[HN Gopher] A mysterious grey-hat is patching people's outdated ...
___________________________________________________________________
A mysterious grey-hat is patching people's outdated MikroTik
routers (2018)
Author : thunderbong
Score : 62 points
Date : 2023-07-08 19:33 UTC (3 hours ago)
(HTM) web link (www.zdnet.com)
(TXT) w3m dump (www.zdnet.com)
| asynchronous wrote:
| I wonder if we'll see the day where legal laws change to either
| condone or just ignore activities like this.
|
| I feel like if we did we'd see more good things happening.
| yjftsjthsd-h wrote:
| > I feel like if we did we'd see more good things happening.
|
| The problem is that we'd see more _bad_ things happening. This
| time someone correctly patched the devices, but maybe next time
| they make a mistake and leave things more vulnerable, and the
| next time someone just bricks devices outright because they
| decide that 's better than vulnerable devices on the open
| internet.
| [deleted]
| Barrin92 wrote:
| Belgium did just that a few months ago:
|
| https://www.vrt.be/vrtnws/en/2023/02/15/ethical-hackers-can-...
| neilv wrote:
| Someone who decides to mess non-consensually with 100,000 other
| people's network routers... Maybe it's a bit like the saying
| about politicians: you don't want anyone who would want the
| job.
| marricks wrote:
| Growing public fruit trees, handing out food, stopping to help
| an injured person, all of those are illegal in some
| jurisdictions or can get you into serious legal trouble.
|
| That is because laws exist not just to stop bad things but also
| to stop good things from happening, or at least centralize how
| good things are done.
|
| I mean, otherwise what would happen? We'd all probably just
| take care of each other, and we can't have that happening.
| [deleted]
| throwawayadvsec wrote:
| "stopping to help an injured person,"
|
| can you be more specific please? where and in which case?
| jagged-chisel wrote:
| Being held liable for attempting to help but making things
| worse.
| whynotmaybe wrote:
| https://en.m.wikipedia.org/wiki/Good_Samaritan_law
| NoZebra120vClip wrote:
| You know, one aspect that doesn't appear to be covered in
| that article is scams. There are often scams perpetrated
| where someone fakes injury or accident, either to create
| a diversion, or to attract wannabe "Good Samaritans" who
| come to render assistance and then find themselves
| pickpocketed or in worse trouble than they started out.
|
| There are also people who pretend to be out of gas and
| just need a can filled at the local service station. A
| guy came up to me at a train station and showed me all
| his sores, and I offered to take him to the drugstore and
| purchase some bandages, but the only reason he was
| showing me sores was because he was a panhandler and he
| wanted cash.
|
| I stay away from anyone who looks like they require
| assistance. Life is too short. I am not a professional
| first responder and it's not my job to diagnose or treat
| any illness or injury. I may call 911 if I see something
| unambiguously egregious, but nowadays, there are usually
| so many witnesses carrying mobile phones that I don't
| need to bother.
| throwaway92700 wrote:
| https://en.m.wikipedia.org/wiki/Bystander_effect
| NoZebra120vClip wrote:
| Thanks for the commentary-free Wikipedia article link,
| but in skimming across it, I don't see any significant
| mention of the cases I discussed which are scammers who
| are faking it. The article chiefly seems to be concerned
| with real, or perceived real, emergencies, and how they
| relate to large crowds of witnesses.
|
| If is often the case that scammers who are faking
| distress will isolate and approach potential victims
| rather than attract a crowd. Especially with people who
| lurk outside of grocery stores or some other venue. Once
| I was approached by an "out of gas" individual at a
| rather lonely intersection of downtown. There were no
| other witnesses around, until an official in a uniform
| vest came to intervene.
| tudorw wrote:
| I don't stay away. I frequently get stuck in, calling the
| police, ambulance and fire services for people, assisting
| epileptics in shops and planes, helping lost children,
| picking up random dogs and returning them to their
| owners...
|
| Why do you think life is too short, I've always thought
| it the perfect length, do divulge what it is that takes
| the time for you?
| kneebonian wrote:
| This law specifically states that you cannot be held
| legally liable for rendering aid. Not that it is against
| the law to help people.
| Moomoomoo309 wrote:
| It covers it in specific cases for specific people. If
| you help someone not in those specific cases and/or are
| not that specific kind of person, you can be punished for
| it.
| NegativeK wrote:
| That's a hyperbolic and rhetorical interpretation of what's
| going on with this patching.
| [deleted]
| jon-wood wrote:
| In all of those cases I'm pretty sure you can't in fact be
| arrested just for the act as described. You need to be in
| some way negligent or malicious in doing so, and in most
| countries at least you have to be _extremely_ negligent to
| get prosecuted for anything done while rendering aid to an
| injured person.
|
| Even more generally, some form of harm needs to be shown to
| prosecute. Unfortunately there's an increasingly broad
| definition of "harm", at least here in the UK, but for now
| you do have to really screw up in any of the cases you've
| listed.
| boomboomsubban wrote:
| While it may be possible for this person to face criminal
| charges, I doubt any police force or attorney general would
| really want to investigate or charge this person. And a civil
| case would require the claimant to prove damages, which they'd
| struggle to do.
|
| So aren't we already at a point where this is condoned/ignored?
| thephyber wrote:
| Perhaps for one person doing it a few times and competently
| patching systems.
|
| What happens when a more novice grey hat tries it and bricks
| the machines? What happens if they patch the routers with
| software patches that have embedded malware?
|
| Ultimately, patching systems on the internet means you are
| very likely crossing jurisdictional boundaries, so beware
| what governments you might piss off.
|
| Personally, I like that prosecutors in the US are ethically
| bound to understand why the suspect did what they did (their
| intentions/motivations) and that prosecutors have the duty to
| prosecute only cases that they can convince juries to convict
| on. More than that, prosecutors rarely have lots of spare
| cycles, so they have to plan+choose their prosecution
| resources judiciously.
|
| And then civil liability is very different from criminal
| prosecution.
| boomboomsubban wrote:
| >What happens when a more novice grey hat tries it and
| bricks the machines? What happens if they patch the routers
| with software patches that have embedded malware?
|
| Then a civil claim could show damages, or there would be
| some amount of motivation for the state to go after them.
| xwdv wrote:
| I think doing stuff like this is the closest we can come to being
| real life superhero vigilantes.
| robotnikman wrote:
| I think the FBI basically did this when Eternalblue (or maybe it
| was Bluekeep) came around years ago.
|
| Edit: Found it. They were patching exchange servers, around when
| 4 zero-day vulnerabilities were disclosed for Exchange
|
| https://www.zdnet.com/article/the-fbi-removed-hacker-backdoo...
|
| https://www.justice.gov/opa/pr/justice-department-announces-...
___________________________________________________________________
(page generated 2023-07-08 23:01 UTC)