Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A mysterious grey-hat is patching people's outdated MikroTik routers

zdnet.com

Post reply on HN
Print view View original

101–110 of 220 posts

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#101

Post by l9k »

vkou wrote: post #69
Swizec wrote: post #20

Earlier quoted context omitted.

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

If your home had a ruptured pipe, that was spraying sewage all over the sidewalk, I think someone stepping onto your property, and turning the firehose of shit off would be behaving ethically. Trespass to save people from themselves is one thing. Trespass to save the public is quite another.

In this case it would be getting back home seeing a note saying "Fixed :)".

So yes, it's actually fixed, but now you know that someone you don't know broke into your house without permission nor supervision and you don't know what he's done/seen/stolen in your house.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#102

Post by sathackr »

r1ch wrote: post #19
ccnafr wrote: post #2

The very last paragraph kinda makes me feel bad for MikroTik, but I'd like them to add an auto-update feature to their routers. Probably fix all these issues.

Unfortunately Mikrotik updates tend to change a lot of things and potentially cause issues. Recently the whole bridge implementation was rewritten which required config changes if you had anything beyond the basic bridge/port setup. And the last "stable" update was bricking certain models by making them unbootable. If they were applied automatically then there would be lots of broken routers...

Yep. They have serious regression issues. Sometimes things that are fixed get broken again, and updates often break other things.

Other vendors have similar issues, so it's not just a Mikrotik problem, but while with other vendors it's uncommon, I almost expect it from Mikrotik.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#103

Post by sathackr »

deckar01 wrote: post #74

> As for MikroTik, the Latvian company has been one of the most responsive vendors in terms of security flaws, fixing issues within hours or days, compared to the months that some other router vendors tend to take. It would be unfair to blame this situation on them. Patches have been available for months, but, yet again, it is ISPs and home users who are failing to take advantage of them. A system that requires users…

As opposed to Microsoft ramming updates down your throat whether you like them or not, and whether they break things or not?

The lock on your house door is 'opt-in'. If you don't lock it and someone steals something, is it the lock manufacturer's fault? The home builder's fault? Did they construct an insecure house? Ignorance of the proper operation of the lock is not an excuse not to lock it and doesn't shift the responsibility to someone else.

I don't know why people happily assume everything in IT is secure by default when in the real world, almost nothing is secure by default.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#104

Post by chrsstrm »

ethbro wrote: post #76
LurkersWillLurk wrote: post #42

Earlier quoted context omitted.

> I NEVER received a thank you from any of these people. Is it possible that they (perhaps mistakenly) believe that communicating with you could open them up to civil liability?

> Is it possible that they (perhaps mistakenly) believe that communicating with you could open them up to civil liability? I'm curious, for vulnerability-by-inaction like this, would there be a legal difference if sent emails were posted to a public blockchain? The intent being, if you're later sued for harm caused by your compromised hardware / IoT devices, you cannot claim ignorance as easily. End goal, of course,…

Ignorantia juris non excusat.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#105

Post by sokoloff »

mtone wrote: post #90
EGreg wrote: post #59

Earlier quoted context omitted.

The solution should be to just stop using human generated passwords and instead have each site generate their own and for browsers and apps use password managers built into the OS and offer to fill them in based on the domain. This is increasingly happening. We need the large sites to move to this to eliminate phishing entirely. So https://f00l.com isn’t same as https://fool.com

I use Keepass and still manually paste and autosave my passwords. Have browsers extensions improved for this? When I last checked 5 and 10 years ago, it didn't seem to work.

For sites that I don't care that much about, I use and like Chrome's (relatively) new password manager [0].

I haven't looked into it in enough depth to be 100% convinced to trust it with my financially-linked passwords. (In reality, it's almost surely good enough, but I haven't reached that informed conclusion yet.)

[0] - https://www.blog.google/products/chrome/chrome-password-mana...

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#106

Post by zero_iq »

x220 wrote: post #99
LurkersWillLurk wrote: post #42

Earlier quoted context omitted.

