7 ms·

I'm wondering how secure it is.. According to https://github.com/maruos/maruos/wiki/Tips https://github.com/maruos/maruos/wiki/Tips, they start sshd up by defa

I'm wondering how secure it is.. According to https://github.com/maruos/maruos/wiki/Tips https://github.com/maruos/maruos/wiki/Tips, they start sshd up by default, listening on the local network, with the default user maru and password maru. That seems like a bit of a red flag and makes me wonder if it is the tip of the iceberg.

stcredzero 9y ago
That seems like a bit of a red flag A basic and egregious security blunder is more than a bit of a red flag. and makes me wonder if it is the tip of the iceberg. If you already see that the tip sticking out has a mine on it, the tons of iceberg only give you the difference in the degree of egregiously bad.
- throwaway91111 9y ago
  I mean, don't install it on anything with data you care about. This isn't exactly a hardened product.
  - dredmorbius 9y ago
    Escallation attacks are a thing.
  - HenryBemis 9y ago
    +1! The way I see it, this is a "toy" (for the time being). The "2013 devices" makes me thing that this is a "toy" for people like "us" that have a Nexus rotting away somewhere and "it would be cool to fool around on your 30-inch screen and nothing more! It would be better if they would up-front say "this is not secure", "this is a demo", "this is a toy", "this is not the OS you're looking for". Imaginary CEO-CTO dialog: CEO: hey! I just read that we can throw away the PCs and replace them with some old phones that we can buy for $50 on ebay! START!!! CTO: but.. let me explain.. I quit!!
    - sangnoir 9y ago
      > The "2013 devices" makes me thing that this is a "toy" for people like "us" that have a Nexus rotting away somewhere I'm writing this on a 2013 Nexus, thank you very much! A year ago it stopped booting and I tried searching for a newer, comparable tablet to replace it: no such device exists. I ordered a replacement main board and couldn't be happier. Until someone makes a new 7-inch tablet with a full HD display, it will continue to not rot in my hands for a few more years.
      - cyc115 9y ago
        I'm using a N5 as my primary phone... It seems mad to me that the life expectancy of a phone is so short those days. :P
        SubiculumCode 9y ago
        same here...and the only thing bad is the battery life :-/
      - kybernetikos 9y ago
        I was surprised when I came to replace my 7 inch nexus that there wasn't a recent 7 inch tablet from a major player with good reviews. I ended up going for the nVidia Shield tablet K1, which despite being an iteration on a more than 2 year old tablet seemed pretty good. I've been happy with it so far.
    - Fice 9y ago
      What's wrong with "2013 devices"? Nexus 5 probably has more alternative OS choices than any other phone available: LineageOS (based on Android 7.1), Ubuntu Touch (UBports continuation of the project), Plasma Mobile, Sailfish, and Maru OS. And what is the real benefit of having a newer device if the old one is still very capable of running modern OSes and applications?
      - _ao789 9y ago
        You sure you don't want a 5000MP camera? Lol
  - ams6110 9y ago
    > This isn't exactly a hardened product Bolting on security later seldom works well.
    - throwaway91111 9y ago
      It's a POC.
      - piyush_soni 9y ago
        I think it's totally fine to be a POC unless you market it as a finished product (e.g. on your website).
  - morganvachon 9y ago
    Indeed, back when I had a Nexus 5 laying around collecting dust, I gave it a whirl. It was interesting but certainly not ready for prime time. The phone side of the OS was about as bare as could be, and buggy too. The PC side was slow and just as bare. As a gadget enthusiast, I loved tinkering with it. But it is simply not practical for daily use (yet). I think it could end up being a nice FOSS alternative to Microsoft's Continuum project, especially if the developer can get it working on a newer device.
  - PrimHelios 9y ago
    From what I've seen the site doesn't give any indication that it's this insecure. The default assumption should be that an OS is secure, and an OS should be secure by default, with tons of big warnings that something isn't secure. This isn't just "unhardened", this is a lack of basic security, and after Mirai, nobody should be doing this shit.
