Live data from Hacker News

A mysterious grey-hat is patching people's outdated MikroTik routers

zdnet.com

201–210 of 220 posts

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#201

Earlier quoted context omitted.

OTOH people would scream bloody murder at a router that installed firmware updates and rebooted itself without asking. Just look at the reaction to how Windows 10 handles updates.

It's time MT got something like unattended upgrades.

It's trivial to script on a mikrotik. Arguably it should be in the default config - most people who know what they're doing will start with a blank slate anyway (system reset configuration nodefaults)

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#202
post #126

Earlier quoted context omitted.

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for…

I once got a really good phishing email pretending to be ebay. It included my full legal name and my ebay id. It was some BS threatening to sue me for nonpayment if I didn't paypal them money or some stupid shit like that. So I forwarded it to spoof@ebay.com with the message "reporting phishing email" or something. Somehow that report got "handled" by a clueless, non-technical, front line rep who thought I thought th…

I think you should have used abuse@ebay.com

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#203
post #175

Earlier quoted context omitted.

>with the authority and means to shut down domains for exactly this How do you get that authority to do that? What does "shut down" entail? Does that mean you can unregister or hijack domains? I'd like to know more about this, as well as the accountability process and where I can report abusive behavior that will actually get addressed.

Work for a registry with many TLDs. Shut down is removing NS records from the TLD zone. And yes, you can generally report this type of thing to a registry of a TLD. We often act quicker than many registrars, in my experience(though it depends on a TLDs owner/policies...some are much better wrt malicious activity than others).

I used to work downstream from groups like yours. In the data center, we would receive abuse reports and investigate. Look for 100% CPU use, or wide-open ports, or just visit the server on port 80 and see the phishing page. Then pull the nic and email the technical and administrative contacts.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#204

This particular effort seems to be a mix of fun, braggadocio, and altruism. Could this sort of thing be organized with a social network and a list of tasks/problems using a tool like Trello or Jira but for solving any problem? The result would be anyone in the world could help/volunteer to fix real problems with free time. Use: 1) Problem is posted 2) Investigated and confirmed to be real 3) Volunteers start to fix a…

More often than not, the opportunities for people to help vastly outscales the amount of hours volunteers are able to put up to help. Anyone can clean up trash on the side of the road and it's a no-skill job, so why is it still there? Open source projects everywhere need help, but a lot of them languish unsupported anyways. Most people likely know countless ways they could help, but the time to do so doesn't match up…

This is the question I was really getting at: where is the site where I can go help beyond the ways that most people already know about? Where I can I volunteer my services to fix a posted problem with MikroTik routers being insecure? Where is the site with a giant list of problems and descriptions of the people needed to solve them? And matching algorithms to put the two together?

More to the point: where can someone who has a totally unique skillset help solve a specific problem?

The assumption I'm making (which may be faulty) is that everyone has a unique and valuable skillset that may only apply to specific problems. (Like for example, I know nothing about B list celebrities from 1950s Hollywood. But if someone had a problem to solve that involved knowledge of that period, they could post the problem and match it to a profile of a Movie professor, or just a regular person who happens to know alot about that subject. The technical complexities of proving someone knows what they are talking about and their authority can be trusted, basically filtering spam contributions, is the biggest technical challenge. But it seems like new tools like machine learning and neural nets could help us here.)

We all know we can help do basic low-skilled stuff: donate money, volunteer at homeless shelter, build houses habitat for humanity, volunteer at local garden, trash cleanup etc.

What website do I go to that collects all of these ways to help and more?

For ex, what website do I go to for helping in these scenarios:

1) I understand politics and want to work on bills in various countries to stop climate change?

2) I understand biology and want to cure the algae bloom I saw in my local lake yesterday?

3) I understand the physics of mechanical design and want to help fix a design flaw in a pair of garden shears that keeps cutting my skin between my thumb and first finger?

Or approach it the other way around: what site can I go to, register my interests and skills and get assigned to existing projects that will change the world? Where I can help anytime I have free time. Or get an assignment in my email?

Scenarios:

1) I sign up on the site saying I have a biology degree and live in Napa Valley, CA and can do environmental stuff. I get assigned to take Cesium 137 readings to followup on the Fukushima disaster in wine country at various GPS coordinates and get sent a geiger counter, instructions, and training.

2) I have Crohns disease but am willing to wear a data collection monitor on my body and send the data to multiple companies developing new medicines or treatments.

3) I care about elephants and can volunteer to take a shift watching through the eyes of an automated drone that scans for poachers on the other side of the planet?

There are plenty of ways to do basic help in a semi-organized manner to treat the symptoms of chronic human problems. There is no site that I've seen where solving the largest problems of humanity can be crowdsourced.

Where I can I volunteer my services to help design water desalinization plants to make them 100X cheaper?

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#206
post #62

Earlier quoted context omitted.

You seem to be outraged about culture itself.

Not really i'm just trying to give some helpful criticism however I lost hope in humanity a long time ago... I'm just watching it burn with popcorn in hand. Maybe add some more fuel to the fire in the form of sarcasm that everyone doesn't even realise is sarcasm... sigh...

Could you please not post unsubstantive comments to HN?

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#207

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for…

> I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people.

Out of curiosity, do you receive answers at all?

If not, there could be a technical reason rather than the decline of human decency: your including the link to the phishing page gets the message filtered away by automated security software.

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#208

Earlier quoted context omitted.

Security issues are tricky. Often making people aware of an issue is indistinguishable from having caused the issue.

Only if you're technologically-illiterate.

I've received many phishing emails claiming that my account has been hacked. So that is a case of someone "pointing out an attack" who is actually causing the attack. Even technologically knowledgeable people fall for phishing (I haven't though).

Re: A mysterious grey-hat is patching people's outdated MikroTik routers

#210

Earlier quoted context omitted.

I'm currently dealing with this from jetigroup.?rg. The registry information is invalid, the contact emails I found for the guy who ran the company at one time bounce back, but a weak password on a mailman install let someone create a distribution list that allows every recipient to post. They broke the unsubscribe part of the script, so nobody can get off the list. Until I made a rule to kill all mail from the domai…

domainabuse@tucows.com, apac-domain.manager@endurance.com, ipadmin@websitewelcome.com, qkhldjwp@whoisprivacyprotect.com, ipadmin@publicdomainregistry.com, abuse@publicdomainregistry.com, cpanel@webhostbox.net

Thanks. I've already emailed most of these, but will try the others.
Post reply on HN