A mysterious grey-hat is patching people's outdated MikroTik routers • Hacker News Board

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#111

Post by tony101 » Fri, Oct 12, 2018, 5:15 PM UTC

robocat wrote: post #94

herodotus wrote: post #71

Earlier quoted context omitted.

What I do in my emails is tell them the exact URL of the bad page. All they need to do is look at the file with a text editor (they are admins, after all). Once they have done this, they will see strange Javascript. They will know it has nothing to do with their own (or their clients) web pages. There are no links per se in my email (except the URL, but I leave off the http:).

Don't you worry that if you email spammy/virus-laden links then your email address could get flagged?

I've worked as a security analyst at a company and sometimes I would report phishing pages to the webhost. After a while, I realized that half of my emails were being silently quarantined by the company's outbound spam filters due to the included URLs. I was able to manually release them, but I wonder how many emails will then be flagged on the receiving end.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#112

Post by writimov » Fri, Oct 12, 2018, 5:16 PM UTC

This particular effort seems to be a mix of fun, braggadocio, and altruism. Could this sort of thing be organized with a social network and a list of tasks/problems using a tool like Trello or Jira but for solving any problem? The result would be anyone in the world could help/volunteer to fix real problems with free time. Use: 1) Problem is posted 2) Investigated and confirmed to be real 3) Volunteers start to fix and swap solutions 4) Extra people are recruited as necessary 5) Problem is solved and wrapped up. This could be applied from everything from MongoDB security issues (https://snyk.io/blog/mongodb-hack-and-secure-defaults) to cleaning up neighborhood pollution (http://www.chicagotribune.com/news/local/breaking/ct-chicago...) Thoughts? Does this exist already?

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#113

Post by Bayart » Fri, Oct 12, 2018, 5:19 PM UTC

herodotus wrote: post #23

AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for…

>I do sometimes wonder what the internet has done to once-common human decency and politeness.

Politeness essencially disappears once you can't see somebody's face. 10 minutes in any online game should be proof of concet enough.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#114

Post by taormina » Fri, Oct 12, 2018, 5:23 PM UTC

DATACOMMANDER wrote: post #109

sathackr wrote: post #81

Earlier quoted context omitted.

Vulnerabilities are almost unavoidable. Leaving a management port on a router open to the entire internet is a very bad practice. Would you leave an RDP port open to the world? If you require remote access, at least restrict it to known management IP addresses.

Why is it that vulnerabilities are almost unavoidable? I’m not trying to be a smart-ass; I’m an analyst at an MSP and I’m doing my first pen-test soon. I’m under no illusions that my job title or growing responsibilities make me a security expert (or anywhere near it). Is it because the software stack is just too complex for network programmers to handle? (Not that router OSes are the only pieces of software that hav…

Well, think about the number of abstractions on top of abstractions that make up all software. From the bits on the wire, being translated into binary, to machine, to higher-level languages. Then let's talk about frameworks on top of frameworks. Unless every contributor remembers every specific detail, edge-case, or assumption (and even if they manage to, we're still only human) then any mistake could potentially have disastrous ramifications. As bugs are unavoidable, you're going to have vulnerabilities. Vulnerabilities are just useful bugs.

Now, of course, at least bothering with CYOA is expected in security, but is rarely implemented up to snuff.... But then again, security is a "cost center", no?

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#115

Post by sohex » Fri, Oct 12, 2018, 5:25 PM UTC

herodotus wrote: post #23

AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for…

Generally speaking the standard is to not respond to email reporting malicious activity on a server, just to resolve the issue and carry on, particularly if the report is being read by an admin at a webhosting company. Doesn't mean the notification isn't appreciated!

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#116

Post by sohex » Fri, Oct 12, 2018, 5:28 PM UTC

tony101 wrote: post #111

robocat wrote: post #94

Earlier quoted context omitted.

Don't you worry that if you email spammy/virus-laden links then your email address could get flagged?

I've worked as a security analyst at a company and sometimes I would report phishing pages to the webhost. After a while, I realized that half of my emails were being silently quarantined by the company's outbound spam filters due to the included URLs. I was able to manually release them, but I wonder how many emails will then be flagged on the receiving end.

Typically when sending an email with content like that for a notification you'll "defang" the URL by rendering it like "hXXp:// foo (dot) bar (dot) com" or something along those lines to ensure that it isn't automatically flagged and filtered, though it's also common on the receiving end to apply no spam filters to their abuse@ email as well. You'll usually have better luck sending this information to the abuse email listed in the IP whois than to any contact information at the domain itself.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#117

Post by noncoml » Fri, Oct 12, 2018, 5:30 PM UTC

Alupis wrote: post #57

AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

> "I added firewall rules that blocked access to the router from outside the local network," Alexey said. This could very well be what's causing the outrage from operators... suddenly losing connection with your router that's in some data center 3 hours away - requiring a drive-over just to discover it's some dude adding rules to your production equipment would be upsetting. There's legitimate reasons for remote oper…

But still, why would you upset? At the very least this guy has made you aware of a known security hole in your router. Sure, the timing maybe inconvenient, but at least you now know there is a problem you have to attend.

Would you rather leave the hold open and be happy in your ignorance if the security problem in your network?

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#118

Post by jVinc » Fri, Oct 12, 2018, 5:31 PM UTC

writimov wrote: post #112

This particular effort seems to be a mix of fun, braggadocio, and altruism. Could this sort of thing be organized with a social network and a list of tasks/problems using a tool like Trello or Jira but for solving any problem? The result would be anyone in the world could help/volunteer to fix real problems with free time. Use: 1) Problem is posted 2) Investigated and confirmed to be real 3) Volunteers start to fix a…

Yes... volunteer work already exists. Suggesting that it could be organized through Trello or Jira doesn't really add any revolutionary element. And many volunteer organisations already have planning solutions.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#119

Post by et2o » Fri, Oct 12, 2018, 5:32 PM UTC

jVinc wrote: post #118

writimov wrote: post #112

This particular effort seems to be a mix of fun, braggadocio, and altruism. Could this sort of thing be organized with a social network and a list of tasks/problems using a tool like Trello or Jira but for solving any problem? The result would be anyone in the world could help/volunteer to fix real problems with free time. Use: 1) Problem is posted 2) Investigated and confirmed to be real 3) Volunteers start to fix a…

Yes... volunteer work already exists. Suggesting that it could be organized through Trello or Jira doesn't really add any revolutionary element. And many volunteer organisations already have planning solutions.

Why so negative?

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#120

Post by ocdtrekkie » Fri, Oct 12, 2018, 5:34 PM UTC

writimov wrote: post #112

This particular effort seems to be a mix of fun, braggadocio, and altruism. Could this sort of thing be organized with a social network and a list of tasks/problems using a tool like Trello or Jira but for solving any problem? The result would be anyone in the world could help/volunteer to fix real problems with free time. Use: 1) Problem is posted 2) Investigated and confirmed to be real 3) Volunteers start to fix a…

More often than not, the opportunities for people to help vastly outscales the amount of hours volunteers are able to put up to help. Anyone can clean up trash on the side of the road and it's a no-skill job, so why is it still there? Open source projects everywhere need help, but a lot of them languish unsupported anyways.

Most people likely know countless ways they could help, but the time to do so doesn't match up with the need that's out there.