Has my Mikrotik been hacked yet?

Question

network hardware

They asked me to set up Mikrotik, before that I had no business with them. In general, for some time he stuck open with a default password on the Internet, for about an hour.
Now in WinBox and found such a call in the schedule.


and then in the log,



do you think it's better to reset all the settings and reconfigure it, or can you look somewhere else for the subject of left life activity?

Answer 1

Reset.
I wonder what is the content of the script that was executed on Mikrotik

Answer 2

/ip socks access add src-address=77.238.240.0/24 action=allow
/ip socks access add src-address=178.239.168.0/24 action=allow
/ip socks access add src-address=77.238.228.0/24 action=allow
/ip socks access add src-address=94.243.168.0/24 action=allow
/ip socks access add src-address=213.33.214.0/24 action=allow
/ip socks access add src-address=31.172.128.45/32 action=allow
/ip socks access add src-address=31.172.128.25/32 action=allow
/ip socks access add src-address=10.0.0.0/8 action=allow
/ip socks access add src-address=185.137.233.251/32 action=allow
/ip socks access add src-address=5.9.163.16/29 action=allow
/ip socks access add src-address=176.9.65.8/32 action=allow
/ip socks access add src-address=95.213.221.0/24 action=allow
/ip socks access add src-address=159.255.24.0/24 action=allow
/ip socks access add src-address=31.184.210.0/24 action=allow
/ip socks access add src-address=188.233.1.0/24 action=allow
/ip socks access add src-address=188.233.5.0/24 action=allow
/ip socks access add src-address=188.233.13.0/24 action=allow
/ip socks access add src-address=188.232.101.0/24 action=allow
/ip socks access add src-address=188.232.105.0/24 action=allow
/ip socks access add src-address=188.232.109.0/24 action=allow
/ip socks access add src-address=176.212.165.0/24 action=allow
/ip socks access add src-address=176.212.169.0/24 action=allow
/ip socks access add src-address=176.212.173.0/24 action=allow
/ip socks access add src-address=176.213.161.0/24 action=allow
/ip socks access add src-address=176.213.165.0/24 action=allow
/ip socks access add src-address=176.213.169.0/24 action=allow
/ip socks access add src-address=5.3.113.0/24 action=allow
/ip socks access add src-address=5.3.117.0/24 action=allow
/ip socks access add src-address=5.3.121.0/24 action=allow
/ip socks access add src-address=5.3.145.0/24 action=allow
/ip socks access add src-address=5.3.149.0/24 action=allow
/ip socks access add src-address=5.3.153.0/24 action=allow
/ip socks access add src-address=5.167.9.0/24 action=allow
/ip socks access add src-address=5.167.13.0/24 action=allow
/ip socks access add src-address=5.167.17.0/24 action=allow
/ip socks access add src-address=94.180.1.0/24 action=allow
/ip socks access add src-address=94.180.5.0/24 action=allow
/ip socks access add src-address=94.180.9.0/24 action=allow
/ip socks access add src-address=192.243.53.0/24 action=allow
/ip socks access add src-address=176.9.65.8/32 action=allow
/ip socks access add src-address=135.181.15.102/32 action=allow
/ip socks access add src-address=0.0.0.0/0 action=deny

this script, removed from the client's router.
At that time, SOCKS was running on port 6199 and was enabled.

Answer 3

before plugging in the provider's cable, you must at least password-protect the admin panel. and change the default winbox port. and those addresses that have already appeared in scripts and logs - full networks / 24 or even / 22 to the black list because they are not fig.

Answer 4

Reset in such cases may not be enough, I would advise you to completely reflash through the console, I had precedents, now I use only cisco, because. Mikrotik is full of holes like a colander with an unreasonably high cost, for a home or a small office, buy a tp-link for 1000 rubles, there will be more sense.

Answer 5

miKrotik, not miСrotik, oh my god