A mysterious grey-hat is patching people's outdated MikroTik routers

https://www.zdnet.com/article/a-mysterious-grey-hat-is-patching-peoples-outdated-mikrotik-routers/

by wglb • 8 years ago

397 205 8 years ago

ccnafr2• 8 years ago

The very last paragraph kinda makes me feel bad for MikroTik, but I'd like them to add an auto-update feature to their routers. Probably fix all these issues.

AdmiralAsshat2• 8 years ago

An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM.

A better solution would be automatically checking for updates, and then sending an e-mail notification to the address associated with the router's owner/sys admin.

I "registered" my router and email address with Netgear about a year ago and I was shocked a few months ago when they actually sent me an e-mail to let me know that a new firmware update was available for my router.

Klathmon• 8 years ago

I don't think automatic updates would be as disruptive as you think.

And having the ability to disable them and apply updates manually, combined with some forewarning like you are talking about (an email that says your router will restart tomorrow at 3am unless you do it sooner), would go a really long way.

3945493• 8 years ago

An "automatic" update that would potentially cause the router to reboot and bring down the network would go over very poorly with customers, even if it happens at 3 AM.

Maybe the the trigger for the automatic reboot could be more complicated than just a time-based trigger. Something like

    Reboot when
        localtime > 2AM & 
        localtime < 5AM & 
        traffic averaged over the last 5 min < 5kbs

Basically reboot unless the router detects the network is being used actively.

Tae3cahN• 8 years ago

You would only need to reboot if the kernel got updated. Otherwise just restart the affected services.

And kernel updates can be made faster with kexec so you don't have to reinitialize the hardware. The flashing procedure itself could also be made interruption-free with dual flash, which most sytems have anyway to avoid bricking the system.

It would take some effort to make it fast, but I think the update interruption could be brought down to the second-range. You'd still lose NAT state but that would only affect long-lasting sessions like SSH.

duxup• 8 years ago

If they thought their consumer users would just go out of their way to update their routers .... that's just not understanding how humans work.

24gttghh• 8 years ago

I have this functionality scripted for my mikrotik routers, and it emails me when it's updating.

r1ch2• 8 years ago

Unfortunately Mikrotik updates tend to change a lot of things and potentially cause issues. Recently the whole bridge implementation was rewritten which required config changes if you had anything beyond the basic bridge/port setup. And the last "stable" update was bricking certain models by making them unbootable. If they were applied automatically then there would be lots of broken routers...

sathackr5• 8 years ago

Yep. They have serious regression issues. Sometimes things that are fixed get broken again, and updates often break other things.

Other vendors have similar issues, so it's not just a Mikrotik problem, but while with other vendors it's uncommon, I almost expect it from Mikrotik.

AdmiralAsshat2• 8 years ago

But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged.

Have to wonder if those "outraged" users are ones who would have proactively fixed it themselves, or if they would've let their router happily continue to chug away as part of a botnet.

booleandilemma• 8 years ago

...he’s the grey-hat they deserve, but not the one they need right now...

uberswe• 8 years ago

or the one they need but not the one they deserve :)

ThetaOneOne• 8 years ago

“I wanted to stay insecure dam it” - Them probably

chatmasta• 8 years ago

Obligatory: https://xkcd.com/1172

michaelbuckbee2• 8 years ago

Security issues are tricky. Often making people aware of an issue is indistinguishable from having caused the issue.

icelancer2• 8 years ago

Only if you're technologically-illiterate.

ReverseCold• 8 years ago

Why would you hack someone and then tell them you did it (without asking for ransom or something)? Of course the person telling you has good intentions.

panic• 8 years ago

See also: why many people don't go to the doctor.

Swizec• 8 years ago

It’s an intrusion.

Would you be outraged if you came home one day and there was a plumber fixing your sink? “Oh hi, don’t worry about me, just fixing your sink. Let myself in, hope you don’t mind”

You didn’t even know your sink was leaky let alone called a plumber.

cs02rm0• 8 years ago

Isn't it more like a locksmith letting himself in because your lock wasn't working as it should and he fixed it?

