18 ms·
A mysterious grey-hat is patching people's outdated MikroTik routers
- ccnafr 8y agoThe very last paragraph kinda makes me feel bad for MikroTik, but I'd like them to add an auto-update feature to their routers. Probably fix all these issues.
- AdmiralAsshat 8y agoAn "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. A better solution would be automatically checking for updates, and then sending an e-mail notification to the address associated with the router's owner/sys admin. I "registered" my router and email address with Netgear about a year ago and I was shocked a few months ago when they actually sent me an e-mail to let me know that a new firmware update was available for my router.
- Klathmon 8y agoI don't think automatic updates would be as disruptive as you think. And having the ability to disable them and apply updates manually, combined with some forewarning like you are talking about (an email that says your router will restart tomorrow at 3am unless you do it sooner), would go a really long way.
- aequitas 8y agoDon't forget that a lot of the customer base for Mikrotik is in remote locations (ie: P2P connections in rural areas) or small ISPs. Having the router in your office die on you (even during office hours) is a little different than all your customers call you the same day their only internet connection is gone.
- icebraining 8y agoISPs would just have to disable it before installing the router. Still seems like a good default.
- ip26 8y agoI used to be a customer of a remote WISP, P2P in a rural area. I can't speak for all WISP's, but we only had service about 12 hours a day, less if it was raining. Five minutes to reboot a router would have been invisible.
- thejrk_ 8y agoI used to contract with a WISP. I would regularly get calls to "reboot the router" from the owner. The "router" was a fiber switch at their CO. I would just do it when they asked. I wasn't a customer nor did I get paid enough to fix their network. Sorry if that was your connection. :)
- Alupis 8y agoA lot of Mikrotik's are installed at WISP's and other ISP's... making unplanned reboots very disruptive. Those of us using them on our corporate networks might be inconvenienced by a temporary outage, but that's unlikely at 3am... however, scheduling and doing these manually is still the best way for enterprise gear.
- lostapathy 8y agoI doubt that most ISPs who can't be bothered to apply security updates are going to notice a 5 minute reboot. Split the difference - email the user that an update will apply on $date unless they do it first, or if they delay it (and don't let them delay it indefinitely).
- Alupis 8y agoYou can already script something like this into RouterOS (Mikrotik's OS).
- lostapathy 8y agoGood - they should make it the default!
- 394549 8y ago> An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM. Maybe the the trigger for the automatic reboot could be more complicated than just a time-based trigger. Something like Reboot when localtime > 2AM & localtime < 5AM & traffic averaged over the last 5 min < 5kbs Basically reboot unless the router detects the network is being used actively.
- macintux 8y agoOf course, if you're on vacation and relying on that router to be available for security cameras, an automatic firmware update that results in a bricked router can be more than a little disruptive.
- 394549 8y agoIt's a tradeoff. You have to balance that negative against the negative of having botnets of millions of never-patched routers. Automatic updates should be the default, but you should be able to shut them off if you want to make a different tradeoff.
- TeMPOraL 8y agoAutomatic security updates should be the default, all other updates should absolutely not. In case of patching routers there isn't much crapware to be upsold, but in general, if we're ever going to develop some code of ethics in this industry, I wish a part of it would be a rule of hard separation between security patches and feature updates, and another rule that the latter should never be done automatically without explicit opt-in. Yes, it's extra work for developers, but the result of not doing that is the present situation - a lot of users, including a surprisingly large population of non-tech-savvy people, will go out of their way to shut down automatic updates, to avoid having to deal with broken workflows, upselling, ads sneaking in, and forced reboots in the middle of a business presentation or a game (or a surgery).
- 8y ago
- Tae3cahN 8y agoYou would only need to reboot if the kernel got updated. Otherwise just restart the affected services. And kernel updates can be made faster with kexec so you don't have to reinitialize the hardware. The flashing procedure itself could also be made interruption-free with dual flash, which most sytems have anyway to avoid bricking the system. It would take some effort to make it fast, but I think the update interruption could be brought down to the second-range. You'd still lose NAT state but that would only affect long-lasting sessions like SSH.
- deleted 8y ago[deleted]
- duxup 8y agoIf they thought their consumer users would just go out of their way to update their routers .... that's just not understanding how humans work.