> I NEVER received a thank you from any of these people. Is it possible that they (perhaps mistakenly) believe that communicating with you could open them up to civil liability?

"Thanks for the info, I'll check this out :)" There, nothing was admitted.

At least four things were admitted: that you received the information, somebody processed it, the approximate time you received/processed, and the intention to take action.

I would hope any well-intentioned and reputable company would not mind, but some might not want to admit any of that! Plenty of ammo for anyone who subsequently blames you if you then fail to remedy the situation in a timely fashion.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#107

Post by Zach_the_Lizard »

robocat wrote: post #94
herodotus wrote: post #71

Earlier quoted context omitted.

What I do in my emails is tell them the exact URL of the bad page. All they need to do is look at the file with a text editor (they are admins, after all). Once they have done this, they will see strange Javascript. They will know it has nothing to do with their own (or their clients) web pages. There are no links per se in my email (except the URL, but I leave off the http:).

Don't you worry that if you email spammy/virus-laden links then your email address could get flagged?

Perhaps using a dedicated email for these sorts of reports could limit the damage if that were to happen. It would probably increase the chance of being flagged, though.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#108

Post by ip26 »

aequitas wrote: post #39
Klathmon wrote: post #8

Earlier quoted context omitted.

I don't think automatic updates would be as disruptive as you think. And having the ability to disable them and apply updates manually, combined with some forewarning like you are talking about (an email that says your router will restart tomorrow at 3am unless you do it sooner), would go a really long way.

Don't forget that a lot of the customer base for Mikrotik is in remote locations (ie: P2P connections in rural areas) or small ISPs. Having the router in your office die on you (even during office hours) is a little different than all your customers call you the same day their only internet connection is gone.

I used to be a customer of a remote WISP, P2P in a rural area.

I can't speak for all WISP's, but we only had service about 12 hours a day, less if it was raining. Five minutes to reboot a router would have been invisible.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#109

Post by DATACOMMANDER »

sathackr wrote: post #81
r1ch wrote: post #15

Earlier quoted context omitted.

I think there's still a lot of blame on Mikrotik for having such bugs in their management service and other daemons. I explicitly opened up the winbox port to be able to remotely manage Mikrotik routers I deploy (I considered their VPN implementations to be an even higher attack surface), as did many other admins it seems. The winbox protocol supposedly runs over TLS and requires a username/password before anything i…

Vulnerabilities are almost unavoidable. Leaving a management port on a router open to the entire internet is a very bad practice. Would you leave an RDP port open to the world? If you require remote access, at least restrict it to known management IP addresses.

Why is it that vulnerabilities are almost unavoidable? I’m not trying to be a smart-ass; I’m an analyst at an MSP and I’m doing my first pen-test soon. I’m under no illusions that my job title or growing responsibilities make me a security expert (or anywhere near it). Is it because the software stack is just too complex for network programmers to handle? (Not that router OSes are the only pieces of software that have vulnerabilities; and I imagine that you’d say that vulnerabilities are almost unavoidable in general.)

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#110

Post by pbhjpbhj »

zero_iq wrote: post #106
x220 wrote: post #99

Earlier quoted context omitted.

"Thanks for the info, I'll check this out :)" There, nothing was admitted.

At least four things were admitted: that you received the information, somebody processed it, the approximate time you received/processed, and the intention to take action. I would hope any well-intentioned and reputable company would not mind, but some might not want to admit any of that! Plenty of ammo for anyone who subsequently blames you if you then fail to remedy the situation in a timely fashion.

A reputable company that deserves it's reputation is probably not hosting phishers pages on their site. Sure, shit happens, but anything above a micro company that's hosting pages should catch that. The shared hosting company I used caught a breach on my personal page once, another time Google notified me: it's not rocket surgery to catch these things is it.

If the company is too small to monitor their own pages then I'd expect them not to be worried about this sort of liability (ie knowing of a breach, they're too small to be sued for much, presumably: if they were bigger they'd know about it already).

Post reply on HN