Without going any further in than he had to and without charging you? I'd probably be a bit weirded out but quite pleased as long as he didn't hang around!

I guess this is part of the issue... even for people who have an understanding of it, it's a nuanced topic and the analogies are widespread but often misleading, because they're analogous. I'd imagine most people don't even care so long as they can access facebook.

corndoge• 8 years ago

The fact is that the greyhat could intrude, which means anyone else could intrude. If you didn't want him there you should have patched your damn router. There is no point in being outraged because you have already been owned, and the grey did you a favor. Now, there's no need to thank them, but being mad is totally counterproductive. Learn the lesson, patch your router.

icelancer2• 8 years ago

The plumber is not a locksmith, so no, I wouldn't particularly enjoy that.

StreakyCobra• 8 years ago

I don't have a strong opinion about this case, but it would be more correct to compare it to this situation:

You come home one day, entering by the main door as usual, and when going down in the garage you notice the key on the floor with a message saying: "Your garage door were not locked and everybody knew about it, so I came in to take the key on the inner lock, closed it from outside and slipped the key back under the door so nobody else with bad intentions can enter anymore".

In the situation you described I would be pissed off, but not in this one, and IMHO it is closer to this case.

tjoff• 8 years ago

You didn't know, but the mere presence of the plumber is evidence that it was faulty (since the plumber used the same security hole).

Also, the alternative in this case might be a water leak that ruins your whole house.

TheCapn• 8 years ago

Its all about how its approached... and its sort of a little bit about how your personality is.

I came home one day to a note on my inner garage door: "you left your door open, I closed it for you ;)". No name, nothing... just someone entered my garage, wrote a note, closed it and left.

I took a quick survey to see if any of the obvious valuable items were disturbed or missing and none were. I was more upset with myself for letting that happen then a stranger "fixing" my security vulnerability.

EDIT: and another anecdote was that my neighbor let himself into my house once when a water leak was discovered outside so the water could be shut off. Saved me thousands in potential damages that he caught it early... I can't say I'd be all that upset finding a plumber under my sink fixing something but that's just me.

thrmsforbfast2• 8 years ago

I have never found this analogy compelling for two reasons.

First, your sink is not part of a botnet (assuming it's not a smartsink, I guess). By leaving your machine unpatched, you are causing harm to others.

This makes the ethics of this sort of grey-hat hacking much more murky IMO. I'm willing to concede that the grey-hat behaved unethically, but I also believe that leaving a machine unpatched makes the machine's owner at least somewhat responsible for how that machine is used.

Further, I do not think it's reasonable to both claim that this sort of grey-hat activity is unethical and also claim that owners of unpatched devices have absolutely zero responsibility for how their unpatched machines are used. I.e., if we condemn this grey hat (assuming he simply locked to door and left and did nothing else) then we should also condemn the owners of botnet'd devices for the way in which their negligence causes harm to others.

If others can't break in and fix your stuff when it starts effecting them, then you should be held at least partially responsible for how your stuff is used by criminals.

Second, physical presence can be a privacy intrusion on its own and without any willful intent. E.g., a grey-hat plumber who is purely altruistic might never-the-less accidentally catch a glimpse of you naked. On the other hand, cyber presence almost always requires intentional snooping to cause a privacy violation.

nkrisc• 8 years ago

If your sink was clogged and running and flooding the apartment below you, it would be perfectly reasonable for someone to kick your door down and turn the water off.

enraged_camel• 8 years ago

If it's an apartment building, a plumber NEEDS to go inside to fix your sink so that it doesn't flood apartment units under yours.

That's why fixing router vulnerabilities is so important: if left unfixed, botnets use them to cause harm to other people.

syntheticcdo• 8 years ago

This is not a valid analogy, unless you broken sink was causing your neighbors sinks to break as well.

And in the case of an multi-tenant building, if one person's actions (or lack of action) was causing problems for other tenants, you can safely assume the landlord would let themselves in to fix it.

