Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A mysterious grey-hat is patching people's outdated MikroTik routers

zdnet.com

Post reply on HN
Print view View original

81–90 of 220 posts

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#81

Post by sathackr »

r1ch wrote: post #15
philamonster wrote: post #10

Devices at vulnerable routerOS version and not already compromised would not be vulnerable if the firewall was enabled. It's that simple. Not great that these boxes used to ship in this default state and I can _understand_ a home user unfamiliar with what they're dealing with but what reason is there for deploying infrastructure this way at an ISP or hospital or whatever org?

I think there's still a lot of blame on Mikrotik for having such bugs in their management service and other daemons. I explicitly opened up the winbox port to be able to remotely manage Mikrotik routers I deploy (I considered their VPN implementations to be an even higher attack surface), as did many other admins it seems. The winbox protocol supposedly runs over TLS and requires a username/password before anything i…

Vulnerabilities are almost unavoidable.

Leaving a management port on a router open to the entire internet is a very bad practice. Would you leave an RDP port open to the world?

If you require remote access, at least restrict it to known management IP addresses.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#82

Post by thrmsforbfast »

Alupis wrote: post #57
AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

> "I added firewall rules that blocked access to the router from outside the local network," Alexey said. This could very well be what's causing the outrage from operators... suddenly losing connection with your router that's in some data center 3 hours away - requiring a drive-over just to discover it's some dude adding rules to your production equipment would be upsetting. There's legitimate reasons for remote oper…

Apparently exactly this happened:

https://pikabu.ru/story/vzlom_routeros_5924128

assuming, at least, that the Google translation is decent: "It seems to be even good, but the admin’s account has severely cut the rights, the attackers created another one with full rights. The office is far away, the provider settings are pppoe, we can’t remove back-ups, we can also unload the config, advise how to be?"

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#83

Post by icebraining »

aequitas wrote: post #39
Klathmon wrote: post #8

Earlier quoted context omitted.

I don't think automatic updates would be as disruptive as you think. And having the ability to disable them and apply updates manually, combined with some forewarning like you are talking about (an email that says your router will restart tomorrow at 3am unless you do it sooner), would go a really long way.

Don't forget that a lot of the customer base for Mikrotik is in remote locations (ie: P2P connections in rural areas) or small ISPs. Having the router in your office die on you (even during office hours) is a little different than all your customers call you the same day their only internet connection is gone.

ISPs would just have to disable it before installing the router. Still seems like a good default.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#84

Post by LinuxBender »

vbezhenar wrote: post #60
behringer wrote: post #48

Earlier quoted context omitted.

Actually I once heard a story of a neighbor who let themselves in when the house was literally flooding and he saved the owner thousands of dollars worth of damage. That's more like what's happening with these patched routers. I also heard a story of a guy who's house burned down. The neighbor saw it very early and did nothing about it cuz not her problem. The homeowner was devastated. So yes, if you see incredible d…

I've heard that in US you could be shot for trespassing. It might be very dangerous to try fixing it.

Certainly in Texas I would be extra careful. Either way, have someone standing outside to advise the homeowner or cops what is going on. Also call the police ahead of time and tell them what you intend to do. Maybe even ask for an officer to assist.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#85

Post by icebraining »

macintux wrote: post #17
394549 wrote: post #14

Earlier quoted context omitted.

> An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. Maybe the the trigger for the automatic reboot could be more complicated than just a time-based trigger. Something like Reboot when localtime > 2AM & localtime Basically reboot unless the router detects the network is being used actively.

Of course, if you're on vacation and relying on that router to be available for security cameras, an automatic firmware update that results in a bricked router can be more than a little disruptive.

An update shouldn't brick a well built router; that's what watchdogs and secondary flash is for.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#86

Post by NelsonMinar »

deckar01 wrote: post #74

> As for MikroTik, the Latvian company has been one of the most responsive vendors in terms of security flaws, fixing issues within hours or days, compared to the months that some other router vendors tend to take. It would be unfair to blame this situation on them. Patches have been available for months, but, yet again, it is ISPs and home users who are failing to take advantage of them. A system that requires users…

OTOH people would scream bloody murder at a router that installed firmware updates and rebooted itself without asking. Just look at the reaction to how Windows 10 handles updates.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#87

Post by samat »

ryandrake wrote: post #67

If only ISPs would start disconnecting negligent customers who continue to use exploited or vulnerable equipment. The incentives are not right. If they did, they’d risk losing a paying customer, if they don’t, nothing bad really happens to them. I hate suggesting regulations and fines but it’s the only thing end users and ISPs will respond to.

Most of this devices are provided by ISPs so it's they who are negligent. :)

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#88

Post by Lukassus »

Swizec wrote: post #20
AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

I think it it's more like someone locking your front door.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#89

Post by TeMPOraL »

394549 wrote: post #21
macintux wrote: post #17

Earlier quoted context omitted.

Of course, if you're on vacation and relying on that router to be available for security cameras, an automatic firmware update that results in a bricked router can be more than a little disruptive.

It's a tradeoff. You have to balance that negative against the negative of having botnets of millions of never-patched routers. Automatic updates should be the default, but you should be able to shut them off if you want to make a different tradeoff.

Automatic security updates should be the default, all other updates should absolutely not. In case of patching routers there isn't much crapware to be upsold, but in general, if we're ever going to develop some code of ethics in this industry, I wish a part of it would be a rule of hard separation between security patches and feature updates, and another rule that the latter should never be done automatically without explicit opt-in.

Yes, it's extra work for developers, but the result of not doing that is the present situation - a lot of users, including a surprisingly large population of non-tech-savvy people, will go out of their way to shut down automatic updates, to avoid having to deal with broken workflows, upselling, ads sneaking in, and forced reboots in the middle of a business presentation or a game (or a surgery).

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#90

Post by mtone »

EGreg wrote: post #59
herodotus wrote: post #54

Earlier quoted context omitted.

I get an email claiming that I have unread Linkedin messages. The email uses their Logos. But if I were to click any of the links in the email, it would send me to a php or html file that contains a Javascript redirect script. That script, if executed, then goes to the phishers actual page. Sometimes, there is an additional DNS redirect at the JS redirected page. For some reason, the JS redirect tries to hide the red…

The solution should be to just stop using human generated passwords and instead have each site generate their own and for browsers and apps use password managers built into the OS and offer to fill them in based on the domain. This is increasingly happening. We need the large sites to move to this to eliminate phishing entirely. So https://f00l.com isn’t same as https://fool.com

I use Keepass and still manually paste and autosave my passwords.

Have browsers extensions improved for this? When I last checked 5 and 10 years ago, it didn't seem to work.

Post reply on HN