Review on the Less Traveled Road: 9 Years of Overlooked MikroTik Pre-Auth RCE
DEVCORE researcher NiNi Chen discloses a 9-year-old pre-authentication remote code execution zero-day in MikroTik RouterOS affecting over 3 million devices.
Summary
The Attack Surface of MikroTik RouterOS
MikroTik RouterOS powers over three million enterprise and ISP networking devices globally, making it a high-priority target for state-sponsored threat actors.
Analyzing IPC Mechanisms and the Nova Message Architecture
Ting-Yu Chen (NiNi) investigates the undocumented internal architecture of RouterOS, moving beyond standard Nova Message research into low-level socket callbacks and remote objects.
Discovering a 9-Year-Old Pre-Auth RCE Zero-Day
Uncovering an architectural race condition in lower-layer remote object management revealed a pre-authentication remote code execution flaw present in all active RouterOS releases since 2014.
Winning Master of Pwn and Tool Release
Chen reviews the Pwn2Own Toronto exploit implementation, releasing open-source reverse-engineering tooling to help the research community audit RouterOS systems.
Related talks
Main Stage·44 min
Noam Moshe · Sharon Brizinov
Claroty Team82 reveals how cloud connectivity features in Western Digital and Synology NAS devices allow remote compromise and full RCE across millions of devices.
War Stories·37 min
Horseman · Hanley
Security researchers demonstrate how simple grep heuristics uncovered a universal remote command injection vulnerability in Lexmark enterprise printers at Pwn2Own.
Hexacon·51 min
Engineers explore architecture and security mechanisms for 2023 - 9 Years of Overlooked MikroTik Pre-Auth RCE by NiNi.