UnFleshedOne• 8 years ago

It is more like you returning from vacation to your apartment and see all your carpets torn up, huge dehumidifiers going at full blast and some trades people milling about because your toilet leaked and flooded your neighbor below.

behringer• 8 years ago

Actually I once heard a story of a neighbor who let themselves in when the house was literally flooding and he saved the owner thousands of dollars worth of damage. That's more like what's happening with these patched routers.

I also heard a story of a guy who's house burned down. The neighbor saw it very early and did nothing about it cuz not her problem. The homeowner was devastated.

So yes, if you see incredible destruction going on, it's ok to go fix it.

Fuxy• 8 years ago

That's an inappropriate analogy because it has nothing to do with security.

A more appropriate one would be a stranger changing your lock for you because vagrants have been going in and out of your house without you realising.

Now doesn't that sound more appropriate, good neighbourly and helpful? What do you have to be outraged about?

If you had a problem with strangers violating your property you should have fixed it yourself before it became common knowledge in the neighbourhood that your house is easy to walk in and out of without your consent.

oasisbob• 8 years ago

I've never come home to an unexpected plumber, but did have a greyhat "fix" my stuff once, and wasn't outraged at all. It felt like an intrusion, but I was grateful.

In ~ 2002 I was off to college with my Linux workstation. IIRC, the vulnerability was in the CUPS web UI. Someone filled the volume with a giant /tmp/YOUR_SYSTEM_IS_INSECURE_UPDATE_NOW file, and shutdown the affected service.

It could have been much worse.

vkou• 8 years ago

If your home had a ruptured pipe, that was spraying sewage all over the sidewalk, I think someone stepping onto your property, and turning the firehose of shit off would be behaving ethically.

Trespass to save people from themselves is one thing. Trespass to save the public is quite another.

Lukassus• 8 years ago

I think it it's more like someone locking your front door.

chaz6• 8 years ago

If your house has a gas leak, in the UK the local gas distribution network has the right to enter your property to stop the leak because it may well cause damage, injury or even death.

herodotus3• 8 years ago

Every now and then, when I am bored, I reverse engineer some of my phishing emails (Linkedin message, Fedex parcel etc). Very often I find that the phisherperson has embedded a rogue document (often .php) in a legitimate server. Sometimes I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people. I don't care - I am not doing it for thanks, but I do sometimes wonder what the internet has done to once-common human decency and politeness.

xx_alpha_xx• 8 years ago

That's great of you, I often do this as well and have never received any acknowledgement or thank you :(

LurkersWillLurk• 8 years ago

I NEVER received a thank you from any of these people.

Is it possible that they (perhaps mistakenly) believe that communicating with you could open them up to civil liability?

louthy• 8 years ago

Ridding the world of PHP, one page at a time :)

But seriously, thank you for taking the time to do this.

tomrod• 8 years ago

Sidenote: how does phishing via LinkedIn work? Recruiter spam?

HarryHirsch2• 8 years ago

You wonder if it's the Internet or the desire to deflect liability. The insurance card in your car instructs you never to admit guilt, it's not a long stretch to assume the same factor is at work here.

rlpb• 8 years ago

How do they know that you can be trusted, and aren't just another spammer/phisher?

You and I can tell the difference, but to the sort of people who run vulnerable servers, perhaps a legitimate email about server security looks indistinguishable from the others ("Hi I'm from Microsoft technical support. Please let me in to your computer to help you fix it").

johndubchak• 8 years ago

Do you ever follow-up in an isolated, safe, environment to determine if the file still exists? Curious to see if there is any correlation to the "admins" and the hackers themselves.

Bayart• 8 years ago

I do sometimes wonder what the internet has done to once-common human decency and politeness.

Politeness essencially disappears once you can't see somebody's face. 10 minutes in any online game should be proof of concet enough.

sohex2• 8 years ago

Generally speaking the standard is to not respond to email reporting malicious activity on a server, just to resolve the issue and carry on, particularly if the report is being read by an admin at a webhosting company. Doesn't mean the notification isn't appreciated!

astura2• 8 years ago

I once got a really good phishing email pretending to be ebay. It included my full legal name and my ebay id. It was some BS threatening to sue me for nonpayment if I didn't paypal them money or some stupid shit like that.

