o Password attacks
o Denial of service attacks
o Arbitrary code execution
o Unauthorized access Privilege
escalation
o Back door Attacks
o Physical security threats
o Data/Input validation
o Authentication andAuthorization
attacks
o Configuration management
o Information disclosure
o Session management issues
o Cryptography attacks
o Parameter manipulation
o Improper error handling and
exception management
Host Threats Application ThreatsNetwork Threats
5

INTERNET CRIME
Cybercrime Gang Tied to 20
Million Stolen Cards
6

INTERNET CRIME REPORT
230,000
240,000
250,000
260,000
270,000
280,000
290,000
300,000
310,000
320,000
2010 2011 2012 2013 2014
Internet Crime Compliant
• Victims are encouraged by law
enforcement to file a complaint
online at www.ic3.gov
• Total Complaints Received in 2014
is amount 269,422
• Complaints Reporting a Loss is
123,684
• Total Losses Reported was
$800,492,073
Overall Statistic
The following is the crime report data from IC3; the Internet Crime ComplaintCenter (IC3) is a partnership among the
Federal Bureau of Investigation (FBI)
$800M
LOSS
YEAR
REPORT
7

HACKING EFFECTS IN BUSINESS
8

HACKING EFFECTS IN BUSINESS
Every business must provide strong security for its customers. Attackers use hacking techniques to steal, pilfer, and
redistribute intellectual property ofbusinesses and in turn to make financial gain
Reputation
Business Loss
Revenue Loss
Compromise Information
According to the Symantec 2012 State of Information survey,
information costs businesses worldwide $1.1 trillion annually.
Theft of customers' personal information may risk
the business's reputation and invite lawsuits
Hacking can be used to steal, pilfer, and redistribute
intellectual property leading to business loss
Botnets can be usedto launchvarious types of DoS andother web-based attacks,
which may lead to business down-time and significant loss of revenues
Attackers may steal corporate secrets and sell them to competitors,
compromise critical financial I information, and leak informationto rivals
9

KNOW THE ATTACK
If you know both of yourself
and your enemies, you will not
be lose in a hundred battles.
If you do not know yourself
nor your enemies, you will be
lose in every single battle.
(The Art of War - Sun Tzu).
10

WHO IS HACKER?
Multitude of Reasons
• Intelligent individuals with excellent computer
skills
• Hacking is a hobby to see how many
computers or networks they can compromise
• Their intention can either be to gain knowledge
or to poke around doing illegal things
• Some hack with malicious intent, such as
stealing business data, credit card information,
social security numbers, email passwords, etc.
A hacker is a person who illegally breaks into a system or network withoutany authorization to destroy, steal sensitive
data, or perform malicious attacks.
11

HACKING PHASE
Reconnaissance
Scanning
Gaining Access
Maintaining Access
Clearing Tracks
12

GATHER INFORMATION
gathers as much information as possible about the target prior to launching the attack.
SOCIAL ENGINEERING ATTACK
because there is no patch for human stupidity.
13

GOOGLE SCAM
How to bypass the two-factor google authentication systems using fake SMS
14

PORT SCANNING
Port scanners can be used to detect listening ports to find information about the nature of services
running on the target machine
15

PORTS
The primary defense technique in this regard is to shut down services thatare not required.Appropriate filtering may also
be adopted as a defense mechanism.However,attackers can still use tools to determine the rules implemented for filtering.
• Port is an specific application or specific process on the computer /
host running that running service.
• In a host, total number of port is 65535, with numbering classification
as follows:
1. From 0 to 1023 (well-known ports),
2. From 1024 to 49151 (registered port),
3. From 49152 to 65535 (unregistered / dynamic, private or
ephemeral ports)
16

SERVICE PORT
2121 2222 5353 8080
17

GAINING ACCESS
Software applications
come with large number
of functionalities and
features
Most administrators don't
have the necessary skills
to maintain or fix issues,
which may lead to
configuration errors
some scripts have
various vulnerabilities,
which can lead to shrink
wrap code attacks
Attackers search for OS
vulnerabilities and exploit
them to gain access to a
network system
OPERATING SYSTEM APPLICATION LEVEL MISCONFIGURATION SRINK WRAP CODE
18

