Thousands of MikroTik Routers Hacked to Eavesdrop On Network Traffic

MikroTik routers have a security vulnerability that was revealed after a wikileaks report detailed a CIA hacking tool, known as Chimay Red. What I found immediately interesting was that someone reverse engineered Chimay Red and it is now available for cloning from someone’s github: https://github.com/BigNerd95/Chimay-Red

With Chimay Red, you can add a payload to the router. It also seems like you can use it to overload a thread’s stack, which traditionally contains variables, functions, pointers, etc. that are in local scope. This allows us to write POST date into ANOTHER stack after we overload the current one. How we know what the next stack is, though, is unclear to me because threads are asynchronous, or rather they are used to handle asynchronous tasks.

Back to MikroTik, the key important detail here is that hackers can hijack devices if they take advantage of this vulnerability. Moreover, hackers can reroute traffic from compromised routers to themselves. This allows them to monitor their victims.

https://thehackernews.com/2018/09/mikrotik-router-hacking.html