So I forwarded it to spoof@ebay.com with the message "reporting phishing email" or something. Somehow that report got "handled" by a clueless, non-technical, front line rep who thought I thought the email was real and was inquiring about the contents of the email. Pissed me off that the email wasn't handled by the correct department. I won't be bothering to forward any more phishing emails anymore.

axaxs4• 8 years ago

As someone with the authority and means to shut down domains for exactly this, the truth is, most people have either used email addresses they never check, or, just ignore all warnings. I'd argue >75% of people contacted never reply. Their entire domain gets shut down, and then, probably 75% of those do finally contact asking why their domain is down. It's probably most likely that since WHOIS data is public, people just don't put addresses they check often there.

JustSomeNobody• 8 years ago

Lawyers. Lawyers have done this and not the internet.

Duladian• 8 years ago

I'm on my company's many distribution email list for info@ support@ and other common addresses. I do the exact same thing, but I've received a number of email responses saying thanks or asking for the original email headers.

I usually only notify .edu or nonprofit organizations and completely ignore large corporations. Sending an email to a larger organization usually gets lost and nothing comes of it.

oldandtired2• 8 years ago

In the cases where the problem is fixed, I think you'll find that the explanation is as simple as this:

They view the message as showing up a failure on their part and they do not want anything showing that they have made a mistake in some way. So, they do not acknowledge your message as it provide a means of tracking that failure.

For those cases where it is not fixed, there is no-one who cares to do so.

In the past, I have made communications with website admins about various aspects of their sites (non-security related) when they poorly relate to those of us who are getting older and have increasing eyesight difficulties. The usual response has been "No one else has complained, so take a long jump off a short pier - our site is perfect." I sometimes try to explain that people won't continue to visit if the experience is bad, nor will they bother highlighting that there are problems. They will generally still respond with "shut-up and go away."

You just leave them to their ineffective site and move on. Very occasionally, you get back a thanks and see improvements made, but that is rare.

emmelaich• 8 years ago

I do the same. Which reminds me -- when you get a 404 from utwente.nl you're redirected to a domain squatter / advertising site.

I can't be bothered to report it to them.

bmn__• 8 years ago

I send a polite email to the admins of these sites warning them about the injected file. I NEVER received a thank you from any of these people.

Out of curiosity, do you receive answers at all?

If not, there could be a technical reason rather than the decline of human decency: your including the link to the phishing page gets the message filtered away by automated security software.

yial• 8 years ago

I was once repeatedly getting phishing emails from a small fire company a few states away. It seemed that one individuals email there had been comprised. I called the fire company and asked to speak with him. He was super embarrassed and thanked me. Their IT person* there apparently didn’t know how to fix the issue, so I suggested a few possible solutions and we parted ways. I didn’t get any more emails from his address so maybe it worked ?

* their IT person I think was really just the person who was best with computers.

Alupis4• 8 years ago

"I added firewall rules that blocked access to the router from outside the local network," Alexey said.

This could very well be what's causing the outrage from operators... suddenly losing connection with your router that's in some data center 3 hours away - requiring a drive-over just to discover it's some dude adding rules to your production equipment would be upsetting.

There's legitimate reasons for remote operators to have remote access from outside the network. Obviously the router should be secured with latest updates that guard against known exploits, but this could be a major pain for some operators.

(you'd also have to roll back to some backup since there's no telling what else the guy changed, even if you feel he's more-or-less trustworthy... which means more downtime for your customers)

gtdawg• 8 years ago

Also, of course, only allowing remote access from a controlled list of source IP addresses.

thrmsforbfast2• 8 years ago

Apparently exactly this happened:

https://pikabu.ru/story/vzlom_routeros_5924128

assuming, at least, that the Google translation is decent: "It seems to be even good, but the admin’s account has severely cut the rights, the attackers created another one with full rights. The office is far away, the provider settings are pppoe, we can’t remove back-ups, we can also unload the config, advise how to be?"

noncoml• 8 years ago

But still, why would you upset? At the very least this guy has made you aware of a known security hole in your router. Sure, the timing maybe inconvenient, but at least you now know there is a problem you have to attend.

