EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Sep 5·5 min read
Reversing MikroTik's Silent Patch: The RouterOS 7.23.4 Fix They Wouldn't Explain
TL;DR
MikroTik's RouterOS 7.23.4 update addressed critical security vulnerabilities without disclosing details, prompting a reverse engineering effort that uncovered multiple bugs, including an RSA signature forgery.
✦ Why It Matters
Update your MikroTik devices immediately to mitigate potential security risks from undisclosed vulnerabilities.
Key Takeaways
- Update MikroTik RouterOS to the latest version immediately.
- Monitor for unusual activity on your network devices.
- Consider implementing additional security measures for SSH access.
- Stay informed about security updates and vulnerabilities in your software.
How It Works
The reverse engineering process involved extracting the NPK files of RouterOS, analyzing the differences in the SSH server's binary, and identifying changes in the symbol tables. This revealed that the new version included stricter validation for SSH usernames, preventing the exploitation of a legacy file descriptor mechanism that could lead to unauthorized command execution.