5 ms·

There's probably loads of port mapped pi's sitting behind NAT'd routers.

bscphil 5y ago
I'm sure it happens but it's hard for me to imagine someone knowledgeable enough to port forward 22 and possibly other ports across their NAT to a Raspberry Pi but not knowledgable enough to realize that enabling themselves to access the Pi over the Internet with the default username and password also enables the same ability for everyone else.
- bennyp101 5y ago
  I dunno, Im sure there are lots of people who have opened things up so their xbox/ps/whatever works properly (or just enabled DMZ for everything) - and just added the Pi as they would do for those.
- hisnameisjimmy 5y ago
  Honestly kinda wild you can’t imagine this person, because when I was in my teens it was me. You don’t care about security or don’t understand the implications, and why would you!? You’re having fun! Fun is the deal. If you focus on the fun path you will jump right past any non fun, which is security. Think about smart kids who get hurt. Were they capable of preventing the injury? Definitely. We’re they having fun? Absolutely. Fun wins every time.
  - sofixa 5y ago
    Absolutely! I distinctly remember when i was learning to develop with PHP, and i specifically chose the mysql over mysqli extension (it was at the time mysql was starting to get deprecated because it was vulnerable to SQL injections and what not) because "I don't care about security, it's just a blog I'm developing, nobody would even know it exists".
    - shbooms 5y ago
      I still remember the day a young me discovered shodan.io for the first time. before that day, I had no idea just how quick and easy it was for strangers to scan the entirity of the internet and just naively assumed that there was no way anyone could find me or my devices amongst the vastness of the internet. needless to say that was a turning point for me and my security posture when it comes to anything internet-related.
  - seba_dos1 5y ago
    I honestly still can't imagine it, and I was playing with this kind of stuff in my teens as well. Changing default passwords is part of early setup fun, and nothing spoils the fun as much as unwanted visitors in your network. I can imagine being distracted enough to actually forget about it, sure, but I can't imagine outright neglecting to do it because "fun".
- ChrisRR 5y ago
  I think that sounds extremely likely. You know exactly how the average tinkerer loves to follow tutorials that they don't fully understand. "Access your raspberry pi from the internet" probably doesn't sound to the layman like anyone can access your raspberry pi with zero effort
- ale42 5y ago
  Don't underestimate people's laziness. I've seen Pis with the default password being setup in internal networks and then exposed to the Internet (either via an actual public IP or via a port forwarding) without any change. There was even at least one case where the use left the thing like that after my remarks about security, saying it was just a temporary setup and that nobody would find it anyway...
- teh_klev 5y ago
  > but it's hard for me to imagine someone knowledgeable enough to port forward 22... I was supposed to be a "knowledgeable" IT expert, but back in the 90's I managed to open-relay my company's mail server... I did so many and different walks of shame that week.
- bigDinosaur 5y ago
  Also don't forget the classic case of people simply forgetting that they set something up, likely originally for some very temporary purpose.
- shiftpgdn 5y ago
  Automatic upnp is a thing

I'm sure it happens but it's hard for me to imagine someone knowledgeable enough to port forward 22 and possibly other ports across their NAT to a Raspberry Pi but not knowledgable enough to realize that enabling themselves to access the Pi over the Internet with the default username and password also enables the same ability for everyone else.

bennyp101 5y ago
I dunno, Im sure there are lots of people who have opened things up so their xbox/ps/whatever works properly (or just enabled DMZ for everything) - and just added the Pi as they would do for those.
hisnameisjimmy 5y ago
Honestly kinda wild you can’t imagine this person, because when I was in my teens it was me. You don’t care about security or don’t understand the implications, and why would you!? You’re having fun! Fun is the deal. If you focus on the fun path you will jump right past any non fun, which is security. Think about smart kids who get hurt. Were they capable of preventing the injury? Definitely. We’re they having fun? Absolutely. Fun wins every time.
- sofixa 5y ago
  Absolutely! I distinctly remember when i was learning to develop with PHP, and i specifically chose the mysql over mysqli extension (it was at the time mysql was starting to get deprecated because it was vulnerable to SQL injections and what not) because "I don't care about security, it's just a blog I'm developing, nobody would even know it exists".
  - shbooms 5y ago
    I still remember the day a young me discovered shodan.io for the first time. before that day, I had no idea just how quick and easy it was for strangers to scan the entirity of the internet and just naively assumed that there was no way anyone could find me or my devices amongst the vastness of the internet. needless to say that was a turning point for me and my security posture when it comes to anything internet-related.
- seba_dos1 5y ago
  I honestly still can't imagine it, and I was playing with this kind of stuff in my teens as well. Changing default passwords is part of early setup fun, and nothing spoils the fun as much as unwanted visitors in your network. I can imagine being distracted enough to actually forget about it, sure, but I can't imagine outright neglecting to do it because "fun".
ChrisRR 5y ago
I think that sounds extremely likely. You know exactly how the average tinkerer loves to follow tutorials that they don't fully understand. "Access your raspberry pi from the internet" probably doesn't sound to the layman like anyone can access your raspberry pi with zero effort
ale42 5y ago
Don't underestimate people's laziness. I've seen Pis with the default password being setup in internal networks and then exposed to the Internet (either via an actual public IP or via a port forwarding) without any change. There was even at least one case where the use left the thing like that after my remarks about security, saying it was just a temporary setup and that nobody would find it anyway...
teh_klev 5y ago
> but it's hard for me to imagine someone knowledgeable enough to port forward 22... I was supposed to be a "knowledgeable" IT expert, but back in the 90's I managed to open-relay my company's mail server... I did so many and different walks of shame that week.
bigDinosaur 5y ago
Also don't forget the classic case of people simply forgetting that they set something up, likely originally for some very temporary purpose.
shiftpgdn 5y ago
Automatic upnp is a thing