Would you rather leave the hold open and be happy in your ignorance if the security problem in your network?

jimnotgym• 8 years ago

Every now and then I let a software company that supplies enterprise software know that their marketing emails are going to spam because their marketing email provider doesn't have an spf record on their domain. They know me personally but still never reply.

I told the same company that the certificate had expired in one of their sub-domains. It intrigued me that the first 3 of their tech team didn't know what that meant.

Still they never said thank you.

ry_ry• 8 years ago

A few months ago I received a random confirmation of my order from one of those fast food ordering aggregator sites, based in a different country that I'd never used.

I logged in and reset the password to gibberish and emailed them to let them know what had happened, assuming user error (email was a firstlast@domain, so relatively easy to mess up I guess)

A couple of days later I received an email from the company asking for my photo ID. I politely said I wouldn't feel comfortable providing that and advised they get email confirmation from users.

I didn't hear back for a couple of weeks and thought nothing more of it. Then a notification that 'my' payment to a fast food place had bounced (or been charged back, it was hard to work out tbh). I figured I'd ignore it because extradition to the states over $36 seemed unlikely.

A few days later I get another mail from them replying to my earlier mail about email confirmation and not mentioning the charges. Never heard any more from them.

The whole thing was a bit odd, but I can't help but think letting them know early saved us all a whole bunch of hassle, and maybe they'll fix their registration flow.

philamonster2• 8 years ago

Devices at vulnerable routerOS version and not already compromised would not be vulnerable if the firewall was enabled. It's that simple. Not great that these boxes used to ship in this default state and I can _understand_ a home user unfamiliar with what they're dealing with but what reason is there for deploying infrastructure this way at an ISP or hospital or whatever org?

r1ch2• 8 years ago

I think there's still a lot of blame on Mikrotik for having such bugs in their management service and other daemons. I explicitly opened up the winbox port to be able to remotely manage Mikrotik routers I deploy (I considered their VPN implementations to be an even higher attack surface), as did many other admins it seems.

The winbox protocol supposedly runs over TLS and requires a username/password before anything is possible so I thought it should be safe enough, but through this bug anyone can download any file with no authentication (and the user db was storing passwords in plaintext which certainly didn't help)!

The web server vulnerability, sshd vulnerability, the smbd vulnerability - all are their fault. Had they used standard, well-tested open source packages there would be no problems, but they had to write their own custom implementations of these protocols for "reasons". I hate to think how many remotely exploitable bugs are lurking in their ipsec implementation.

sathackr5• 8 years ago

Vulnerabilities are almost unavoidable.

Leaving a management port on a router open to the entire internet is a very bad practice. Would you leave an RDP port open to the world?

If you require remote access, at least restrict it to known management IP addresses.

fencepost• 8 years ago

Creating named address lists on Mikrotik routers is pretty trivial, so it's easy to create Remote_FW_Access_Allowed and add several remote IPs or netblocks to it. Then set up a firewall rule to allow Winbox (or other) port access from that address list (using an address list instead of a Src Address is on the Advanced tab when setting up the firewall rule).

Using source address lists with short timeouts it's also easy to set up port knocking - first port connection attempt adds to "Knock1" for 5 seconds, second port connection attempt from an IP on "Knock1" adds to "Knock2" for 5 seconds, (repeat for X knocks), connection attempt from an IP on "KnockX" adds to "Fully_Knocked" for (duration) (or "none static" for a permanent add). You can also do both a temporary add with a duration and a separate "Has_ever_knocked" with no timeout to build a list of all remote IPs that have ever fully knocked.

