Slashdot Mirror
A Mysterious Grey-Hat Is Patching People's Outdated MikroTik Routers (zdnet.com)
An anonymous reader quotes a report from ZDNet: A Russian-speaking grey-hat hacker is breaking into people's MikroTik routers and patching devices so they can't be abused by cryptojackers, botnet herders, or other cyber-criminals, ZDNet has learned. The hacker, who goes by the name of Alexey and says he works as a server administrator, claims to have disinfected over 100,000 MikroTik routers already. "I added firewall rules that blocked access to the router from outside the local network," Alexey said. "In the comments, I wrote information about the vulnerability and left the address of the @router_os Telegram channel, where it was possible for them to ask questions." But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. The vigilante server administrator says he's been only fixing routers that have not been patched by their owners against a MikroTik vulnerability that came to light in late April.
..but the sysadmin they deserve?
Regardless, I approve of this. Bravo, Sir.
Did MicroTik even sell that many routers? Really?
they were smart enough to login and see the note but the router was still unpatched? maybe that was the bad guys?
nothing to see here - move along
When people can't admit they were morons. They are the ones who ran unsecured hardware and didn't bother patching it. They should be thanking him, he may have prevented many actual scumbags from exploiting their hardware.
The Hero we need, but do not deserve
My Aurora : http://www.youtube.com/watch?v=o91ZsGwJYyg
FB : https://www.facebook.com/TanveersPhotography
I'll say it plainly, if you do not maintain your devices then anyone should be free to brick them. The obvious argument is "but it's not yours!" but this disregards that like an unvaccinated child, it puts everyone else at risk. The only alternative to this is to hack the devices so that they permanently DoS the manufacturer and sellers of the device. The situation will not improve until companies are forced to make devices secure.
Anons need not reply. Questions end with a question mark.
... to consider:
Let's say it takes 30 minutes (being very, very generous here) to do the patch, post the blurb and stuff. Appreciate I'm ignoring the time it takes to locate these puppies.
100,000 routers X 30 minutes = 3,000,000 router-minutes ÷ 60 = 50,000 router-hours ÷ 24 = 2,083 router-days ÷ 365.25 = 5.7 router-years.
It little behooves the best of us to comment on the rest of us.
In other news, beauhd still not leet.
Can the updates run without reboot?
That is the one part of why they don't get updated the down time.
Like if you were "renting/leasing" your router from your ISP and they bricked it as a "favor" for you,
If you bought your own router:
1) Disable remote access
2) Change all the "passwords" you can. Extra points if you can change the admin account to something other than admin.
3) Get the most recent update from the vendor and apply ir to your device. Repeat step 1 and 2.
4) Create some local firewall rules, make sure nothing in your network is in an Internet reachable DMZ.
... insensitive clod!
...to make a router that was secure against any realistic attack and still offer better throughput than anything being sold today. Reason you don't get that? It costs a little more and has to be modular, not single board.
People prefer cheap and nasty to quality, every time.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
This is the Right Thing To Do! So many times the Goody Two-Shoes so called "white hats" take out the botnets but rather that do this and patch the hacked machines, they just try to disable the current botnet. And surprise, surprise within a few months all the hacked machines are back in a new botnet, more fault tolerant botnet.
It's almost like these researchers realize that doing what this unsung hero did would hurt there job security. We should all celebrate this Russian hero. We need more like him.
the terrorists screw up the system by fixing things so they work better.
Some drink at the fountain of knowledge. Others just gargle.
I read the article but there was no mention of what the angry replies said... I'd be really curious to find out in what way they were angry, instead of just saying "thanks, but don't do it again".
It seems like maybe there should be something like statute of limitations, where if an exploit was older than a certain amount it was legal for others to patch it even if it broke systems.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
By your own logic, it would be OK to kill the children of those that refuse to vaccinate their children.
Somehow, this doesn't sound all that logical or legal, does it?
This this presumptuous fucktard, and those that support him such as yourself, are performing and advocating criminal activity. Not OK, Shitlord.
You know what's so elegant about this little game, Jake? ... ... because they think they are him.
Nobody knows where the enemy is.
They don't even know he exists.
He's in every...one of their heads.
And they trust him
If you try to destroy him to save them, ...
they'll destroy you to save him.
It's beautiful, man.
You have to admire the opponent's elegance.
[moves chess piece]
Check.
In the end, you've had your router hacked - and it probably needs to be reset (or tossed and upgraded).
So what if the hacker's trying to do the right thing. Would anyone smart trust a random stranger out there "fixing" your router without consent? Wouldn't a black hat just say the same thing - "Fixed your router for you. And oh yeah... you're welcome!" - and slip something malicious in?
The dude is only accomplishing one thing: Getting even with lazy router owners to help other less lazy owners out. Misguided vigilantism.
No good deed goes unpunished, pretty much every time.
When you do the RIGHT thing, you CAN'T be WRONG https://it.slashdot.org/commen...
* ... & I'm NOT WRONG about that!
APK
P.S.=> You make a strong point on the "job security" thing you noted - who do you THINK makes the viruses/malwares/botnets? Non-technical users?? No way. It's "geeks gone bad" CREATING "JOB SECURITY" for themselves (as well as more 'side-money' albeit via thievery hurting others) - it's sad & it's wrong but it is HAPPENING & always has been... apk
You make an analogy between physical devices and internet devices. Your analogy is dead wrong. Here is why:
An internet-connect device has potentially billions of attackers. Billions. Literally anyone, anywhere on the planet, any time. To contrast, someone has to show up to your door, car, phone.
Furthermore, hacking internet devices can be automated, so ONE attacker can potentially attack ALL the devices on the internet that share that vulnerability.
So your RISK on your internet connected device so far exceeds your risk of any of your physical devices that to make an analogy between the two is nonsensical.
Last, your unsecured devices presents a RISK to everyone else on the network: you get hacked and now your device is an offensive tool being used against others. This is not at ALL like your door lock.
So please, never, ever use the analogies you used again.
That said, I don't advocate bricking devices. I would rather that people acting in defense install patches or disable the device in a reversible way. And I would rather see manufacturers FORCED by laws to provide security for their devices commensurate with the risks they face as internet devices!
--PeterM