Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A mysterious grey-hat is patching people's outdated MikroTik routers

zdnet.com

Post reply on HN
Print view View original

121–130 of 220 posts

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#121

Post by [deleted] »

herodotus wrote: post #23
AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for…

[deleted]

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#122

Post by commandlinefan »

I remember once, when I had an unpatched computer overrun by hostile viruses that rendered it unusable, wondering if one of the botnet-type viruses that want to take over your computer and use it without being undetected would someday get smart enough to recognize other viruses and automatically remove their competition so that they could continue to silently infect you. Like a biological virus, one that kills the host is an ineffective one - they want to use the hosts resources while not being noticed. I wonder if this is something like that - virus writers starting to get smarter about cleaning up behind them and keeping out competing malware.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#123

Post by Avamander »

NelsonMinar wrote: post #86
deckar01 wrote: post #74

> As for MikroTik, the Latvian company has been one of the most responsive vendors in terms of security flaws, fixing issues within hours or days, compared to the months that some other router vendors tend to take. It would be unfair to blame this situation on them. Patches have been available for months, but, yet again, it is ISPs and home users who are failing to take advantage of them. A system that requires users…

OTOH people would scream bloody murder at a router that installed firmware updates and rebooted itself without asking. Just look at the reaction to how Windows 10 handles updates.

It's time MT got something like unattended upgrades.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#124

Post by zenojevski »

et2o wrote: post #119
jVinc wrote: post #118

Earlier quoted context omitted.

Yes... volunteer work already exists. Suggesting that it could be organized through Trello or Jira doesn't really add any revolutionary element. And many volunteer organisations already have planning solutions.

Why so negative?

This is not at all negative.

Imagine parent telling some underground rebel group that their revolution would be more successful if they organized it with Jira.

Meanwhile, this concern is so far away from the rebels, who are doing just fine with pen and paper, and are more concerned with basic needs like surviving undetected.

People are of course excited by this initiative, and wish to contribute how they know. Except what they have is hammers, and there are no nails to be seen.

It looks like you are helping, but you are only diluting the focus from what's important to what's easy to mindlessly talk about in a forum.

It looks like people are trying to organize how to organize, instead of actually organizing anything. It's like the difference between being a writer and a word processing expert.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#125

Post by cbhl »

noncoml wrote: post #117
Alupis wrote: post #57

Earlier quoted context omitted.

> "I added firewall rules that blocked access to the router from outside the local network," Alexey said. This could very well be what's causing the outrage from operators... suddenly losing connection with your router that's in some data center 3 hours away - requiring a drive-over just to discover it's some dude adding rules to your production equipment would be upsetting. There's legitimate reasons for remote oper…

But still, why would you upset? At the very least this guy has made you aware of a known security hole in your router. Sure, the timing maybe inconvenient, but at least you now know there is a problem you have to attend. Would you rather leave the hold open and be happy in your ignorance if the security problem in your network?

It is trivial to secure a system by powering it off and disconnecting it from the Internet.

That also makes said system useless for getting work done.

Many people do not care about security at all; they just care that it "works". If we want the world to be more secure, the best (but hardest) way to make that happen is to make it cheaper/easier/faster to be secure than to be open (for example, Let's Encrypt).

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#126

Post by astura »

herodotus wrote: post #23
AdmiralAsshat wrote: post #3

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for…

I once got a really good phishing email pretending to be ebay. It included my full legal name and my ebay id. It was some BS threatening to sue me for nonpayment if I didn't paypal them money or some stupid shit like that.

So I forwarded it to spoof@ebay.com with the message "reporting phishing email" or something. Somehow that report got "handled" by a clueless, non-technical, front line rep who thought I thought the email was real and was inquiring about the contents of the email. Pissed me off that the email wasn't handled by the correct department. I won't be bothering to forward any more phishing emails anymore.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#127

Post by HarryHirsch »

LinuxBender wrote: post #84
vbezhenar wrote: post #60

Earlier quoted context omitted.

I've heard that in US you could be shot for trespassing. It might be very dangerous to try fixing it.

Certainly in Texas I would be extra careful. Either way, have someone standing outside to advise the homeowner or cops what is going on. Also call the police ahead of time and tell them what you intend to do. Maybe even ask for an officer to assist.

Better get a friend with a firearm to stand guard at the door if you must take that kind of measure. US police are ill-disciplined, trigger-happy and uninformed about the law.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#128

Post by [deleted] »

commandlinefan wrote: post #122

I remember once, when I had an unpatched computer overrun by hostile viruses that rendered it unusable, wondering if one of the botnet-type viruses that want to take over your computer and use it without being undetected would someday get smart enough to recognize other viruses and automatically remove their competition so that they could continue to silently infect you. Like a biological virus, one that kills the ho…

[deleted]

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#129

Post by tzakrajs »

commandlinefan wrote: post #122

I remember once, when I had an unpatched computer overrun by hostile viruses that rendered it unusable, wondering if one of the botnet-type viruses that want to take over your computer and use it without being undetected would someday get smart enough to recognize other viruses and automatically remove their competition so that they could continue to silently infect you. Like a biological virus, one that kills the ho…

I've heard rumors that nation states will keep infected machines from crashing or attracting attention so that system administrators stay away from their beachhead.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#130

Post by vectorEQ »

commandlinefan wrote: post #122

I remember once, when I had an unpatched computer overrun by hostile viruses that rendered it unusable, wondering if one of the botnet-type viruses that want to take over your computer and use it without being undetected would someday get smart enough to recognize other viruses and automatically remove their competition so that they could continue to silently infect you. Like a biological virus, one that kills the ho…

botnets often uninstall other botnets, and patch vulnerabilities they use to get in, to close the door behind them.
Post reply on HN