The UI could certainly be more friendly, but I think that's because they're avoiding having things that can only be set up from the command line.

alyandon• 8 years ago

How long ago was it that Mikrotik shipped devices that listened on the WAN port? The Mikrotik hEX and RB3011 I bought last year most assuredly was not configured that way even though the version of ROS on them was many revisions out of date.

philamonster2• 8 years ago

I've purchased a rack-mounted RB2011 and wAP ac, more commonly known as RBwAPG-5HacT2HnD (lol these model names), within the last 3 years that did not have firewall enabled and contained no firewall rules by default. If I had to guess it was around ROS 6.32 or 6.33 release for 2011 and recently for the wAP.

nebulous1• 8 years ago

I've heard that this was the default for these routers. I have a RB951G-2HnD using NAT, and, although I patched it long ago, as far as I can tell the relevant ports were never open on the WAN side, nor any ports that I haven't manually forwarded. Was that not the default?

Hello712• 8 years ago

according to Mikrotik, the firewall is off by default, but the web interface also listens LAN only by default. this is a more secure configuration because it prevents people going "hurr durr firewall breaking muh videos" (in part because of shitty video games telling everybody to turn off their firewalls and antiviruses) and creating the security problems.

Snawoot• 8 years ago

Original post from Alexey at habr.com (russian IT community): https://habr.com/post/424433/

ryandrake• 8 years ago

If only ISPs would start disconnecting negligent customers who continue to use exploited or vulnerable equipment. The incentives are not right. If they did, they’d risk losing a paying customer, if they don’t, nothing bad really happens to them. I hate suggesting regulations and fines but it’s the only thing end users and ISPs will respond to.

samat• 8 years ago

Most of this devices are provided by ISPs so it's they who are negligent. :)

deckar014• 8 years ago

As for MikroTik, the Latvian company has been one of the most responsive vendors in terms of security flaws, fixing issues within hours or days, compared to the months that some other router vendors tend to take. It would be unfair to blame this situation on them. Patches have been available for months, but, yet again, it is ISPs and home users who are failing to take advantage of them.

A system that requires users to opt in to security is not a secure system.

NelsonMinar• 8 years ago

OTOH people would scream bloody murder at a router that installed firmware updates and rebooted itself without asking. Just look at the reaction to how Windows 10 handles updates.

Avamander• 8 years ago

It's time MT got something like unattended upgrades.

deckar014• 8 years ago

One PC operating system's poor implementation of automatic updates does not mean automatic updates can't be implemented gracefully on a router.

jessaustin• 8 years ago

It takes effort to purchase, install, and configure MikroTik products rather than just using the router/AP combo you got from your ISP. Anyone who has done that is capable of patching occasionally. [EDIT:] And actually now that I've read TFA I learn that many of these are actually "edge" routers used by ISPs on their own premises. There's no excuse for an ISP not to keep up with patches.

deckar014• 8 years ago

They have hardware targeted towards average consumers also.

https://www.newegg.com/Product/Product.aspx?Item=9SIAEFK6MH2...

https://www.newegg.com/Product/Product.aspx?Item=9SIAEFK6D86...

sathackr5• 8 years ago

As opposed to Microsoft ramming updates down your throat whether you like them or not, and whether they break things or not?

The lock on your house door is 'opt-in'. If you don't lock it and someone steals something, is it the lock manufacturer's fault? The home builder's fault? Did they construct an insecure house? Ignorance of the proper operation of the lock is not an excuse not to lock it and doesn't shift the responsibility to someone else.

I don't know why people happily assume everything in IT is secure by default when in the real world, almost nothing is secure by default.

deckar014• 8 years ago

The pervasiveness of insecure systems is not a justification for designing an insecure system.

paulie_a• 8 years ago

Just start bricking them. It's a public service to the internet as a whole.

ratsimihah• 8 years ago

Patch me daddy

Krasnol• 8 years ago

I had one once and I can recommend the "MikroTik Security Guide" by Tyler Hart.