deleted 9y ago
[deleted]
api 9y ago
Default passwords on things that are on by default is "full stop" bad. This is on the same level as passwords in clear text e-mail.
fredsted 9y ago
Man, why'd they have to go and do that. :-( So many other options: not enabling sshd per default, ask for a password, display a random password on the phone, allow uploading a public key... possibilities are endless.
narrowrail 9y ago
Looking at the Github [0], it looks like a fairly alpha product targeted at technical people and has one contributor. I think giving the project some slack at this point seems reasonable. I guess if there is major concern about this, one could submit a PR? [0]https://github.com/maruos/maruos https://github.com/maruos/maruos
- panic 9y ago
  The website is super polished and doesn't mention anything about being alpha quality. It would be easy to install this on your phone without any idea you were making yourself vulnerable.
  - X-Cubed 9y ago
    It's version 0.4, so it's a pre-release build.
    - rickycook 9y ago
      welllll, so are plenty of packages people install into production software every day. i think pre release means less to people these days. and sure, you can blame it on the people using the software, but that doesn't stop a bunch of ssh servers with default credentials being open to the network.
    - omribahumi 9y ago
      Putty is 18 years old and only reached 0.69
      - vanderZwan 9y ago
        Fair enough, but this project is slightly less than a year old[0], so let's give it the benefit of doubt. [0] https://github.com/maruos/maruos/commits/master https://github.com/maruos/maruos/commits/master
  - contingencies 9y ago
    super polished My definition of super polished includes 'renders without javascript enabled'.
jjrh 9y ago
I don't disagree, it's not exactly a uncommon practice. I think Raspberry pi for instance does this. Not defending it, totally stupid, just pointing out they aren't alone in this. The fact passwords are on by default for sshd on most distributions is crazy.
- harel 9y ago
  Raspbian DID this. They now ship with SSH off by default.
  - jancsika 9y ago
    They should have done this: 1. User tries to SSH to rpi over LAN from their laptop. 2. rpi SSH server sends back a request for a torrent of the 1999 smash hit "The Matrix" 3. laptop sends torrent "The Matrix" iso. 4. If the average latency dips below a threshold value, don't connect. 5. If it's done in five minutes, connect. 6. set rpi's SSH server to key-based authentication for strong keypair that was generated on user's laptop. 7. Done.
    - type0 9y ago
      And suddenly there would be no escape from the matrix, no seriously may I recommend matrix.org for you?
nathancahill 9y ago
iOS jailbreak used to do this, for the root user. The password 'alpine' was the codename for iOS 1.0.
gigatexal 9y ago
after installing it change the password on that user. red flag fixed.
swiley 9y ago
You should leave the default user's password blank on embedded Linux images! Why does everyone set them up with default passwords!? I'm surprised the raspbian maintainers have not realized this yet. sshd won't let you login with an empty password by default.
- jareds 9y ago
  What percent of pi users don't connect a keyboard and monitor? I don't mind having a default password since when ever I've used a pi I ran it headless and configured it on first boot with SSH. It would make sense to force the pi user to change there password on first login, can't remember if this is the case.
  - swiley 9y ago
    You could set it up using the serial console then.
    - WillPostForFood 9y ago
      Does the average Raspberry Pi purchaser have the hardware or knowledge to connect a serial console?
  - pmontra 9y ago
    I almost never do. I ssh into it. To be fair, I had a Pi2 and used it to watch videos but it died and my tablet or my TV+USB key are more convenient to use now. I guess some people would use a Chromecast instead.
  - kingosticks 9y ago
