10 ms·
Good. 8ish years ago, I wrote a script to search out Pis with port 22 opened to the internet with default un and pw. Let it run overnight. The next morning I
by alar44 5y ago
Good.
8ish years ago, I wrote a script to search out Pis with port 22 opened to the internet with default un and pw. Let it run overnight.
The next morning I checked the log and it found thousands of Pis that I could have just logged into with root privileges if I wanted.
Never trust users.
- jbaczuk 5y agoI know you logged in to some of them... :)
- teaearlgraycold 5y agoCareful now. That's a felony.
- simondotau 5y agoPhew, good to know my Pi is safe from meddling Americans.
- teaearlgraycold 5y agoThrow some US legalese in the SSH MOTD.
- deleted 5y ago[deleted]
- exfascist 5y agoLol I thought I was being bad just shoulder surfing for ssh commands.
- abnry 5y agoHow can you know that they had the default un and pw without logging into them?
- xarball 5y agoDid he say anywhere that he wasn't logging into them :)
- justinpowers 5y ago> …I could have just logged into with root privileges if I wanted He did say it, though indirectly :) [edit: And then I got downvoted. Oh humans. Lol.]
- veonik 5y agoThey only logged in as pi -- didn't bother to sudo as root :P
- RealStickman_ 5y agoPeople who don't change the default password probably aren't those that would remove sudo privileges.
- alar44 5y agoI logged in via script. If the login was successful the IP was added to a list. Was younger and stupider.
- ciupicri 5y agoWait, so there's a shortage of IPv4 addresses and people have issues with NAT (including CGNAT) traversal all the time, yet somehow lots of Raspberry Pis end up on the Internet?
- teh_klev 5y agoThere's probably loads of port mapped pi's sitting behind NAT'd routers.
- bscphil 5y agoI'm sure it happens but it's hard for me to imagine someone knowledgeable enough to port forward 22 and possibly other ports across their NAT to a Raspberry Pi but not knowledgable enough to realize that enabling themselves to access the Pi over the Internet with the default username and password also enables the same ability for everyone else.
- bennyp101 5y agoI dunno, Im sure there are lots of people who have opened things up so their xbox/ps/whatever works properly (or just enabled DMZ for everything) - and just added the Pi as they would do for those.
- hisnameisjimmy 5y agoHonestly kinda wild you can’t imagine this person, because when I was in my teens it was me. You don’t care about security or don’t understand the implications, and why would you!? You’re having fun! Fun is the deal. If you focus on the fun path you will jump right past any non fun, which is security. Think about smart kids who get hurt. Were they capable of preventing the injury? Definitely. We’re they having fun? Absolutely. Fun wins every time.
- sofixa 5y agoAbsolutely! I distinctly remember when i was learning to develop with PHP, and i specifically chose the mysql over mysqli extension (it was at the time mysql was starting to get deprecated because it was vulnerable to SQL injections and what not) because "I don't care about security, it's just a blog I'm developing, nobody would even know it exists".
- jachee 5y agoThis is why I run `fail2ban` on my pi.
- spydum 5y agoIf I know the default login, how would fail2ban help you? Doesn't it mine only the failures?
- jachee 5y agoRight, I changed the default, and now I ban anyone who tries it.
- Brian_K_White 5y agoThen what's making a difference for you is that you changed a default name or password. fail2ban is nice and all, but irrelevant to this post about a default login.
- jachee 5y agoI guess I should’ve said “Scripts like this…” instead of just “This”. My entire point being that any client that tries a default account should be insta-banned. That’s what I get from this.
- Brian_K_White 5y agostout policy
- stjohnswarts 5y agofail2ban wouldn't help as he used the default password, it would have let him in. All you have to do is change the password or force key only logins (which is what most security conscious people do)
- oynqr 5y agofail2ban is such a clumsy solution when one can just disable password authentication and change the default port.
- Terry_Roll 5y agoYou mean like this? https://www.shodan.io/search?query=raspberrypi https://www.shodan.io/search?query=raspberrypi
- tymscar 5y agoWhy is the top OS Windows 6.1 on that results page?
- Terry_Roll 5y agoWhen it scans an ip address, it engages with different forms of communication protocols expected of the port, ie it talks email protocols on the email ports and web browser protocols on the web server ports. Now its possible to change the agent name of software running behind a port, and Shodan almost certainly have some rules which throws up results as per their criteria. Maybe you should ask their support dept for a comment to your specific question? support@shodan.io
- teekert 5y agoHehe, I once logged into someone else’s pi by accident because I was not on the WiFi network I expect. The person had his Google credentials in a script in his home folder. Still, it’s nice that you can get it online so wails but it was obviously not a good idea. Some software they sets WiFi and user info while flashing would be nice.
- protomyth 5y agoI bet some of those were internet connected weather stations. We got one built around a Pi.