- deleted 8y ago[deleted]
- 24gttghh 8y agoI have this functionality scripted for my mikrotik routers, and it emails me when it's updating.
- r1ch 8y agoUnfortunately Mikrotik updates tend to change a lot of things and potentially cause issues. Recently the whole bridge implementation was rewritten which required config changes if you had anything beyond the basic bridge/port setup. And the last "stable" update was bricking certain models by making them unbootable. If they were applied automatically then there would be lots of broken routers...
- sathackr 8y agoYep. They have serious regression issues. Sometimes things that are fixed get broken again, and updates often break other things. Other vendors have similar issues, so it's not just a Mikrotik problem, but while with other vendors it's uncommon, I almost expect it from Mikrotik.
- AdmiralAsshat 8y ago>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.
- booleandilemma 8y ago...he’s the grey-hat they deserve, but not the one they need right now...
- uberswe 8y agoor the one they need but not the one they deserve :)
- ThetaOneOne 8y ago“I wanted to stay insecure dam it” - Them probably
- chatmasta 8y agoObligatory: https://xkcd.com/1172 https://xkcd.com/1172
- michaelbuckbee 8y agoSecurity issues are tricky. Often making people aware of an issue is indistinguishable from having caused the issue.
- philamonster 8y agoDevices at vulnerable routerOS version and not already compromised would not be vulnerable if the firewall was enabled. It's that simple. Not great that these boxes used to ship in this default state and I can _understand_ a home user unfamiliar with what they're dealing with but what reason is there for deploying infrastructure this way at an ISP or hospital or whatever org?
- r1ch 8y agoI think there's still a lot of blame on Mikrotik for having such bugs in their management service and other daemons. I explicitly opened up the winbox port to be able to remotely manage Mikrotik routers I deploy (I considered their VPN implementations to be an even higher attack surface), as did many other admins it seems. The winbox protocol supposedly runs over TLS and requires a username/password before anything is possible so I thought it should be safe enough, but through this bug anyone can download any file with no authentication (and the user db was storing passwords in plaintext which certainly didn't help)! The web server vulnerability, sshd vulnerability, the smbd vulnerability - all are their fault. Had they used standard, well-tested open source packages there would be no problems, but they had to write their own custom implementations of these protocols for "reasons". I hate to think how many remotely exploitable bugs are lurking in their ipsec implementation.
- sathackr 8y agoVulnerabilities are almost unavoidable. Leaving a management port on a router open to the entire internet is a very bad practice. Would you leave an RDP port open to the world? If you require remote access, at least restrict it to known management IP addresses.
- DATACOMMANDER 8y agoWhy is it that vulnerabilities are almost unavoidable? I’m not trying to be a smart-ass; I’m an analyst at an MSP and I’m doing my first pen-test soon. I’m under no illusions that my job title or growing responsibilities make me a security expert (or anywhere near it). Is it because the software stack is just too complex for network programmers to handle? (Not that router OSes are the only pieces of software that have vulnerabilities; and I imagine that you’d say that vulnerabilities are almost unavoidable in general.)
- Fuxy 8y agoIs anyone really surprised by this in today's outrage culture where everyone is offended by everything?
- FranOntanaya 8y agoYou seem to be outraged about culture itself.
- Fuxy 8y agoNot really i'm just trying to give some helpful criticism however I lost hope in humanity a long time ago... I'm just watching it burn with popcorn in hand. Maybe add some more fuel to the fire in the form of sarcasm that everyone doesn't even realise is sarcasm... sigh...
- dang 8y agoCould you please not post unsubstantive comments to HN?
- Frondo 8y agoIt's not a matter of being offended if you just want some gray-hat to mind his own business.
- dang 8y agoWe detached this subthread from https://news.ycombinator.com/item?id=18201572 https://news.ycombinator.com/item?id=18201572 and marked it off-topic.
- Snawoot 8y agoOriginal post from Alexey at habr.com (russian IT community): https://habr.com/post/424433/ https://habr.com/post/424433/
- ryandrake 8y agoIf only ISPs would start disconnecting negligent customers who continue to use exploited or vulnerable equipment. The incentives are not right. If they did, they’d risk losing a paying customer, if they don’t, nothing bad really happens to them. I hate suggesting regulations and fines but it’s the only thing end users and ISPs will respond to.
