Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A mysterious grey-hat is patching people's outdated MikroTik routers

zdnet.com

Post reply on HN
Print view View original

21–30 of 220 posts

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#21

Post by 394549 »

macintux wrote: post #17
394549 wrote: post #14

Earlier quoted context omitted.

> An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. Maybe the the trigger for the automatic reboot could be more complicated than just a time-based trigger. Something like Reboot when localtime > 2AM & localtime Basically reboot unless the router detects the network is being used actively.

Of course, if you're on vacation and relying on that router to be available for security cameras, an automatic firmware update that results in a bricked router can be more than a little disruptive.

It's a tradeoff. You have to balance that negative against the negative of having botnets of millions of never-patched routers.

Automatic updates should be the default, but you should be able to shut them off if you want to make a different tradeoff.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#22

Post by cs02rm0 »

Swizec wrote: post #20
AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

Isn't it more like a locksmith letting himself in because your lock wasn't working as it should and he fixed it?

Without going any further in than he had to and without charging you? I'd probably be a bit weirded out but quite pleased as long as he didn't hang around!

I guess this is part of the issue... even for people who have an understanding of it, it's a nuanced topic and the analogies are widespread but often misleading, because they're analogous. I'd imagine most people don't even care so long as they can access facebook.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#23

Post by herodotus »

AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for thanks, but I do sometimes wonder what the internet has done to once-common human decency and politeness.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#24

Post by Alupis »

Klathmon wrote: post #8
AdmiralAsshat wrote: post #4

Earlier quoted context omitted.

An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. A better solution would be automatically checking for updates, and then sending an e-mail notification to the address associated with the router's owner/sys admin. I "registered" my router and email address with Netgear about a year ago and I was shoc…

I don't think automatic updates would be as disruptive as you think. And having the ability to disable them and apply updates manually, combined with some forewarning like you are talking about (an email that says your router will restart tomorrow at 3am unless you do it sooner), would go a really long way.

A lot of Mikrotik's are installed at WISP's and other ISP's... making unplanned reboots very disruptive.

Those of us using them on our corporate networks might be inconvenienced by a temporary outage, but that's unlikely at 3am... however, scheduling and doing these manually is still the best way for enterprise gear.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#25

Post by corndoge »

Swizec wrote: post #20
AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

The fact is that the greyhat could intrude, which means anyone else could intrude. If you didn't want him there you should have patched your damn router. There is no point in being outraged because you have already been owned, and the grey did you a favor. Now, there's no need to thank them, but being mad is totally counterproductive. Learn the lesson, patch your router.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#26

Post by dharmab »

394549 wrote: post #14
AdmiralAsshat wrote: post #4

Earlier quoted context omitted.

An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. A better solution would be automatically checking for updates, and then sending an e-mail notification to the address associated with the router's owner/sys admin. I "registered" my router and email address with Netgear about a year ago and I was shoc…

> An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. Maybe the the trigger for the automatic reboot could be more complicated than just a time-based trigger. Something like Reboot when localtime > 2AM & localtime Basically reboot unless the router detects the network is being used actively.

What about links that need to be available for failover or during emergencies? What about organizations that operate at those hours? I used to work at a 24 hour retail chain, and some stores in mining towns had their busiest hours around 4AM as busloads of miners came in to shop before the day started. We could _never_ upgrade those stores in the early morning hours.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#27

Post by icelancer »

michaelbuckbee wrote: post #18
AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

Security issues are tricky. Often making people aware of an issue is indistinguishable from having caused the issue.

Only if you're technologically-illiterate.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#28

Post by icelancer »

Swizec wrote: post #20
AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

The plumber is not a locksmith, so no, I wouldn't particularly enjoy that.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#29

Post by Alupis »

394549 wrote: post #14
AdmiralAsshat wrote: post #4

Earlier quoted context omitted.

An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. A better solution would be automatically checking for updates, and then sending an e-mail notification to the address associated with the router's owner/sys admin. I "registered" my router and email address with Netgear about a year ago and I was shoc…

> An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. Maybe the the trigger for the automatic reboot could be more complicated than just a time-based trigger. Something like Reboot when localtime > 2AM & localtime Basically reboot unless the router detects the network is being used actively.

Mikrotik's aren't really consumer-grade hardware (most Mikrotik's that is). Some operators deliberately stay a version or so back off the latest due to features breaking or instability, or requiring configuration changes, etc.

Automatic updating could be crippling to ISP operators (Mikrotik's are very popular with WISP's, and other smaller ISP operators).

> Basically reboot unless the router detects the network is being used actively.

For the average Mikrotik router, deployed at some WISP or small ISP, that's unlikely to happen.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#30

Post by [deleted] »

Swizec wrote: post #20
AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

[deleted]
Post reply on HN