Попытка взлома Mikrotik?

Автор: Андрей Торженов

Если в логах Mikrotik, вы увидели кучу сообщений о попытке входа под разными логинами/паролями, не спешите делать выводы, что вас ломают, особенно, если вы видите адрес источника из вашей локальной сеть.

Дело оказалось не в попытке взлома…

Проблема оказалась в бесплатном антивирусе AVG. В него встроили функцию трафик-инспектора, она периодически сканирует сеть и видя Mikrotik, начинает попытки подобрать имя пользователя и пароль.

Понятно, что AVG не пытается взломать Mikrotik, а только провести аудит безопасности.

Одно дело, если у вас несколько ПК с AVG, а если их 1000 и все они начнут сканировать сеть и по сути, атаковать ваше сетевое оборудование…

Антивирус на ПК пользователя, не должен заниматься сканированием уязвимости в сетевой инфраструктуре. Его задача контролировать то, что происходит на том ПК, где он стоит, а инфраструктурой должен заниматься администратор сети.

Тема обсуждения на reddit: https://www.reddit.com/r/antivirus/comments/qligwk/avg_hacked_or_simple_software_error/

Обсуждение на сайте поддержки AVG: https://support.avg.com/answers?id=9065p0000000jO6AAI

Ниже лог Mikrotik:

