4 ms·

The pi-hole I was running on Raspberry Pi got hacked. I only noticed the traffic when something unusual showed up on my node app console

haswell 5y ago
Was the Pi running public facing services? How did this occur?
- qwertyuiop_ 5y ago
  No it was internal facing behind cable router. There must have been some vulnerability in the pinhole or os. They breached the router
  - chrisfinazzo 5y ago
    Yikes. As much as I want to look into PiVPN, things like this give me pause.
    - purpmint008 5y ago
      Wireguard is the only service that I bother to expose. It's stealth and has mitigations for DOS attacks.
      - chrisfinazzo 5y ago
        Do you have a good guide for this? I sort of grok that the Pi (server) setup is different from the devices (clients) that will use it, but it’s always good to check assumptions. I already run PiHole, but I might run this on a different box just to keep things simple. Also, last I checked - port 51820 is reasonably well known, is it safe to use this default when forwarding traffic?
  - gigel82 5y ago
    That feels weird somehow. I highly doubt PiHole is the culprit. If you're only using it internal to your LAN for DNS there is no way someone from outside can touch it. You most likely have other, bigger problems with your network (perhaps the WiFi password was discovered by someone, or you're exposing other vulnerable services to the web directly).
    - wwn_se 5y ago
      Accually there's several ways, XSS for example. But I agree that there's something other that's not ok. Compromised client (probably a computer) or a compromised router is my guesses.
    - dev_throw 5y ago
      Agreed, I managed to achieve this by port forwarding port 53 in my router settings. This allows hackers to enlist you in their DNS amplification attacks so please never do this.
southerntofu 5y ago
To be fair, that was probably due to something else than the DNS stack. For example, i assume the web interface downloads countless dependencies from a 3rd party repo (such as npmjs), any of which could have been victim of a hostile takeover. DNS is nowadays very robust and secure, and if you have unattended-upgrades configured there's literally zero reason to be frightened by DNS.

haswell 5y ago

Was the Pi running public facing services? How did this occur?

qwertyuiop_ 5y ago
No it was internal facing behind cable router. There must have been some vulnerability in the pinhole or os. They breached the router
- chrisfinazzo 5y ago
  Yikes. As much as I want to look into PiVPN, things like this give me pause.
  - purpmint008 5y ago
    Wireguard is the only service that I bother to expose. It's stealth and has mitigations for DOS attacks.
    - chrisfinazzo 5y ago
      Do you have a good guide for this? I sort of grok that the Pi (server) setup is different from the devices (clients) that will use it, but it’s always good to check assumptions. I already run PiHole, but I might run this on a different box just to keep things simple. Also, last I checked - port 51820 is reasonably well known, is it safe to use this default when forwarding traffic?
- gigel82 5y ago
  That feels weird somehow. I highly doubt PiHole is the culprit. If you're only using it internal to your LAN for DNS there is no way someone from outside can touch it. You most likely have other, bigger problems with your network (perhaps the WiFi password was discovered by someone, or you're exposing other vulnerable services to the web directly).
  - wwn_se 5y ago
    Accually there's several ways, XSS for example. But I agree that there's something other that's not ok. Compromised client (probably a computer) or a compromised router is my guesses.
  - dev_throw 5y ago
    Agreed, I managed to achieve this by port forwarding port 53 in my router settings. This allows hackers to enlist you in their DNS amplification attacks so please never do this.

southerntofu 5y ago

To be fair, that was probably due to something else than the DNS stack. For example, i assume the web interface downloads countless dependencies from a 3rd party repo (such as npmjs), any of which could have been victim of a hostile takeover. DNS is nowadays very robust and secure, and if you have unattended-upgrades configured there's literally zero reason to be frightened by DNS.