A mysterious grey-hat is patching people's outdated MikroTik routers • Hacker News Board

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#31

Post by StreakyCobra » Fri, Oct 12, 2018, 3:16 PM UTC

Swizec wrote: post #20

AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

I don't have a strong opinion about this case, but it would be more correct to compare it to this situation:

You come home one day, entering by the main door as usual, and when going down in the garage you notice the key on the floor with a message saying: "Your garage door were not locked and everybody knew about it, so I came in to take the key on the inner lock, closed it from outside and slipped the key back under the door so nobody else with bad intentions can enter anymore".

In the situation you described I would be pissed off, but not in this one, and IMHO it is closer to this case.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#32

Post by tjoff » Fri, Oct 12, 2018, 3:17 PM UTC

Swizec wrote: post #20

AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

You didn't know, but the mere presence of the plumber is evidence that it was faulty (since the plumber used the same security hole).

Also, the alternative in this case might be a water leak that ruins your whole house.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#33

Post by xx_alpha_xx » Fri, Oct 12, 2018, 3:17 PM UTC

herodotus wrote: post #23

AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for…

That's great of you, I often do this as well and have never received any acknowledgement or thank you :(

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#34

Post by TheCapn » Fri, Oct 12, 2018, 3:17 PM UTC

Swizec wrote: post #20

AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

Its all about how its approached... and its sort of a little bit about how your personality is.

I came home one day to a note on my inner garage door: "you left your door open, I closed it for you ;)". No name, nothing... just someone entered my garage, wrote a note, closed it and left.

I took a quick survey to see if any of the obvious valuable items were disturbed or missing and none were. I was more upset with myself for letting that happen then a stranger "fixing" my security vulnerability.

EDIT: and another anecdote was that my neighbor let himself into my house once when a water leak was discovered outside so the water could be shut off. Saved me thousands in potential damages that he caught it early... I can't say I'd be all that upset finding a plumber under my sink fixing something but that's just me.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#35

Post by thrmsforbfast » Fri, Oct 12, 2018, 3:17 PM UTC

Swizec wrote: post #20

AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

I have never found this analogy compelling for two reasons.

First, your sink is not part of a botnet (assuming it's not a smartsink, I guess). By leaving your machine unpatched, you are causing harm to others.

This makes the ethics of this sort of grey-hat hacking much more murky IMO. I'm willing to concede that the grey-hat behaved unethically, but I also believe that leaving a machine unpatched makes the machine's owner at least somewhat responsible for how that machine is used.

Further, I do not think it's reasonable to both claim that this sort of grey-hat activity is unethical and also claim that owners of unpatched devices have absolutely zero responsibility for how their unpatched machines are used. I.e., if we condemn this grey hat (assuming he simply locked to door and left and did nothing else) then we should also condemn the owners of botnet'd devices for the way in which their negligence causes harm to others.

If others can't break in and fix your stuff when it starts effecting them, then you should be held at least partially responsible for how your stuff is used by criminals.

Second, physical presence can be a privacy intrusion on its own and without any willful intent. E.g., a grey-hat plumber who is purely altruistic might never-the-less accidentally catch a glimpse of you naked. On the other hand, cyber presence almost always requires intentional snooping to cause a privacy violation.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#36

Post by nkrisc » Fri, Oct 12, 2018, 3:18 PM UTC

Swizec wrote: post #20

AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

If your sink was clogged and running and flooding the apartment below you, it would be perfectly reasonable for someone to kick your door down and turn the water off.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#37

Post by toomuchtodo » Fri, Oct 12, 2018, 3:19 PM UTC

xx_alpha_xx wrote: post #33

herodotus wrote: post #23

Earlier quoted context omitted.

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for…

That's great of you, I often do this as well and have never received any acknowledgement or thank you :(

To you and OP: Thank you for your efforts! Don't stop fighting the good fight!

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#38

Post by mygo » Fri, Oct 12, 2018, 3:19 PM UTC

StreakyCobra wrote: post #31

Swizec wrote: post #20

Earlier quoted context omitted.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

I don't have a strong opinion about this case, but it would be more correct to compare it to this situation: You come home one day, entering by the main door as usual, and when going down in the garage you notice the key on the floor with a message saying: "Your garage door were not locked and everybody knew about it, so I came in to take the key on the inner lock, closed it from outside and slipped the key back unde…

If someone slides my key under the door I’m changing the locks

Which I guess is something a gray hat would be happy to see

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#39

Post by aequitas » Fri, Oct 12, 2018, 3:20 PM UTC

Klathmon wrote: post #8

AdmiralAsshat wrote: post #4

Earlier quoted context omitted.

An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. A better solution would be automatically checking for updates, and then sending an e-mail notification to the address associated with the router's owner/sys admin. I "registered" my router and email address with Netgear about a year ago and I was shoc…

I don't think automatic updates would be as disruptive as you think. And having the ability to disable them and apply updates manually, combined with some forewarning like you are talking about (an email that says your router will restart tomorrow at 3am unless you do it sooner), would go a really long way.

Don't forget that a lot of the customer base for Mikrotik is in remote locations (ie: P2P connections in rural areas) or small ISPs. Having the router in your office die on you (even during office hours) is a little different than all your customers call you the same day their only internet connection is gone.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#40

Post by moron4hire » Fri, Oct 12, 2018, 3:20 PM UTC

StreakyCobra wrote: post #31

Swizec wrote: post #20

Earlier quoted context omitted.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

I don't have a strong opinion about this case, but it would be more correct to compare it to this situation: You come home one day, entering by the main door as usual, and when going down in the garage you notice the key on the floor with a message saying: "Your garage door were not locked and everybody knew about it, so I came in to take the key on the inner lock, closed it from outside and slipped the key back unde…

There's the added wrinkle of "... and there's a band of criminals in the area that we know likes to secretly hide in the remote, infrequently used closets of people's houses, where they plot and execute break-ins, thefts, kidnappings, and acts of terrorism."