https://www.zdnet.com/article/a-mysterious-grey-hat-is-patching-peoples-outdated-mikrotik-routers/ /> X Trending * I tried Apple Vision Pro and it's far ahead of where I expected * Amazon Prime Day is official: July 11-12 for major sales on tech and more * The best early Prime Day deals: TVs, phones, AirPods, robot vacuums, more * What is ChatGPT and why does it matter? * Is Temu legit? What to know about this shopping app before you place an order * Special Feature: Unlock the Full Power of Your Phone * * ZDNET Recommends * These $400 XR glasses gave my MacBook a 120-inch screen to work with * The best earbuds you can buy * Google Pixel Fold review: Samsung's first big competitor comes out swinging * Smart home starter pack: 5 devices that will make your life easier * Mesh routers vs. Wi-Fi routers: What's best for your home office? * * Best smartphones * Best laptops * Best VPNs * Best TVs * Best headphones * Best robot vacuums Tech * Gaming * Headphones * Laptops * Mobile Accessories * Networking * PCs * * Printers * Smartphones * Smart Watches * Speakers * Streaming Devices * Streaming Services * * Tablets * TVs * Wearables * * Kitchen & Household * Office Furniture * Office Hardware & Appliances * Smart Home * Smart Lighting * Yard & Outdoors Innovation * Artificial Intelligence * AR + VR * Cloud * Digital Transformation * Energy * * Robotics * Sustainability * Transportation * Work Life * * Accelerate your tech game Paid Content * How the New Space Race Will Drive Innovation * How the metaverse will change the future of work and society * * Managing the Multicloud * The Future of the Internet * The New Rules of Work * The Tech Trends to Watch in 2023 Business * See all Business * Amazon * Apple * Developer * E-Commerce * * Edge Computing * Enterprise Software * Executive * Google * Microsoft * * Professional Development * Social Media * SMB * Windows * * Digital transformation: Trends and insights for success * Software development: Emerging trends and changing roles Security * See all Security * Cyber Threats * Password Manager * Ransomware * VPN * * Cybersecurity: Let's get tactical * Securing the Cloud Advice * Deals * How-to * Product Comparisons * Product Spotlights * Reviews Buying Guides * See all Buying Guides * Best all-in-one computers * Best budget TVs * Best gaming CPUs * Best gaming laptops * Best gaming PCs * * Best headphones * Best iPads * Best iPhones * Best laptops * Best large tablets * Best OLED TVs * * Best robot vacuum mops * Best rugged tablets * Best Samsung phones * Best smart rings * Best smartphones * Best smartwatches * * Best speakers * Best tablets * Best travel VPNs * Best TVs * Best VPNs tomorrow belongs to those who embrace it today * Asia * Australia * Europe * India * United Kingdom * United States * ZDNET France * ZDNET Germany * ZDNET Korea * ZDNET Japan [ ] Go Most Popular * See all Topics * Finance * Education * Health * Special Features * ZDNET In Depth * ZDNET Recommends * Newsletters * Videos * Editorial Guidelines * Trending * I tried Apple Vision Pro and it's far ahead of where I expected * Amazon Prime Day is official: July 11-12 for major sales on tech and more * The best early Prime Day deals: TVs, phones, AirPods, robot vacuums, more * What is ChatGPT and why does it matter? * Is Temu legit? What to know about this shopping app before you place an order * Special Feature: Unlock the Full Power of Your Phone * ZDNET Recommends * These $400 XR glasses gave my MacBook a 120-inch screen to work with * The best earbuds you can buy * Google Pixel Fold review: Samsung's first big competitor comes out swinging * Smart home starter pack: 5 devices that will make your life easier * Mesh routers vs. Wi-Fi routers: What's best for your home office? * Best smartphones * Best laptops * Best VPNs * Best TVs * Best headphones * Best robot vacuums * Tech * Gaming * Headphones * Laptops * Mobile Accessories * Networking * PCs * Printers * Smartphones * Smart Watches * Speakers * Streaming Devices * Streaming Services * Tablets * TVs * Wearables * Kitchen & Household * Office Furniture * Office Hardware & Appliances * Smart Home * Smart Lighting * Yard & Outdoors * Innovation * Artificial Intelligence * AR + VR * Cloud * Digital Transformation * Energy * Robotics * Sustainability * Transportation * Work Life * Accelerate your tech game Paid Content * How the New Space Race Will Drive Innovation * How the metaverse will change the future of work and society * Managing the Multicloud * The Future of the Internet * The New Rules of Work * The Tech Trends to Watch in 2023 * Business * See all Business * Amazon * Apple * Developer * E-Commerce * Edge Computing * Enterprise Software * Executive * Google * Microsoft * Professional Development * Social Media * SMB * Windows * Digital transformation: Trends and insights for success * Software development: Emerging trends and changing roles * Security * See all Security * Cyber Threats * Password Manager * Ransomware * VPN * Cybersecurity: Let's get tactical * Securing the Cloud * Advice * Deals * How-to * Product Comparisons * Product Spotlights * Reviews * Buying Guides * See all Buying Guides * Best all-in-one computers * Best budget TVs * Best gaming CPUs * Best gaming laptops * Best gaming PCs * Best headphones * Best iPads * Best iPhones * Best laptops * Best large tablets * Best OLED TVs * Best robot vacuum mops * Best rugged tablets * Best Samsung phones * Best smart rings * Best smartphones * Best smartwatches * Best speakers * Best tablets * Best travel VPNs * Best TVs * Best VPNs * More * See all Topics * Finance * Education * Health * Special Features * ZDNET In Depth * ZDNET Recommends * Newsletters * Videos * Editorial Guidelines Tech Home Tech Security A mysterious grey-hat is patching people's outdated MikroTik routers Internet vigilante claims he patched over 100,000 MikroTik routers already. catalin-cimpanu.jpg Written by Catalin Cimpanu, Contributor on Oct. 12, 2018 * * * * * A Russian-speaking grey-hat hacker is breaking into people's MikroTik routers and patching devices so they can't be abused by cryptojackers, botnet herders, or other cyber-criminals, ZDNet has learned. The hacker, who goes by the name of Alexey and says he works as a server administrator, claims to have disinfected over 100,000 MikroTik routers already. Featured * The 25 best early Prime Day deals: AirPods, Dyson vacuums, TVs, phones, more * The Pixel 8 could bring back a buzzword that was once the talk of the tech industry * How to use ChatGPT: Everything you need to know * Google Pixel Fold review: Samsung's first big competitor comes out swinging Alexey has not been trying to hide his actions and has boasted about his hobby on a Russian blogging platform. He says he accesses routers and makes changes to their settings to prevent further abuse. Also: Best VPN services of 2020: Safe and fast don't come for free "I added firewall rules that blocked access to the router from outside the local network," Alexey said. "In the comments, I wrote information about the vulnerability and left the address of the @router_os Telegram channel, where it was possible for them to ask questions." But despite adjusting firewall settings for over 100,000 users, Alexey says that only 50 users reached out via Telegram. A few said "thanks," but most were outraged. The vigilante server administrator says he's been only fixing routers that have not been patched by their owners against a MikroTik vulnerability that came to light in late April. At the time, the vulnerability (known as CVE-2018-14847) was a zero-day, but MikroTik rolled out a fix in record time. Nonetheless, cyber-criminals quickly jumped on board to exploit the flaw. CVE-2018-14847 is a very convenient vulnerability because it allows an attacker to bypass authentication and download the user database file. Attackers decrypt this file and then use one of the username & password combos to log into a remote device and make OS settings and run various scripts. For the past five and a half months, the vulnerability has been mainly used to plant cryptojacking scripts on outdated MikroTik routers [1, 2] and to hijack DNS servers and later redirect user traffic towards malicious sites [1, 2]. This wouldn't be an issue, but MikroTik is one of today's most popular router brand. There are over two million MikroTik routers around the globe. Security researcher Troy Mursch told ZDNet today that of the millions of MikroTik routers currently connected to the Internet, over 420,000 show signs they've been infected with cryptocurrency-mining scripts. Speaking to ZDNet today, Ankit Anubhav, a security researcher for NewSky Security, has also indicated that DDoS botnet authors have also been trying to infect and corral these devices under their control, but failing. "The usual IoT blackhat botnet factory is basically clueless about the exploit, and how it can be deployed for a proper functioning botnet," Anubhav said. Instead, he says the people placing cryptocurrency-mining scripts on the devices are far more adept at hijacking the vulnerable routers. Anubhav speculated that this looks to be the "work of a knowledgeable lone actor." Things became even worse for the MikroTik community this past week after Tenable researchers released