12 ms·

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were out

>But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

booleandilemma 8y ago
...he’s the grey-hat they deserve, but not the one they need right now...
- uberswe 8y ago
  or the one they need but not the one they deserve :)
ThetaOneOne 8y ago
“I wanted to stay insecure dam it” - Them probably
- chatmasta 8y ago
  Obligatory: https://xkcd.com/1172 https://xkcd.com/1172
michaelbuckbee 8y ago
Security issues are tricky. Often making people aware of an issue is indistinguishable from having caused the issue.
- icelancer 8y ago
  Only if you're technologically-illiterate.
  - presscast 8y ago
    ... which many people are. What's your point?
  - Buge 8y ago
    I've received many phishing emails claiming that my account has been hacked. So that is a case of someone "pointing out an attack" who is actually causing the attack. Even technologically knowledgeable people fall for phishing (I haven't though).
- ReverseCold 8y ago
  Why would you hack someone and then tell them you did it (without asking for ransom or something)? Of course the person telling you has good intentions.
  - michaelbuckbee 8y ago
    Not sure if you're being sarcastic, but there's a whole class of attacks that begin under the guise of "helping" the user. A hilarious and interesting example: https://www.gimletmedia.com/reply-all/long-distance https://www.gimletmedia.com/reply-all/long-distance Additionally: see all the drama and issues that consistently occur surrounding bug bounty payments, secure disclosure of vulnerabilities, etc.
- panic 8y ago
  See also: why many people don't go to the doctor.
Swizec 8y ago
It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.
- enraged_camel 8y ago
  If it's an apartment building, a plumber NEEDS to go inside to fix your sink so that it doesn't flood apartment units under yours. That's why fixing router vulnerabilities is so important: if left unfixed, botnets use them to cause harm to other people.
- thrmsforbfast 8y ago
  I have never found this analogy compelling for two reasons. First, your sink is not part of a botnet (assuming it's not a smartsink, I guess). By leaving your machine unpatched, you are causing harm to others. This makes the ethics of this sort of grey-hat hacking much more murky IMO. I'm willing to concede that the grey-hat behaved unethically, but I also believe that leaving a machine unpatched makes the machine's owner at least somewhat responsible for how that machine is used. Further, I do not think it's reasonable to both claim that this sort of grey-hat activity is unethical and also claim that owners of unpatched devices have absolutely zero responsibility for how their unpatched machines are used. I.e., if we condemn this grey hat (assuming he simply locked to door and left and did nothing else) then we should also condemn the owners of botnet'd devices for the way in which their negligence causes harm to others. If others can't break in and fix your stuff when it starts effecting them, then you should be held at least partially responsible for how your stuff is used by criminals. Second, physical presence can be a privacy intrusion on its own and without any willful intent. E.g., a grey-hat plumber who is purely altruistic might never-the-less accidentally catch a glimpse of you naked. On the other hand, cyber presence almost always requires intentional snooping to cause a privacy violation.
- nkrisc 8y ago
  If your sink was clogged and running and flooding the apartment below you, it would be perfectly reasonable for someone to kick your door down and turn the water off.
herodotus 8y ago
Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for thanks, but I do sometimes wonder what the internet has done to once-common human decency and politeness.
- LurkersWillLurk 8y ago
  > I NEVER received a thank you from any of these people. Is it possible that they (perhaps mistakenly) believe that communicating with you could open them up to civil liability?
  - jdboyd 8y ago
    Or that your email is the actual attack they need to worry about.
    - newsbinator 8y ago
      > I'm a security researcher and I discovered that your server has been compromised. Click this legitimate link to learn more.
      - gcb0 8y ago
        more like "click this legitimate link TO YOUR OWN SERVERS to learn more". Big difference :)
        Drdrdrq 8y ago
        To you. They don't see it.
  - ethbro 8y ago
    > Is it possible that they (perhaps mistakenly) believe that communicating with you could open them up to civil liability? I'm curious, for vulnerability-by-inaction like this, would there be a legal difference if sent emails were posted to a public blockchain? The intent being, if you're later sued for harm caused by your compromised hardware / IoT devices, you cannot claim ignorance as easily. End goal, of course, being that people care more about patching their devices.
Alupis 8y ago
> "I added firewall rules that blocked access to the router from outside the local network," Alexey said. This could very well be what's causing the outrage from operators... suddenly losing connection with your router that's in some data center 3 hours away - requiring a drive-over just to discover it's some dude adding rules to your production equipment would be upsetting. There's legitimate reasons for remote operators to have remote access from outside the network. Obviously the router should be secured with latest updates that guard against known exploits, but this could be a major pain for some operators. (you'd also have to roll back to some backup since there's no telling what else the guy changed, even if you feel he's more-or-less trustworthy... which means more downtime for your customers)
- gtdawg 8y ago
  Also, of course, only allowing remote access from a controlled list of source IP addresses.
- thrmsforbfast 8y ago
  Apparently exactly this happened: https://pikabu.ru/story/vzlom_routeros_5924128 https://pikabu.ru/story/vzlom_routeros_5924128 assuming, at least, that the Google translation is decent: "It seems to be even good, but the admin’s account has severely cut the rights, the attackers created another one with full rights. The office is far away, the provider settings are pppoe, we can’t remove back-ups, we can also unload the config, advise how to be?"
- noncoml 8y ago
  But still, why would you upset? At the very least this guy has made you aware of a known security hole in your router. Sure, the timing maybe inconvenient, but at least you now know there is a problem you have to attend. Would you rather leave the hold open and be happy in your ignorance if the security problem in your network?
  - cbhl 8y ago
    It is trivial to secure a system by powering it off and disconnecting it from the Internet. That also makes said system useless for getting work done. Many people do not care about security at all; they just care that it "works". If we want the world to be more secure, the best (but hardest) way to make that happen is to make it cheaper/easier/faster to be secure than to be open (for example, Let's Encrypt).
jimnotgym 8y ago
Every now and then I let a software company that supplies enterprise software know that their marketing emails are going to spam because their marketing email provider doesn't have an spf record on their domain. They know me personally but still never reply. I told the same company that the certificate had expired in one of their sub-domains. It intrigued me that the first 3 of their tech team didn't know what that meant. Still they never said thank you.
pickleman 8y ago
RIP in peace Adrian Lamo
ry_ry 8y ago
A few months ago I received a random confirmation of my order from one of those fast food ordering aggregator sites, based in a different country that I'd never used. I logged in and reset the password to gibberish and emailed them to let them know what had happened, assuming user error (email was a firstlast@domain, so relatively easy to mess up I guess) A couple of days later I received an email from the company asking for my photo ID. I politely said I wouldn't feel comfortable providing that and advised they get email confirmation from users. I didn't hear back for a couple of weeks and thought nothing more of it. Then a notification that 'my' payment to a fast food place had bounced (or been charged back, it was hard to work out tbh). I figured I'd ignore it because extradition to the states over $36 seemed unlikely. A few days later I get another mail from them replying to my earlier mail about email confirmation and not mentioning the charges. Never heard any more from them. The whole thing was a bit odd, but I can't help but think letting them know early saved us all a whole bunch of hassle, and maybe they'll fix their registration flow.

