11–20 of 220 posts
>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.
...he’s the grey-hat they deserve, but not the one they need right now...
The very last paragraph kinda makes me feel bad for MikroTik, but I'd like them to add an auto-update feature to their routers. Probably fix all these issues.
>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.
The very last paragraph kinda makes me feel bad for MikroTik, but I'd like them to add an auto-update feature to their routers. Probably fix all these issues.
An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. A better solution would be automatically checking for updates, and then sending an e-mail notification to the address associated with the router's owner/sys admin. I "registered" my router and email address with Netgear about a year ago and I was shoc…
Maybe the the trigger for the automatic reboot could be more complicated than just a time-based trigger. Something like
Reboot when
localtime > 2AM &
localtime Devices at vulnerable routerOS version and not already compromised would not be vulnerable if the firewall was enabled. It's that simple. Not great that these boxes used to ship in this default state and I can _understand_ a home user unfamiliar with what they're dealing with but what reason is there for deploying infrastructure this way at an ISP or hospital or whatever org?
The winbox protocol supposedly runs over TLS and requires a username/password before anything is possible so I thought it should be safe enough, but through this bug anyone can download any file with no authentication (and the user db was storing passwords in plaintext which certainly didn't help)!
The web server vulnerability, sshd vulnerability, the smbd vulnerability - all are their fault. Had they used standard, well-tested open source packages there would be no problems, but they had to write their own custom implementations of these protocols for "reasons". I hate to think how many remotely exploitable bugs are lurking in their ipsec implementation.
Devices at vulnerable routerOS version and not already compromised would not be vulnerable if the firewall was enabled. It's that simple. Not great that these boxes used to ship in this default state and I can _understand_ a home user unfamiliar with what they're dealing with but what reason is there for deploying infrastructure this way at an ISP or hospital or whatever org?
Earlier quoted context omitted.
An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. A better solution would be automatically checking for updates, and then sending an e-mail notification to the address associated with the router's owner/sys admin. I "registered" my router and email address with Netgear about a year ago and I was shoc…
> An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. Maybe the the trigger for the automatic reboot could be more complicated than just a time-based trigger. Something like Reboot when localtime > 2AM & localtime Basically reboot unless the router detects the network is being used actively.
>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.
The very last paragraph kinda makes me feel bad for MikroTik, but I'd like them to add an auto-update feature to their routers. Probably fix all these issues.
>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.
Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind”
You didn’t even know your sink was leaky let alone called a plumber.