Re: [Mikrotik Users] Exploit in ROS 6.41.3/6.42rc27

2018-08-05 Thread Bob Pensworth via Mikrotik-users
We are finding an IP/Socks connection: We are finding an event entry in System/Scheduler And the (below) script in System/Script: /ip firewall filter remove [/ip firewall filter find where comment ~ "port [0-9]*"];/ip socks set enabled=yes port=11328 max-connections=255

Re: [Mikrotik Users] Exploit in ROS 6.41.3/6.42rc27

2018-08-05 Thread Bruce Bridegwater via Mikrotik-users
Fyi, credit to J.P. Douros from RPM Provioning Management for bringing it to our attention and providing the solution. RPM manages our Cisco UBR10k CMTS. Great support company. From: mikrotik-users-boun...@wispa.org on behalf of Bob Pensworth via

Re: [Mikrotik Users] Exploit in ROS 6.41.3/6.42rc27

2018-08-05 Thread Shawn C. Peppers via Mikrotik-users
Been cleaning this up for random clients daily nowhence the reason i am very strongly voicing zero open ports (except l2tp and ipsec) to the outside network... :: // Shawn Peppers :: // DirectlinkAdmin.com > On Aug 5, 2018, at 7:57 PM, Bob Pensworth wrote: > > We are finding an