INTRUSION DETECTION SYSTEM
• Intrusion: activities that can detected as
anomalies, incorrect, inappropriate occurring on
the network or host, usually done by hacker
• IDS (Intrusion Detecting System): system that
can detect intrusion, it is like the alarm system
19

BACKGROUND
• Admin can not always monitor the servers directly or
always login in to check the servers for intruder.
• We need firewall not just to blocking intruder, but also
log and report them to admin immediately.
• In wide network with many MikroTik router, we don’t
know which is under attack.
• We can report the to the IP owner of the intruders as
abuse.
20

HOW IDS WORK
• Passive System
ü sensor detects a potential security breach
ü logs the information
ü alert on the console
• Reactive System
ü Like Passive System, but plus:
ü auto-responds (resetting the connection or drop the
traffic) from intruders
ü Send the report to admin
21

ATTACK PROCESS
22

DROP BY FIREWALL
23

DROP BY FIREWALL
24

IDS WORK FLOW IN MIKROTIK
25

MALICIOUS CONNECTION
Kind of Malicious Connection
• From outside:
ü Port Scanning, Brute Force, DDoS attack
• From inside:
ü Virus, spam, ilegal Tunneling (utrasurf),
Anonymous Proxy, Internet Download
manager, url filtered.
26

TOOLS
We want simulation with the following tools:
• MikroTik (I am using RB 751)
as IDS machine
• Attacker (my laptop)
it will attack the MikroTik with different method
• Email Account (gmail account)
there are 1 email for smtp relay and some mail as mail
of administrator.
28

MIKROTIK CONFIGURATION
Router Identity
In menu /system identity, set the router name, ex : customer identity
Why we must set the router id?
– If we have many routers, which one is being attacked.
– Because router identity will be informed in email as subject.
29

Configure Mikrotik to Send e-mail
Create mail account for the smtp relay, In this lab we using Gmail.
In /tool e-mail , set the smtp server, your username & password of gmail
/tool email
set address=74.125.141.108 user=yourgmailuser
password=yourpassword port=587
Lets try to send some email to make sure its work
30

MIKROTIK FIREWALL
• To protect the router from unauthorized access,
both originating from the WAN (Internet) or from
the LAN (local).
• To protect the network that through the router.
• In MikroTik, firewall has many features that are
all included in the IP Firewall menu.
• Basic Firewall in MikroTik configure at
IP>Firewall>Filter Rule.
31

MIKROTIK FIREWALL
• Each firewall filter rules are organized in a chain and read
sequentially.
• Each chain will be read by the router from top to bottom.
• In Firewall Filter Rule there 3 default chain
• input – processes packets sentto the router
• output – processes packets sent by the router
• forward – processes packets sentthrough the router
• In addition to the 3 default chain, We can make chain by our self as
needed.
• Every user-defined chain should subordinate to at least one of the
default chains
32

MIKROTIK FIREWALL
Rules can be placed in three default chains
• input (to router)
• output (from router)
• forward (trough the router)
Input
Winbox
Forward
WWW E-Mail
Output
Ping from Router
33

MIKROTIK FIREWALL
• Rule IF….THEN….
• IF packet match with our define criteria.
• THEN what will we do for that packet?
• In IP firewall IF condition define in tab General,
Advanced and Extra, and THEN condition define
in Action tab
34

MIKROTIK FIREWALL
IP>Firewall>Filter Rules>General
35

MIKROTIK FIREWALL
IP>Firewall>Filter Rules>Extra
36

MIKROTIK FIREWALL
accept - acceptthe packet. Packet is not passed to next firewall rule.
add-dst-to-address-list - add destination address to address list
specified by address-listparameter
add-src-to-address-list - add source address to address list
specified by address-listparameter
drop - silently drop the packet
jump - jump to the user defined chain specified by the value of jump-
target parameter
log - add a message to the system log containing following data: in-
interface, out-interface, src-mac, protocol, src-ip:port->dst-ip:port and
length of the packet. After packet is matched it is passed to next rule
in the list, similar as passthrough
passthrough - ignore this rule and go to next one (useful for
statistics).
reject - drop the packet and send an ICMP rejectmessage
return - passes control back to the chain from where the jump took
place
tarpit - captures and holds TCP connections (replies with SYN/ACK
to the inbound TCP SYN packet)
IP>Firewall>Filter Rules>Action
37