a new exploit named "By The Way" for the original CVE-2018-14847 vulnerability. This spurred new interest from the botnet community. But the reason why Alexey was able to "clean" over 100,000 routers is because none of the hacker groups currently abusing MikroTik routers appear to perform basic hygiene. "The attackers are not closing [device ports] or patching the devices, so anyone who wants to further mess with these routers, can," Anubhav told ZDNet. Fortunately, Alexey has been doing this clean-up on some users's behalf. But technically speaking, Alexey is on the wrong side of the law. Despite his good intentions, it is illegal to access another person or organization's equipment without consent. Alexey's vigilante spree may be illegal, but he is definitely not the first. In 2014, a hacker accessed thousands of ASUS routers and planted text warnings inside computers with shared folders and hard drives that were located behind those routers, warning users to patch their ASUS device. In late 2015, a team of vigilante hackers going by the name of the White Team launched the Linux.Wifatch malware that closed security holes on a variety of Linux-based routers. At one point, the White Team's botnet became so big it battled with the botnet of the infamous Lizard Squad team for the title of the Internet's largest botnet. In 2017, a more devious vigilante hacker named The Janit0r deployed the BrickerBot malware that erased firmware or bricked IoT devices that had not been updated. Also in 2017, a hacker made over 150,000 printers spew out a message to their owners to raise everyone's awareness about the danger of leaving printers exposed online. In 2018, another vigilante renamed tens of thousands of MikroTik and Ubiquiti routers to "HACKED" and other messages to get owners' attention to update their devices. Mursch told ZDNet that he doesn't believe the MikroTik situation will get better any time soon. "Rebooting grandma's router won't fix this," he said. "Remediation efforts must be done by the service providers." The reason is that many of these devices are not routers placed inside users' homes, but are so-called "edge" devices, often part of an ISP's internal infrastructure, such as routers placed in ISP boxes left inside apartment complexes or on street poles. Another source in the infosec community who spoke to ZDNet but did not want his name shared for this story confirmed that Alexey's vigilante efforts have also touched edge routers, not only those found in people's homes. "Ironically, by cleaning some ISP routers he might get the ISPs to act and fix everyone's routers as well," the unnamed researcher told us. As for MikroTik, the Latvian company has been one of the most responsive vendors in terms of security flaws, fixing issues within hours or days, compared to the months that some other router vendors tend to take. It would be unfair to blame this situation on them. Patches have been available for months, but, yet again, it is ISPs and home users who are failing to take advantage of them. How zombie cameras took down Netflix... and an entire country's internet zdnet-iot-crime.jpg zdnet-iot-foscam.jpg zdnet-iot-baby-monitor.jpg zdnet-iot-bitcoin.jpg zdnet-iot-router.jpg zdnet-iot-shellshock.jpg zdnet-iot-minecraft.jpg zdnet-iot-snowden.jpg zdnet-iot-mirai.jpg zdnet-iot-netflix.jpg zdnet-iot-brian-krebs.jpg zdnet-iot-paras-jha.jpg zdnet-iot-liberia.jpg zdnet-iot-trump.jpg zdnet-iot-gamer.jpg RELATED COVERAGE: * Hackers breach web hosting provider for the second time in the past year * Five years later, Italian police identify hacker behind 2013 NASA hacks * Over nine million cameras and DVRs open to APTs, botnet herders, and voyeurs * Web hosting providers take three days, on average, to respond to abuse reports * TechRepublic: Why 31% of data breaches lead to employees getting fired * CNET: That VPNFilter botnet the FBI wanted us to help kill? It's still alive * New study finds 5 of every 6 routers are inadequately updated for security flaws * US ISP RCN stores customer passwords in cleartext * Thousands of WordPress sites backdoored with malicious code Editorial standards Show Comments Log In to Comment Community Guidelines Footer background image ZDNET we equip you to harness the power of disruptive innovation, at work and at home. * Topics * Galleries * Videos * Do Not Sell or Share My Personal Information * about ZDNET * Meet The Team * Sitemap * Reprint Policy * Join | Log In * Newsletters * Site Assistance * Licensing * * * * * * (c) 2023 ZDNET, A Red Ventures company. All rights reserved. Privacy Policy | Cookie Settings | Advertise | Terms of Use