    If I remember correctly, raspi-config starts when you first login and that's a big hint to go and change the password. But after that there's something that nags you to change it but doesn't force you. I think this is entirely reasonable.
z3t4 9y ago
it can be useful for debugging. you can disable it once you get the desktop to work.
pdsouza 9y ago
Preetam here, founder and lead developer of Maru. Thank you for all the critical feedback on security in this thread. Maru used to ship with sshd disabled [0] but it was enabled because of all the requests I was getting from users who wanted to run the system headless without needing an HDMI display and BT keyboard/mouse around to set sshd up. I assumed that users would change the default password after the initial login, but as many of you have pointed out, hope is not a strategy when it comes to security. I've opened up an issue [1] to fix this. Please feel free to open up issues (or, even better, PRs!) at any time if you have further suggestions for improvement. It's thanks to feedback like this that Maru continues to move onwards and upwards. [0]: https://github.com/maruos/maruos/issues/22#issuecomment-229692011 https://github.com/maruos/maruos/issues/22#issuecomment-2296... [1]: https://github.com/maruos/maruos/issues/76 https://github.com/maruos/maruos/issues/76
- josephg 9y ago
  There's is a fundamental issue here that comes up with lots of small organizations around security: If your process for prioritizing work is based on which issues people complain about the most, you will never prioritize security issues until its too late. Security problems are never obvious until the horse bolts. It is very easy to accidentally add egregious security vulnerabilities to products if you don't know what you're doing. In fact, accruing small security issues (like this SSH password problem) is the default state of the world. As a user, I pay the cost when products I use have bad security. If I get hacked via your product, it might be embarrassing for you, but its my device and my data that gets compromised. And because of that, I expect most small companies will not care about their product's security as much as I do as a consumer. Of course, once a company grows large enough they'll hire a person or a team to look into their software security. At that point they'll fix all the obvious security issues. The database will gain a password. The root AWS account will stop being shared out amongst employees. Work laptops will have full disk encryption turned on to protect against theft, etc. But until then, as a customer, I should be really nervous. How can you tell the secure products apart from the insecure ones? Well, one of the most obvious signs is that secure products will have already fixed the obvious mistakes. Things like connecting to backend services using unencrypted HTTP. Things like a backdoor-by-default SSH password published on the website. That is why we (security wonks) make a big deal out of small security problems when they're obvious. They're a sign that nobody has even taken a look at the security situation, and for every obvious problem there's probably 10 more that aren't obvious. This issue might get fixed, but thats why your reply doesn't make me less nervous. --- And thats a shame, because your project seems super cool and I really want you to succeed! This has come across much more negative than I intended, and I'm more frustrated at the startup industry over this than I am frustrated with you or what you're doing. Hopefully you can get a security review done at some point to make sure there aren't any other simple problems that need to be dealt with. I'm looking forward to seeing where it goes.
kbart 9y ago
There are legitimate use cases for sshd with default logins. Headless and embedded systems come to mind first. Of course, this should not reach production stage.
squarefoot 9y ago
Based on Android, which unless I missed something huge, translates into all device drivers and most apps being closed source and requiring full access to anything, that is, the best place to put malware into. To me it can appear more secure if compared to the usual bloatware ridden smartphone, but a Linux PC with all software, including most drivers, being OSS, is a different story.