It's quite an easy step by step guide.

some1else• 8 years ago

Some black hats also patch the systems they compromise. Depends on the purpose.

electricwater• 8 years ago

This is hollywood material.

mathieubordere• 8 years ago

Hats off to this guy.

writimov2• 8 years ago

This particular effort seems to be a mix of fun, braggadocio, and altruism. Could this sort of thing be organized with a social network and a list of tasks/problems using a tool like Trello or Jira but for solving any problem? The result would be anyone in the world could help/volunteer to fix real problems with free time. Use: 1) Problem is posted 2) Investigated and confirmed to be real 3) Volunteers start to fix and swap solutions 4) Extra people are recruited as necessary 5) Problem is solved and wrapped up. This could be applied from everything from MongoDB security issues (https://snyk.io/blog/mongodb-hack-and-secure-defaults) to cleaning up neighborhood pollution (http://www.chicagotribune.com/news/local/breaking/ct-chicago...) Thoughts? Does this exist already?

jVinc• 8 years ago

Yes... volunteer work already exists. Suggesting that it could be organized through Trello or Jira doesn't really add any revolutionary element. And many volunteer organisations already have planning solutions.

et2o• 8 years ago

Why so negative?

ocdtrekkie• 8 years ago

More often than not, the opportunities for people to help vastly outscales the amount of hours volunteers are able to put up to help. Anyone can clean up trash on the side of the road and it's a no-skill job, so why is it still there? Open source projects everywhere need help, but a lot of them languish unsupported anyways.

Most people likely know countless ways they could help, but the time to do so doesn't match up with the need that's out there.

writimov2• 8 years ago

This is the question I was really getting at: where is the site where I can go help beyond the ways that most people already know about? Where I can I volunteer my services to fix a posted problem with MikroTik routers being insecure? Where is the site with a giant list of problems and descriptions of the people needed to solve them? And matching algorithms to put the two together?

More to the point: where can someone who has a totally unique skillset help solve a specific problem?

The assumption I'm making (which may be faulty) is that everyone has a unique and valuable skillset that may only apply to specific problems. (Like for example, I know nothing about B list celebrities from 1950s Hollywood. But if someone had a problem to solve that involved knowledge of that period, they could post the problem and match it to a profile of a Movie professor, or just a regular person who happens to know alot about that subject. The technical complexities of proving someone knows what they are talking about and their authority can be trusted, basically filtering spam contributions, is the biggest technical challenge. But it seems like new tools like machine learning and neural nets could help us here.)

We all know we can help do basic low-skilled stuff: donate money, volunteer at homeless shelter, build houses habitat for humanity, volunteer at local garden, trash cleanup etc.

What website do I go to that collects all of these ways to help and more?

For ex, what website do I go to for helping in these scenarios:

1) I understand politics and want to work on bills in various countries to stop climate change?

2) I understand biology and want to cure the algae bloom I saw in my local lake yesterday?

3) I understand the physics of mechanical design and want to help fix a design flaw in a pair of garden shears that keeps cutting my skin between my thumb and first finger?

Or approach it the other way around: what site can I go to, register my interests and skills and get assigned to existing projects that will change the world? Where I can help anytime I have free time. Or get an assignment in my email?

Scenarios:

1) I sign up on the site saying I have a biology degree and live in Napa Valley, CA and can do environmental stuff. I get assigned to take Cesium 137 readings to followup on the Fukushima disaster in wine country at various GPS coordinates and get sent a geiger counter, instructions, and training.

2) I have Crohns disease but am willing to wear a data collection monitor on my body and send the data to multiple companies developing new medicines or treatments.

3) I care about elephants and can volunteer to take a shift watching through the eyes of an automated drone that scans for poachers on the other side of the planet?

There are plenty of ways to do basic help in a semi-organized manner to treat the symptoms of chronic human problems. There is no site that I've seen where solving the largest problems of humanity can be crowdsourced.