dec/23 14:31:33 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:33 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:34 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:34 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:34 system,error,critical login failure for user MikroTikSystem from 10.10.11.51 via ssh 
dec/23 14:31:35 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:35 system,error,critical login failure for user dircreate from 10.10.11.51 via ssh 
dec/23 14:31:35 system,error,critical login failure for user EServicios from 10.10.11.51 via ssh 
dec/23 14:31:36 system,error,critical login failure for user SolucTec from 10.10.11.51 via ssh 
dec/23 14:31:36 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:36 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:37 system,error,critical login failure for user user from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user Admin from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user meo from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:39 system,error,critical login failure for user Admin from 10.10.11.51 via ssh 
dec/23 14:31:39 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:39 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:40 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:40 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:40 system,error,critical login failure for user ubnt from 10.10.11.51 via ssh 
dec/23 14:31:41 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:41 system,error,critical login failure for user sysadm from 10.10.11.51 via ssh 
dec/23 14:31:41 system,error,critical login failure for user guest from 10.10.11.51 via ssh 
dec/23 14:31:42 system,error,critical login failure for user Administrator from 10.10.11.51 via ssh 
dec/23 14:31:42 system,error,critical login failure for user vodafone from 10.10.11.51 via ssh 
dec/23 14:31:42 system,error,critical login failure for user vodafone from 10.10.11.51 via ssh 
dec/23 14:31:42 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:42 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:43 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:43 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:43 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:43 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:44 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:44 system,error,critical login failure for user supervisor from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user User from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user user from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user user from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user Guest from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user Guest from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user Gearguy from 10.10.11.51 via ssh 
dec/23 14:31:46 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:46 system,error,critical login failure for user Cisco from 10.10.11.51 via ssh 
dec/23 14:31:46 system,error,critical login failure for user supervisor from 10.10.11.51 via ssh 
dec/23 14:31:47 system,error,critical login failure for user 11111 from 10.10.11.51 via ssh 
dec/23 14:31:47 system,error,critical login failure for user Admin from 10.10.11.51 via ssh 
dec/23 14:31:48 system,error,critical login failure for user Administrator from 10.10.11.51 via ssh 
dec/23 14:31:48 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:48 system,error,critical login failure for user guest from 10.10.11.51 via ssh 
dec/23 14:31:49 system,error,critical login failure for user user from 10.10.11.51 via ssh 
dec/23 14:31:49 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:33 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:33 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:34 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:34 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:34 system,error,critical login failure for user MikroTikSystem from 10.10.11.51 via ssh 
dec/23 14:31:35 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:35 system,error,critical login failure for user dircreate from 10.10.11.51 via ssh 
dec/23 14:31:35 system,error,critical login failure for user EServicios from 10.10.11.51 via ssh 
dec/23 14:31:36 system,error,critical login failure for user SolucTec from 10.10.11.51 via ssh 
dec/23 14:31:36 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:36 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:37 system,error,critical login failure for user user from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user Admin from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user meo from 10.10.11.51 via ssh 
dec/23 14:31:38 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:39 system,error,critical login failure for user Admin from 10.10.11.51 via ssh 
dec/23 14:31:39 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:39 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:40 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:40 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:40 system,error,critical login failure for user ubnt from 10.10.11.51 via ssh 
dec/23 14:31:41 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:41 system,error,critical login failure for user sysadm from 10.10.11.51 via ssh 
dec/23 14:31:41 system,error,critical login failure for user guest from 10.10.11.51 via ssh 
dec/23 14:31:42 system,error,critical login failure for user Administrator from 10.10.11.51 via ssh 
dec/23 14:31:42 system,error,critical login failure for user vodafone from 10.10.11.51 via ssh 
dec/23 14:31:42 system,error,critical login failure for user vodafone from 10.10.11.51 via ssh 
dec/23 14:31:42 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:42 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:43 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:43 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:43 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:43 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:44 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:44 system,error,critical login failure for user supervisor from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user User from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user user from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user user from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user Guest from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user Guest from 10.10.11.51 via ssh 
dec/23 14:31:45 system,error,critical login failure for user Gearguy from 10.10.11.51 via ssh 
dec/23 14:31:46 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:46 system,error,critical login failure for user Cisco from 10.10.11.51 via ssh 
dec/23 14:31:46 system,error,critical login failure for user supervisor from 10.10.11.51 via ssh 
dec/23 14:31:47 system,error,critical login failure for user 11111 from 10.10.11.51 via ssh 
dec/23 14:31:47 system,error,critical login failure for user Admin from 10.10.11.51 via ssh 
dec/23 14:31:48 system,error,critical login failure for user Administrator from 10.10.11.51 via ssh 
dec/23 14:31:48 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:48 system,error,critical login failure for user guest from 10.10.11.51 via ssh 
dec/23 14:31:49 system,error,critical login failure for user user from 10.10.11.51 via ssh 
dec/23 14:31:49 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:49 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:50 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:50 system,error,critical login failure for user admim from 10.10.11.51 via ssh 
dec/23 14:31:51 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:52 system,error,critical login failure for user from 10.10.11.51 via ssh 
dec/23 14:31:52 system,error,critical login failure for user user from 10.10.11.51 via ssh 
dec/23 14:31:52 system,error,critical login failure for user Admin from 10.10.11.51 via ssh 
dec/23 14:31:53 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:53 system,error,critical login failure for user 1234 from 10.10.11.51 via ssh 
dec/23 14:31:54 system,error,critical login failure for user ADSL from 10.10.11.51 via ssh 
dec/23 14:31:54 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:54 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:55 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:56 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:56 system,error,critical login failure for user administrator from 10.10.11.51 via ssh 
dec/23 14:31:56 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:56 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:57 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:57 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:57 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:58 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:31:58 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:58 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:59 system,error,critical login failure for user Administrator from 10.10.11.51 via ssh 
dec/23 14:31:59 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:31:59 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:32:00 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:32:00 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:32:01 system,error,critical login failure for user admin from 10.10.11.51 via ssh 
dec/23 14:32:01 system,error,critical login failure for user root from 10.10.11.51 via ssh 
dec/23 14:32:01 system,error,critical login failure for user root from 10.10.11.51 via ssh

The following two tabs change content below.
В профессиональной сфере занимаюсь всем, что связанно с IT. Основная специализация - VoIP и сети передачи данных. Стараюсь не заниматься Windows серверами (но иногда приходится) и 1С.

Попытка взлома Mikrotik?: 2 комментария

    1. Андрей Торженов Автор записи

      Я и не ставил… люди сами его поставили, а я подключился к МТ и в логах такое обнаружил. Сначала подумал, что подхватили какой-то троян, забрал ноут, но там было всё чисто… потом вот выяснилось что это AVG.

Добавить комментарий