stcredzero 9y ago

That seems like a bit of a red flag A basic and egregious security blunder is more than a bit of a red flag. and makes me wonder if it is the tip of the iceberg. If you already see that the tip sticking out has a mine on it, the tons of iceberg only give you the difference in the degree of egregiously bad.

throwaway91111 9y ago
I mean, don't install it on anything with data you care about. This isn't exactly a hardened product.
- dredmorbius 9y ago
  Escallation attacks are a thing.
- HenryBemis 9y ago
  +1! The way I see it, this is a "toy" (for the time being). The "2013 devices" makes me thing that this is a "toy" for people like "us" that have a Nexus rotting away somewhere and "it would be cool to fool around on your 30-inch screen and nothing more! It would be better if they would up-front say "this is not secure", "this is a demo", "this is a toy", "this is not the OS you're looking for". Imaginary CEO-CTO dialog: CEO: hey! I just read that we can throw away the PCs and replace them with some old phones that we can buy for $50 on ebay! START!!! CTO: but.. let me explain.. I quit!!
  - sangnoir 9y ago
    > The "2013 devices" makes me thing that this is a "toy" for people like "us" that have a Nexus rotting away somewhere I'm writing this on a 2013 Nexus, thank you very much! A year ago it stopped booting and I tried searching for a newer, comparable tablet to replace it: no such device exists. I ordered a replacement main board and couldn't be happier. Until someone makes a new 7-inch tablet with a full HD display, it will continue to not rot in my hands for a few more years.
    - cyc115 9y ago
      I'm using a N5 as my primary phone... It seems mad to me that the life expectancy of a phone is so short those days. :P
      - SubiculumCode 9y ago
        same here...and the only thing bad is the battery life :-/
    - kybernetikos 9y ago
      I was surprised when I came to replace my 7 inch nexus that there wasn't a recent 7 inch tablet from a major player with good reviews. I ended up going for the nVidia Shield tablet K1, which despite being an iteration on a more than 2 year old tablet seemed pretty good. I've been happy with it so far.
  - Fice 9y ago
    What's wrong with "2013 devices"? Nexus 5 probably has more alternative OS choices than any other phone available: LineageOS (based on Android 7.1), Ubuntu Touch (UBports continuation of the project), Plasma Mobile, Sailfish, and Maru OS. And what is the real benefit of having a newer device if the old one is still very capable of running modern OSes and applications?
    - _ao789 9y ago
      You sure you don't want a 5000MP camera? Lol
- ams6110 9y ago
  > This isn't exactly a hardened product Bolting on security later seldom works well.
  - throwaway91111 9y ago
    It's a POC.
    - piyush_soni 9y ago
      I think it's totally fine to be a POC unless you market it as a finished product (e.g. on your website).
- morganvachon 9y ago
  Indeed, back when I had a Nexus 5 laying around collecting dust, I gave it a whirl. It was interesting but certainly not ready for prime time. The phone side of the OS was about as bare as could be, and buggy too. The PC side was slow and just as bare. As a gadget enthusiast, I loved tinkering with it. But it is simply not practical for daily use (yet). I think it could end up being a nice FOSS alternative to Microsoft's Continuum project, especially if the developer can get it working on a newer device.
- PrimHelios 9y ago
  From what I've seen the site doesn't give any indication that it's this insecure. The default assumption should be that an OS is secure, and an OS should be secure by default, with tons of big warnings that something isn't secure. This isn't just "unhardened", this is a lack of basic security, and after Mirai, nobody should be doing this shit.

deleted 9y ago

[deleted]

api 9y ago

Default passwords on things that are on by default is "full stop" bad. This is on the same level as passwords in clear text e-mail.

fredsted 9y ago

Man, why'd they have to go and do that. :-( So many other options: not enabling sshd per default, ask for a password, display a random password on the phone, allow uploading a public key... possibilities are endless.

narrowrail 9y ago

Looking at the Github [0], it looks like a fairly alpha product targeted at technical people and has one contributor. I think giving the project some slack at this point seems reasonable. I guess if there is major concern about this, one could submit a PR? [0]https://github.com/maruos/maruos https://github.com/maruos/maruos

panic 9y ago
The website is super polished and doesn't mention anything about being alpha quality. It would be easy to install this on your phone without any idea you were making yourself vulnerable.
- X-Cubed 9y ago
  It's version 0.4, so it's a pre-release build.
  - rickycook 9y ago
    welllll, so are plenty of packages people install into production software every day. i think pre release means less to people these days. and sure, you can blame it on the people using the software, but that doesn't stop a bunch of ssh servers with default credentials being open to the network.
  - omribahumi 9y ago
    Putty is 18 years old and only reached 0.69
    - vanderZwan 9y ago
      Fair enough, but this project is slightly less than a year old[0], so let's give it the benefit of doubt. [0] https://github.com/maruos/maruos/commits/master https://github.com/maruos/maruos/commits/master
- contingencies 9y ago
  super polished My definition of super polished includes 'renders without javascript enabled'.

jjrh 9y ago

I don't disagree, it's not exactly a uncommon practice. I think Raspberry pi for instance does this. Not defending it, totally stupid, just pointing out they aren't alone in this. The fact passwords are on by default for sshd on most distributions is crazy.

harel 9y ago
Raspbian DID this. They now ship with SSH off by default.
- jancsika 9y ago
  They should have done this: 1. User tries to SSH to rpi over LAN from their laptop. 2. rpi SSH server sends back a request for a torrent of the 1999 smash hit "The Matrix" 3. laptop sends torrent "The Matrix" iso. 4. If the average latency dips below a threshold value, don't connect. 5. If it's done in five minutes, connect. 6. set rpi's SSH server to key-based authentication for strong keypair that was generated on user's laptop. 7. Done.
  - type0 9y ago
    And suddenly there would be no escape from the matrix, no seriously may I recommend matrix.org for you?

nathancahill 9y ago

iOS jailbreak used to do this, for the root user. The password 'alpine' was the codename for iOS 1.0.

