Slashdot Mirror

← Back to Stories (view on slashdot.org)

A Mysterious Grey-Hat Is Patching People's Outdated MikroTik Routers (zdnet.com)

Posted by BeauHD on from the just-trying-to-help dept.

An anonymous reader quotes a report from ZDNet: A Russian-speaking grey-hat hacker is breaking into people's MikroTik routers and patching devices so they can't be abused by cryptojackers, botnet herders, or other cyber-criminals, ZDNet has learned. The hacker, who goes by the name of Alexey and says he works as a server administrator, claims to have disinfected over 100,000 MikroTik routers already. "I added firewall rules that blocked access to the router from outside the local network," Alexey said. "In the comments, I wrote information about the vulnerability and left the address of the @router_os Telegram channel, where it was possible for them to ask questions." But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. The vigilante server administrator says he's been only fixing routers that have not been patched by their owners against a MikroTik vulnerability that came to light in late April.

5 of 74 comments (clear)

  1. outraged...but patched by ole_timer · · Score: 1, Interesting

    they were smart enough to login and see the note but the router was still unpatched? maybe that was the bad guys?

    --
    nothing to see here - move along
  2. Should have gotten Janit0r. by Gravis+Zero · · Score: 2, Interesting

    I'll say it plainly, if you do not maintain your devices then anyone should be free to brick them. The obvious argument is "but it's not yours!" but this disregards that like an unvaccinated child, it puts everyone else at risk. The only alternative to this is to hack the devices so that they permanently DoS the manufacturer and sellers of the device. The situation will not improve until companies are forced to make devices secure.

    --
    Anons need not reply. Questions end with a question mark.
  3. Really curious what the angry ones said by SuperKendall · · Score: 3, Interesting

    I read the article but there was no mention of what the angry replies said... I'd be really curious to find out in what way they were angry, instead of just saying "thanks, but don't do it again".

    It seems like maybe there should be something like statute of limitations, where if an exploit was older than a certain amount it was legal for others to patch it even if it broke systems.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:Really curious what the angry ones said by Mistlefoot · · Score: 4, Interesting

      They were angry because they were administering networks remotely and all of a sudden were not able to as their access was disabled as well.

      Imagine you are an incompetent IT doing work remotely and you can't access it anymore. So you have your client login locally to enable that feature again and they read that message to you. Now your client knows you are incompetent too. And then when the client refuses to enable access from outside the network you actually have to leave your desk to do the work. Or find a new customer as you have now been replaced.

  4. Re:Ah yes, outraged... by TheReaperD · · Score: 3, Interesting

    I remember once that I switched a bad security setting with the intention of switching it right back. Well, I forgot to switch it back. Thankfully a guy from 4chan hacked my system and left me a note to fix it without doing any damage. Left him a thank you note. If you're bitching about this, you're an ungrateful asshole.

    --
    "Be particularly skeptical when presented with evidence confirming what you already believe." -