booleandilemma 8y ago

...he’s the grey-hat they deserve, but not the one they need right now...

uberswe 8y ago
or the one they need but not the one they deserve :)

ThetaOneOne 8y ago

“I wanted to stay insecure dam it” - Them probably

chatmasta 8y ago
Obligatory: https://xkcd.com/1172 https://xkcd.com/1172

michaelbuckbee 8y ago

Security issues are tricky. Often making people aware of an issue is indistinguishable from having caused the issue.

icelancer 8y ago
Only if you're technologically-illiterate.
- presscast 8y ago
  ... which many people are. What's your point?
- Buge 8y ago
  I've received many phishing emails claiming that my account has been hacked. So that is a case of someone "pointing out an attack" who is actually causing the attack. Even technologically knowledgeable people fall for phishing (I haven't though).
ReverseCold 8y ago
Why would you hack someone and then tell them you did it (without asking for ransom or something)? Of course the person telling you has good intentions.
- michaelbuckbee 8y ago
  Not sure if you're being sarcastic, but there's a whole class of attacks that begin under the guise of "helping" the user. A hilarious and interesting example: https://www.gimletmedia.com/reply-all/long-distance https://www.gimletmedia.com/reply-all/long-distance Additionally: see all the drama and issues that consistently occur surrounding bug bounty payments, secure disclosure of vulnerabilities, etc.
panic 8y ago
See also: why many people don't go to the doctor.

Swizec 8y ago

It’s an intrusion. Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind” You didn’t even know your sink was leaky let alone called a plumber.

enraged_camel 8y ago
If it's an apartment building, a plumber NEEDS to go inside to fix your sink so that it doesn't flood apartment units under yours. That's why fixing router vulnerabilities is so important: if left unfixed, botnets use them to cause harm to other people.
thrmsforbfast 8y ago
I have never found this analogy compelling for two reasons. First, your sink is not part of a botnet (assuming it's not a smartsink, I guess). By leaving your machine unpatched, you are causing harm to others. This makes the ethics of this sort of grey-hat hacking much more murky IMO. I'm willing to concede that the grey-hat behaved unethically, but I also believe that leaving a machine unpatched makes the machine's owner at least somewhat responsible for how that machine is used. Further, I do not think it's reasonable to both claim that this sort of grey-hat activity is unethical and also claim that owners of unpatched devices have absolutely zero responsibility for how their unpatched machines are used. I.e., if we condemn this grey hat (assuming he simply locked to door and left and did nothing else) then we should also condemn the owners of botnet'd devices for the way in which their negligence causes harm to others. If others can't break in and fix your stuff when it starts effecting them, then you should be held at least partially responsible for how your stuff is used by criminals. Second, physical presence can be a privacy intrusion on its own and without any willful intent. E.g., a grey-hat plumber who is purely altruistic might never-the-less accidentally catch a glimpse of you naked. On the other hand, cyber presence almost always requires intentional snooping to cause a privacy violation.
nkrisc 8y ago
If your sink was clogged and running and flooding the apartment below you, it would be perfectly reasonable for someone to kick your door down and turn the water off.