gigatexal 9y ago

after installing it change the password on that user. red flag fixed.

swiley 9y ago

You should leave the default user's password blank on embedded Linux images! Why does everyone set them up with default passwords!? I'm surprised the raspbian maintainers have not realized this yet. sshd won't let you login with an empty password by default.

jareds 9y ago
What percent of pi users don't connect a keyboard and monitor? I don't mind having a default password since when ever I've used a pi I ran it headless and configured it on first boot with SSH. It would make sense to force the pi user to change there password on first login, can't remember if this is the case.
- swiley 9y ago
  You could set it up using the serial console then.
  - WillPostForFood 9y ago
    Does the average Raspberry Pi purchaser have the hardware or knowledge to connect a serial console?
- pmontra 9y ago
  I almost never do. I ssh into it. To be fair, I had a Pi2 and used it to watch videos but it died and my tablet or my TV+USB key are more convenient to use now. I guess some people would use a Chromecast instead.
- kingosticks 9y ago
  If I remember correctly, raspi-config starts when you first login and that's a big hint to go and change the password. But after that there's something that nags you to change it but doesn't force you. I think this is entirely reasonable.

z3t4 9y ago

it can be useful for debugging. you can disable it once you get the desktop to work.

pdsouza 9y ago

Preetam here, founder and lead developer of Maru. Thank you for all the critical feedback on security in this thread. Maru used to ship with sshd disabled [0] but it was enabled because of all the requests I was getting from users who wanted to run the system headless without needing an HDMI display and BT keyboard/mouse around to set sshd up. I assumed that users would change the default password after the initial login, but as many of you have pointed out, hope is not a strategy when it comes to security. I've opened up an issue [1] to fix this. Please feel free to open up issues (or, even better, PRs!) at any time if you have further suggestions for improvement. It's thanks to feedback like this that Maru continues to move onwards and upwards. [0]: https://github.com/maruos/maruos/issues/22#issuecomment-229692011 https://github.com/maruos/maruos/issues/22#issuecomment-2296... [1]: https://github.com/maruos/maruos/issues/76 https://github.com/maruos/maruos/issues/76

josephg 9y ago
There's is a fundamental issue here that comes up with lots of small organizations around security: If your process for prioritizing work is based on which issues people complain about the most, you will never prioritize security issues until its too late. Security problems are never obvious until the horse bolts. It is very easy to accidentally add egregious security vulnerabilities to products if you don't know what you're doing. In fact, accruing small security issues (like this SSH password problem) is the default state of the world. As a user, I pay the cost when products I use have bad security. If I get hacked via your product, it might be embarrassing for you, but its my device and my data that gets compromised. And because of that, I expect most small companies will not care about their product's security as much as I do as a consumer. Of course, once a company grows large enough they'll hire a person or a team to look into their software security. At that point they'll fix all the obvious security issues. The database will gain a password. The root AWS account will stop being shared out amongst employees. Work laptops will have full disk encryption turned on to protect against theft, etc. But until then, as a customer, I should be really nervous. How can you tell the secure products apart from the insecure ones? Well, one of the most obvious signs is that secure products will have already fixed the obvious mistakes. Things like connecting to backend services using unencrypted HTTP. Things like a backdoor-by-default SSH password published on the website. That is why we (security wonks) make a big deal out of small security problems when they're obvious. They're a sign that nobody has even taken a look at the security situation, and for every obvious problem there's probably 10 more that aren't obvious. This issue might get fixed, but thats why your reply doesn't make me less nervous. --- And thats a shame, because your project seems super cool and I really want you to succeed! This has come across much more negative than I intended, and I'm more frustrated at the startup industry over this than I am frustrated with you or what you're doing. Hopefully you can get a security review done at some point to make sure there aren't any other simple problems that need to be dealt with. I'm looking forward to seeing where it goes.

kbart 9y ago

There are legitimate use cases for sshd with default logins. Headless and embedded systems come to mind first. Of course, this should not reach production stage.

squarefoot 9y ago

Based on Android, which unless I missed something huge, translates into all device drivers and most apps being closed source and requiring full access to anything, that is, the best place to put malware into. To me it can appear more secure if compared to the usual bloatware ridden smartphone, but a Linux PC with all software, including most drivers, being OSS, is a different story.