Thank you very much for the replies! I am definitely more at ease now.
My concerns came from a few videos on youtube, which show unboxings of ac3 and there is clearly a yellow anti-tamper sticker. Like this one:
https://www.youtube.com/watch?v=6KDD2wmvyj0
I know this is a different model and maybe it is no longer done or differs from country to country?
I also stumbled upon discussions like this:
https://security.stackexchange.com/ques ... sed-router
It is about buying a used router, but it is the same principle. They talk about a lot of ways to compromise a device once you have physical access to it. Although in retrospect it does seem a little overparanoid and I am glad to learn that routerOS is secured on many of the vectors described. Although I was just reading the documentation on running containers where it states this:
Disclaimer
you need physical access to the router to enable support for the container feature, it is disabled by default;
once the container feature is enabled, containers can be added/configured/started/stopped/removed remotely!
if the router is compromised, containers can be used to easily install malicious software in your router and over network;
your router is as secure as anything you run in container;
if you run container, there is no security guarantee of any kind;
running a 3rd party container image on your router could open a security hole/attack vector/attack surface;
an expert with knowledge how to build exploits will be able to jailbreak/elevate to root;
and this:
Security risks:
when a security expert publishes his exploit research - anyone can apply such an exploit;
someone will build a container image that will do the exploit AND provide a Linux root shell;
by using a root shell someone may leave a permanent backdoor/vulnerability in your RouterOS system even after the docker image is removed and the container feature disabled;
if a vulnerability is injected into the primary or secondary routerboot (or vendor pre-loader), then even netinstall may not be able to fix it;
That last line is a bit scary. Needless to say I checked and I only have routeros and wifiwave2 packages installed. I also confirmed that there are no scripts scheduled to run on boot time in the system scheduler. But aren't containers (and maybe scripts) a way to run arbitrary code on routerOS?
I don't see anything wrong in the report from /export, though I cannot claim that I understand everything. It is awesome that such an option exists! BTW I have disabled all services, besides the webserver on port 80. And /system/resource/print gives me this:
正常运行时间:5 d20h58m5s版本:7.8(稳定)build-time: Feb/24/2023 09:03:00 factory-software: 7.5 free-memory: 660.8MiB total-memory: 960.0MiB cpu: ARM64 cpu-count: 4 cpu-frequency: 864MHz cpu-load: 0% free-hdd-space: 95.2MiB total-hdd-space: 128.5MiB write-sect-since-reboot: 6168 write-sect-total: 22038 bad-blocks: 0% architecture-name: arm64 board-name: hAP ax^3 platform: MikroTik
I did update to 7.8 so maybe that is why write-sect-total is that high?
Do not uselessly worry, your smartphone and your computer have more rootkit than the RouterBOARD....
I never meant to imply there was anything wrong with the RouterBOARD, but after it left the factory
After all this is the device that now protects me and my family from the internet
I will look into Netinstall, but will probably refrain from flashing for now, since I see there is no reason. Going on this rabbit hole has given me a big incentive to better educate myself and keep finding out new things about routerOS