herodotus 8y ago

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for thanks, but I do sometimes wonder what the internet has done to once-common human decency and politeness.

LurkersWillLurk 8y ago
> I NEVER received a thank you from any of these people. Is it possible that they (perhaps mistakenly) believe that communicating with you could open them up to civil liability?
- jdboyd 8y ago
  Or that your email is the actual attack they need to worry about.
  - newsbinator 8y ago
    > I'm a security researcher and I discovered that your server has been compromised. Click this legitimate link to learn more.
    - gcb0 8y ago
      more like "click this legitimate link TO YOUR OWN SERVERS to learn more". Big difference :)
      - Drdrdrq 8y ago
        To you. They don't see it.
- ethbro 8y ago
  > Is it possible that they (perhaps mistakenly) believe that communicating with you could open them up to civil liability? I'm curious, for vulnerability-by-inaction like this, would there be a legal difference if sent emails were posted to a public blockchain? The intent being, if you're later sued for harm caused by your compromised hardware / IoT devices, you cannot claim ignorance as easily. End goal, of course, being that people care more about patching their devices.

Alupis 8y ago

> "I added firewall rules that blocked access to the router from outside the local network," Alexey said. This could very well be what's causing the outrage from operators... suddenly losing connection with your router that's in some data center 3 hours away - requiring a drive-over just to discover it's some dude adding rules to your production equipment would be upsetting. There's legitimate reasons for remote operators to have remote access from outside the network. Obviously the router should be secured with latest updates that guard against known exploits, but this could be a major pain for some operators. (you'd also have to roll back to some backup since there's no telling what else the guy changed, even if you feel he's more-or-less trustworthy... which means more downtime for your customers)

gtdawg 8y ago
Also, of course, only allowing remote access from a controlled list of source IP addresses.
thrmsforbfast 8y ago
Apparently exactly this happened: https://pikabu.ru/story/vzlom_routeros_5924128 https://pikabu.ru/story/vzlom_routeros_5924128 assuming, at least, that the Google translation is decent: "It seems to be even good, but the admin’s account has severely cut the rights, the attackers created another one with full rights. The office is far away, the provider settings are pppoe, we can’t remove back-ups, we can also unload the config, advise how to be?"
noncoml 8y ago
But still, why would you upset? At the very least this guy has made you aware of a known security hole in your router. Sure, the timing maybe inconvenient, but at least you now know there is a problem you have to attend. Would you rather leave the hold open and be happy in your ignorance if the security problem in your network?
- cbhl 8y ago
  It is trivial to secure a system by powering it off and disconnecting it from the Internet. That also makes said system useless for getting work done. Many people do not care about security at all; they just care that it "works". If we want the world to be more secure, the best (but hardest) way to make that happen is to make it cheaper/easier/faster to be secure than to be open (for example, Let's Encrypt).

jimnotgym 8y ago

Every now and then I let a software company that supplies enterprise software know that their marketing emails are going to spam because their marketing email provider doesn't have an spf record on their domain. They know me personally but still never reply. I told the same company that the certificate had expired in one of their sub-domains. It intrigued me that the first 3 of their tech team didn't know what that meant. Still they never said thank you.

pickleman 8y ago

RIP in peace Adrian Lamo

ry_ry 8y ago

A few months ago I received a random confirmation of my order from one of those fast food ordering aggregator sites, based in a different country that I'd never used. I logged in and reset the password to gibberish and emailed them to let them know what had happened, assuming user error (email was a firstlast@domain, so relatively easy to mess up I guess) A couple of days later I received an email from the company asking for my photo ID. I politely said I wouldn't feel comfortable providing that and advised they get email confirmation from users. I didn't hear back for a couple of weeks and thought nothing more of it. Then a notification that 'my' payment to a fast food place had bounced (or been charged back, it was hard to work out tbh). I figured I'd ignore it because extradition to the states over $36 seemed unlikely. A few days later I get another mail from them replying to my earlier mail about email confirmation and not mentioning the charges. Never heard any more from them. The whole thing was a bit odd, but I can't help but think letting them know early saved us all a whole bunch of hassle, and maybe they'll fix their registration flow.