IP Firewall Filter Rule (Extra) - PSD
PSD (Port Scan Detection)
Filter or and identify port scanning (TCP)
low port : 0 – 1023
high port : 1024 - 65535
38

Configure IP Firewall to detect Port Scan Detect
/ip firewall filter
add action=add-src-to-address-list address-list=port_scaners
address-list-timeout=5m10s chain=input comment="QUICK
SCANNING" psd=21,3s,3,1
Add chain=input protocol=icmp reject-with=icmp-host-unreachable
src-address-list=port_scaners action=reject
39

Configure MikroTik to Run the Script
Scripts can be written directly to console or can be stored in Script
repository
• Example script that directly run in console:
[admin@MikroTik]>:put (45+23+1)
• Script repository ( /system script) can be run by running other
script, on event scheduler or netwatch
40

Configure in Script Repository (/system script)
:foreach a in=[/ip firewall address-list find list=port_scaners] do={:global
ip [/ip firewall address-list get $a address];
:log warning ("Scan Attack from:" .$ip);
:local sysname [/system identity get name];
:local date [/system clock get date];
:local time [/system clock get time];
/tool e-mail send from="Router $sysname<mikrotik.ids@gmail.com>"
to="indomedia.monitoring@yahoo.com" start-tls=yes server=74.125.127.108
port=587 user=mikrotik.ids password=t3ddyb3ar subject="Scan Attack!" body="
Dear Admin, n nWe have note that on $date at $time. There is scanning attack
to $sysname from IP $ip, and has been blocked by firewall. nSee
http://whois.sc/$ip for detail IP attacker information. n n Thanks & Regard
nIDS Machine":log warning "IP intruder telah diblock dan Email report telah
dikirim."}
Find match address list
Get the IP address
Log it on machine
Get router id, date & time
send the report
41

Configure in Script Repository (/system script)
Download script from www.trainingmikrotik.com/ids
42

Configure in System Scheduler
In /system schedule add schedule in order to run the scripts within a certain period
Interval set to 5m, because the ip address list time out set to 5m 10s,
its to ensure that the IP in address-list sent once.
43

In /system log, add logging for mail topics, Its make us easy to get the log if there are
troubleshoot in send mail
44

ATACKER DEMO
– Today most of the attackers who attacked
continuously usually is a machine or boot
– In this demonstration, we will use Software for
testing/simulation
– For demo, We will using Nmap for scanning and
Brute Force for involves systematically checking
all possible code, combination, or password until
the correct one is found
45

ATACKER DEMO
Download NMAP from https://nmap.org/, and run it:
46

ATACKER DEMO
Check in your email inbox:
47

CONCLUTIONS
ü We can change our mikrotik box to become a
smart machine that inform us if it’s attacked by
intruders.
ü We can improve this method to any malicious
connection
48

“If you cannot survive in the tired of learning, then you will be suffering by the pain of stupidity” (Imam
Syafi’i)
THANK YOU
FOR YOUR TIME
If you have any other questions or would like me
to clarify anything else, please, let me know. I am
always glad to help in any way I can
Jakarta & Semarang,Indonesia
www.trainingmikrotik.com
rrofiq@idn.id
+62 8156583545
@mymikrotik
www.facebook.com/ropix
ADDRESS:
WEBSITE:
EMAIL:
TELEPHONE:
id.linkedin.com/in/ropix/
rofiq.fauzi
CONTACT
49

MikroTik Security

More Related Content

What's hot

Viewers also liked

Similar to MikroTik Security

Recently uploaded

In this document

MikroTik Security