[HN Gopher] Abusing container mount points on MikroTik's RouterO...
___________________________________________________________________
Abusing container mount points on MikroTik's RouterOS to gain code
execution
Author : xx_ns
Score : 49 points
Date : 2022-08-05 08:50 UTC (14 hours ago)
(HTM) web link (nns.ee)
(TXT) w3m dump (nns.ee)
| tmikaeld wrote:
| This is seriously the last straw for me, I'll be switching away
| from Mikrotik to OpenWRT devices, a router should stay a router,
| not run containers!
|
| The attack area on a router should shrink, not grow!
| kirenida wrote:
| I installed OpenWrt on my mikrotik hap ac2 because I had
| problems streaming audio over wireless from my laptop to my
| raspberry.
|
| I posted on mikrotik forums, even contacted support, all to no
| avail. Not what I expected from mikrotik and a device marketed
| as a "home router".
|
| After installing openwrt, everything just worked as expected.
| oakwhiz wrote:
| Support, as well as detailed, rigorous documentation in a
| technical writing style, are definitely lacking with Mikrotik
| products. There is a lot of assumed knowledge in the process
| of specifying and then purchasing from them. However the
| price, support and feature set are not too bad if you're able
| to determine ahead of time that it would all be suitable for
| your environment.
| mcspiff wrote:
| Might want to stay away from the Turris routers, while openwrt
| based they also support running containers ;-)
| justsomehnguy wrote:
| Oh boy, what you wanna do when you learn what there are
| switches there what have a complete PC in them, running Debian?
|
| Eg: https://www.servethehome.com/dell-s5232f-on-hands-on-a-
| vastl...
| detaro wrote:
| ... OpenWRT also can run containers.
| necheffa wrote:
| So...disable the container feature?
|
| Do you just not review the configuration of your networking
| equipment?
|
| It is a convenient way to maximize hardware in SOHO
| deployments.
| oherrala wrote:
| RouterOS by default doesn't have container support. It's a
| separate package which has to be installed on the system. And
| it is still in testing / beta phase.
| gunapologist99 wrote:
| Edge equipment should not be multi-purpose, "maximizing
| hardware" or not.
|
| This pursuit of saving money has given us weak boundaries
| that are relatively easy to cross, which will ultimately cost
| substantially more given any successful attack. The risk of
| an attack is an existential threat to the business itself. Do
| you really want to risk your entire business because you are
| trying to save a few hundred for a separate device?
|
| There are places to try to save money and consolidate
| workloads, but edge routers are not it.
| yjftsjthsd-h wrote:
| I was initially inclined to agree, especially since openwrt
| can run docker too, but I think it's fair to question both
| defaults and supported modes of operation, and how much work
| it is to go from the default to the desired target state. If
| out of the box openwrt has less attack surface and you have
| to go out of your way to add those features, that's probably
| better than a jack-of-all-trades that comes out of the box
| with loads of attack surface that you have to pare down and
| hope that removing the features you don't want is
| possible/supported.
| oakwhiz wrote:
| Containers are an optional add-on package that is only present
| in the unstable release channel
| adamcharnock wrote:
| I'm seeing a few unhappy comments about this, so I'll just point
| out a couple of things:
|
| 1. This was introduced in a beta. It was then removed from
| subsequent betas until a fix could be found.
|
| 2. Running docker on a router could be really helpful in some
| cases, especially for small ISPs such as mine. For example: being
| able to run a recursive DNS resolver at the broadcast tower (ie
| nearer the customer) without having to run an entire server would
| be great. Or running a Prometheus exporter on the router for
| metric collection. Or for local processing/archiving of netflow
| data.
|
| There are some really helpful use cases for this, but they are
| not the normal devops reasons for using docker.
| justsomehnguy wrote:
| It is even more amusing what this would be used by most for
| running something like piHole.
| bravetraveler wrote:
| Oh boy, glad I moved mine to SwitchOS I guess. This being a beta
| means I would've ended up with this eventually, and Docker is
| just not something I want on a network device
|
| Seriously considering replacing this with Mikrotik showing up so
| often
|
| Edit: Any recommendations for 10GbE switches with ~8 ports would
| be appreciated, likely encouraging me to follow through
___________________________________________________________________
(page generated 2022-08-05 23:02 UTC)