Where I can I volunteer my services to help design water desalinization plants to make them 100X cheaper?

fenwick67• 8 years ago

Archive Team does distributed grey-hat activities on volunteer-run computers all the time, but only for archival projects.

commandlinefan• 8 years ago

I remember once, when I had an unpatched computer overrun by hostile viruses that rendered it unusable, wondering if one of the botnet-type viruses that want to take over your computer and use it without being undetected would someday get smart enough to recognize other viruses and automatically remove their competition so that they could continue to silently infect you. Like a biological virus, one that kills the host is an ineffective one - they want to use the hosts resources while not being noticed. I wonder if this is something like that - virus writers starting to get smarter about cleaning up behind them and keeping out competing malware.

tzakrajs• 8 years ago

I've heard rumors that nation states will keep infected machines from crashing or attracting attention so that system administrators stay away from their beachhead.

vectorEQ• 8 years ago

botnets often uninstall other botnets, and patch vulnerabilities they use to get in, to close the door behind them.

iodiniemetra• 8 years ago

This has been happening for years, especially in the "botnet community". Either someone takes down someone else's botnet through the same bug and patches it or figures out a bug in the botnet and caps it for themselves (for example, getting ops in the CNC channel). I think Microsoft has even done in cooperation this a few times; it's dubious legal territory.

You can see some historical examples, both recent (Mirai had some viruses that went around closing the bug), as well as further in the past (there's one that escapes me, it must have been around 2010?)

I wish I could cite more, I'm going to spend some time researching this and make a list for myself, it's surprisingly interesting!

drewmol• 8 years ago

And of course they did, frustratingly that behavior is industry standard even outside of malware.

madrox• 8 years ago

Reminds me of a black hat I knew in the 90s. He bragged that if he ever gained access to a system, he'd start patching vulnerabilities so others wouldn't gain access and make it obvious the machine had been compromised.

Ensorceled• 8 years ago

I can attest that there was at least one such black hat in the 00's.

One of my IT guy's mom complained about her machine being slow and having "too many pop ups", so he planned to go to her place on the weekend and fix it. She called back a couple of days later and told him not to bother as it was "all fixed now".

o.O

I lent him one of our loaner laptops and he brought in her computer back and put it on our test DMZ to see what was up. Yep, somebody had scrubbed all the malware and "search bars" off the machine and installed a free anti-virus package. The exceptions on the anti-virus made it easy to track down what was happening; it was set to send spam every night between 1am and 7am but otherwise was pristine.

My colleague had to do some serious soul searching before he decided to wipe it instead of just returning it ...

tenpo• 8 years ago

Not sure what they mean by "mysterious". He isn't hiding and never was. He posted his photo, name and other personal details in articles about MikroTik on Russian IT blogging platform[1]. His name is Alexey Sopov, 34, from Novosibirsk. Quick search revealed his social network accounts:

https://fb.com/100005153643926

https://vk.com/lmonoceros

[1] https://habr.com/post/353530/

netsec_burn• 8 years ago

Clickbait?

ccnafr2• 8 years ago

Probably the journalist didn't want to get this guy in trouble for doxxing him.

I'm pretty sure the FBI would love to arrest him by now. Just like MalwareTech.

wjp3• 8 years ago

Back in college (early 90's) I would run ToneLoc overnight, and wake up to view the results. One time I had a hit, and I ftp'ed into some server on Mindspring's customer IP range.

A quick look at the system told me the root account had no password set. So I tried a telnet and wham - I was in.

A 'who' showed someone else was logged in. So I sent a broadcast message to them saying they need to secure their system better, and logged out.

I had the habit of using an obscure hotmail email to log into FTP servers, and had done that here. I was surprised to see an email from the owner - wanting to know how I found his system, etc. He was nice, but I didn't reply.

iforgotpassword• 8 years ago

He was nice, but I didn't reply.

Noooooo. Story started off well and then you tree fiddied me!

spappal• 8 years ago

This reminded me of last years "BrickerBot" malware [0] by grey-hat The Janit0r / The Doctor who bricked IoT devices with the stated purpose of preventing the same devices from being hacked by botnet-malware, which allegedly puts the whole internet at risk.

[0] https://www.bleepingcomputer.com/news/security/brickerbot-au...

anonnel• 8 years ago

Normally HN is not a place for memes, but I feel this is appropriate

https://m.imgur.com/JxH0lUT?r

ristic• 8 years ago

Would have been nice if he got around to the router at our office, we got cryptojacked: https://imgur.com/a/Q7Pmxth

A mysterious grey-hat is patching people's outdated MikroTik routers

Related Stories