- samat 8y agoMost of this devices are provided by ISPs so it's they who are negligent. :)
- deckar01 8y ago> As for MikroTik, the Latvian company has been one of the most responsive vendors in terms of security flaws, fixing issues within hours or days, compared to the months that some other router vendors tend to take. It would be unfair to blame this situation on them. Patches have been available for months, but, yet again, it is ISPs and home users who are failing to take advantage of them. A system that requires users to opt in to security is not a secure system.
- NelsonMinar 8y agoOTOH people would scream bloody murder at a router that installed firmware updates and rebooted itself without asking. Just look at the reaction to how Windows 10 handles updates.
- Avamander 8y agoIt's time MT got something like unattended upgrades.
- isostatic 8y agoIt's trivial to script on a mikrotik. Arguably it should be in the default config - most people who know what they're doing will start with a blank slate anyway (system reset configuration nodefaults)
- deckar01 8y agoOne PC operating system's poor implementation of automatic updates does not mean automatic updates can't be implemented gracefully on a router.
- jessaustin 8y agoIt takes effort to purchase, install, and configure MikroTik products rather than just using the router/AP combo you got from your ISP. Anyone who has done that is capable of patching occasionally. [EDIT:] And actually now that I've read TFA I learn that many of these are actually "edge" routers used by ISPs on their own premises. There's no excuse for an ISP not to keep up with patches.
- paulie_a 8y agoJust start bricking them. It's a public service to the internet as a whole.
- ratsimihah 8y agoPatch me daddy
- Krasnol 8y agoI had one once and I can recommend the "MikroTik Security Guide" by Tyler Hart. It's quite an easy step by step guide.
- some1else 8y agoSome black hats also patch the systems they compromise. Depends on the purpose.
- electricwater 8y agoThis is hollywood material.
- mathieubordere 8y agoHats off to this guy.
- writimov 8y agoThis particular effort seems to be a mix of fun, braggadocio, and altruism. Could this sort of thing be organized with a social network and a list of tasks/problems using a tool like Trello or Jira but for solving any problem? The result would be anyone in the world could help/volunteer to fix real problems with free time. Use: 1) Problem is posted 2) Investigated and confirmed to be real 3) Volunteers start to fix and swap solutions 4) Extra people are recruited as necessary 5) Problem is solved and wrapped up. This could be applied from everything from MongoDB security issues (https://snyk.io/blog/mongodb-hack-and-secure-defaults https://snyk.io/blog/mongodb-hack-and-secure-defaults) to cleaning up neighborhood pollution (http://www.chicagotribune.com/news/local/breaking/ct-chicago-air-quality-testing-met-20171111-story.html http://www.chicagotribune.com/news/local/breaking/ct-chicago...) Thoughts? Does this exist already?
- jVinc 8y agoYes... volunteer work already exists. Suggesting that it could be organized through Trello or Jira doesn't really add any revolutionary element. And many volunteer organisations already have planning solutions.
- et2o 8y agoWhy so negative?
- zenojevski 8y agoThis is not at all negative. Imagine parent telling some underground rebel group that their revolution would be more successful if they organized it with Jira. Meanwhile, this concern is so far away from the rebels, who are doing just fine with pen and paper, and are more concerned with basic needs like surviving undetected. People are of course excited by this initiative, and wish to contribute how they know. Except what they have is hammers, and there are no nails to be seen. It looks like you are helping, but you are only diluting the focus from what's important to what's easy to mindlessly talk about in a forum. It looks like people are trying to organize how to organize, instead of actually organizing anything. It's like the difference between being a writer and a word processing expert.
- commandlinefan 8y agoI remember once, when I had an unpatched computer overrun by hostile viruses that rendered it unusable, wondering if one of the botnet-type viruses that want to take over your computer and use it without being undetected would someday get smart enough to recognize other viruses and automatically remove their competition so that they could continue to silently infect you. Like a biological virus, one that kills the host is an ineffective one - they want to use the hosts resources while not being noticed. I wonder if this is something like that - virus writers starting to get smarter about cleaning up behind them and keeping out competing malware.
