Hacker News new | ask | show | jobs
by VladVladikoff 16 days ago
>42 hosts with remote management

>vender doesn’t want to fix it

Sometimes I wonder if the white hat hackers who find such a thing should just take it a step further and patch those hosts. Take the firmware, fix those bugs and update those 42 routers.
5 comments
mrweasel 16 days ago
Someone did, a Russian dude (or at least Russian speaking) updated over a 100.000 Mikrotik routers. While he did get a few "Thank you" notes, some users was also pretty angry with him.

https://www.zdnet.com/article/a-mysterious-grey-hat-is-patch...

link
nerdsniper 16 days ago
That would be “gray hat”. It would be illegal, though it has happened in the past and to my knowledge no one has yet been prosecuted for illegally fixing vulnerabilities.

But it’s definitely not white hat.

link
CrzyLngPwd 16 days ago
Probably simpler to brick them, forcing the owners to upgrade to a modern and supported device.
link
milkshakes 16 days ago
https://en.wikipedia.org/wiki/BrickerBot
link
stragies 16 days ago
Or upgrade them to modern OpenWrt, which has supported the near identical (minus USB port) D-Link DIR-882 since 2021: https://openwrt.org/toh/d-link/dir-882_a1 , as User 6SixTy has hinted at.
link
6SixTy 16 days ago
I actually have put that firmware on a MR2600, and it boots, not so sure about working well though. Screwing with OpenWRT and a vague sense it has a twin were my only memories of it. I had to retrace my own research from 4 years ago to come up with something worthy of a comment.
link
binaryturtle 16 days ago
Just flash OpenWRT to them? :) (a script could prepare a matching default config)
link
6SixTy 16 days ago
The MR2600 is a rebranded (or same ODM) D Link DIR-882 with a different plastic case, but the MR doesn't come with a rear USB 2.0 port. The FCC photos for each are identical otherwise, right down to the silkscreened board revision.

There's already an OpenWRT image for the DLink model, so coming up with an entry for the Motorola version shouldn't be hard.

link
itintheory 16 days ago
Isn't just as illegal as exploiting them for nefarious purposes? That's a pretty big risk to take to help a few dozen strangers on the Internet. What happens if your fix has an unforeseen interaction with some configuration on a remote system and your actions cause outage or worse?
link