- deleted 8y ago[deleted]
- tzakrajs 8y agoI've heard rumors that nation states will keep infected machines from crashing or attracting attention so that system administrators stay away from their beachhead.
- vectorEQ 8y agobotnets often uninstall other botnets, and patch vulnerabilities they use to get in, to close the door behind them.
- iodiniemetra 8y agoThis has been happening for years, especially in the "botnet community". Either someone takes down someone else's botnet through the same bug and patches it or figures out a bug in the botnet and caps it for themselves (for example, getting ops in the CNC channel). I think Microsoft has even done in cooperation this a few times; it's dubious legal territory. You can see some historical examples, both recent (Mirai had some viruses that went around closing the bug), as well as further in the past (there's one that escapes me, it must have been around 2010?) I wish I could cite more, I'm going to spend some time researching this and make a list for myself, it's surprisingly interesting!
- drewmol 8y agoAnd of course they did, frustratingly that behavior is industry standard even outside of malware.
- madrox 8y agoReminds me of a black hat I knew in the 90s. He bragged that if he ever gained access to a system, he'd start patching vulnerabilities so others wouldn't gain access and make it obvious the machine had been compromised.
- Ensorceled 8y agoI can attest that there was at least one such black hat in the 00's. One of my IT guy's mom complained about her machine being slow and having "too many pop ups", so he planned to go to her place on the weekend and fix it. She called back a couple of days later and told him not to bother as it was "all fixed now". o.O I lent him one of our loaner laptops and he brought in her computer back and put it on our test DMZ to see what was up. Yep, somebody had scrubbed all the malware and "search bars" off the machine and installed a free anti-virus package. The exceptions on the anti-virus made it easy to track down what was happening; it was set to send spam every night between 1am and 7am but otherwise was pristine. My colleague had to do some serious soul searching before he decided to wipe it instead of just returning it ...
- tenpo 8y agoNot sure what they mean by "mysterious". He isn't hiding and never was. He posted his photo, name and other personal details in articles about MikroTik on Russian IT blogging platform[1]. His name is Alexey Sopov, 34, from Novosibirsk. Quick search revealed his social network accounts: https://fb.com/100005153643926 https://fb.com/100005153643926 https://vk.com/lmonoceros https://vk.com/lmonoceros [1] https://habr.com/post/353530/ https://habr.com/post/353530/
- netsec_burn 8y agoClickbait?
- ccnafr 8y agoProbably the journalist didn't want to get this guy in trouble for doxxing him. I'm pretty sure the FBI would love to arrest him by now. Just like MalwareTech.
- wjp3 8y agoBack in college (early 90's) I would run ToneLoc overnight, and wake up to view the results. One time I had a hit, and I ftp'ed into some server on Mindspring's customer IP range. A quick look at the system told me the root account had no password set. So I tried a telnet and wham - I was in. A 'who' showed someone else was logged in. So I sent a broadcast message to them saying they need to secure their system better, and logged out. I had the habit of using an obscure hotmail email to log into FTP servers, and had done that here. I was surprised to see an email from the owner - wanting to know how I found his system, etc. He was nice, but I didn't reply.
- iforgotpassword 8y ago> He was nice, but I didn't reply. Noooooo. Story started off well and then you tree fiddied me!
- spappal 8y agoThis reminded me of last years "BrickerBot" malware [0] by grey-hat The Janit0r / The Doctor who bricked IoT devices with the stated purpose of preventing the same devices from being hacked by botnet-malware, which allegedly puts the whole internet at risk. [0] https://www.bleepingcomputer.com/news/security/brickerbot-author-retires-claiming-to-have-bricked-over-10-million-iot-devices/ https://www.bleepingcomputer.com/news/security/brickerbot-au...
- anonnel 8y agoNormally HN is not a place for memes, but I feel this is appropriate https://m.imgur.com/JxH0lUT?r https://m.imgur.com/JxH0lUT?r
- ristic 8y agoWould have been nice if he got around to the router at our office, we got cryptojacked: https://imgur.com/a/Q7Pmxth https://imgur.com/a/Q7Pmxth