Hacker News Reader

Comment by alar44 | Hacker News Reader

Good.

8ish years ago, I wrote a script to search out Pis with port 22 opened to the internet with default un and pw. Let it run overnight.

The next morning I checked the log and it found thousands of Pis that I could have just logged into with root privileges if I wanted.

Never trust users.

View on HN

Wait, so there's a shortage of IPv4 addresses and people have issues with NAT (including CGNAT) traversal all the time, yet somehow lots of Raspberry Pis end up on the Internet?

There's probably loads of port mapped pi's sitting behind NAT'd routers.

I'm sure it happens but it's hard for me to imagine someone knowledgeable enough to port forward 22 and possibly other ports across their NAT to a Raspberry Pi but not knowledgable enough to realize that enabling themselves to access the Pi over the Internet with the default username and password also enables the same ability for everyone else.

I dunno, Im sure there are lots of people who have opened things up so their xbox/ps/whatever works properly (or just enabled DMZ for everything) - and just added the Pi as they would do for those.

Honestly kinda wild you can’t imagine this person, because when I was in my teens it was me.

You don’t care about security or don’t understand the implications, and why would you!? You’re having fun!

Fun is the deal. If you focus on the fun path you will jump right past any non fun, which is security.

Think about smart kids who get hurt. Were they capable of preventing the injury? Definitely. We’re they having fun? Absolutely. Fun wins every time.

Absolutely! I distinctly remember when i was learning to develop with PHP, and i specifically chose the mysql over mysqli extension (it was at the time mysql was starting to get deprecated because it was vulnerable to SQL injections and what not) because "I don't care about security, it's just a blog I'm developing, nobody would even know it exists".

I still remember the day a young me discovered shodan.io for the first time. before that day, I had no idea just how quick and easy it was for strangers to scan the entirity of the internet and just naively assumed that there was no way anyone could find me or my devices amongst the vastness of the internet. needless to say that was a turning point for me and my security posture when it comes to anything internet-related.

I honestly still can't imagine it, and I was playing with this kind of stuff in my teens as well. Changing default passwords is part of early setup fun, and nothing spoils the fun as much as unwanted visitors in your network. I can imagine being distracted enough to actually forget about it, sure, but I can't imagine outright neglecting to do it because "fun".

I think that sounds extremely likely. You know exactly how the average tinkerer loves to follow tutorials that they don't fully understand.

"Access your raspberry pi from the internet" probably doesn't sound to the layman like anyone can access your raspberry pi with zero effort

Don't underestimate people's laziness. I've seen Pis with the default password being setup in internal networks and then exposed to the Internet (either via an actual public IP or via a port forwarding) without any change. There was even at least one case where the use left the thing like that after my remarks about security, saying it was just a temporary setup and that nobody would find it anyway...

> but it's hard for me to imagine someone knowledgeable enough to port forward 22...

I was supposed to be a "knowledgeable" IT expert, but back in the 90's I managed to open-relay my company's mail server...

I did so many and different walks of shame that week.

Also don't forget the classic case of people simply forgetting that they set something up, likely originally for some very temporary purpose.

Automatic upnp is a thing

Could be uPnP setting up port forwarding

If a distro configures sshd to use UPnP out of the box is deliciously evil. It wouldn't surprise me after some of the shenanigans I've seen through the years.

there is a shortage, while there are plenty of IPv4 addresses. It is an interesting duality.

But just search for "raspberry pi hosting" on your favorite search engine. There are tons of companies providing hosting on Pis, as crazy as it sounds and those come with IPs (but for a semi professional hosting place hopefully with different credentials ... but given how cheap many of those are it's more hope than expectation)

Hehe, I once logged into someone else’s pi by accident because I was not on the WiFi network I expect. The person had his Google credentials in a script in his home folder.

Still, it’s nice that you can get it online so wails but it was obviously not a good idea. Some software they sets WiFi and user info while flashing would be nice.

You mean like this?

https://www.shodan.io/search?query=raspberrypi

Why is the top OS Windows 6.1 on that results page?

When it scans an ip address, it engages with different forms of communication protocols expected of the port, ie it talks email protocols on the email ports and web browser protocols on the web server ports.

Now its possible to change the agent name of software running behind a port, and Shodan almost certainly have some rules which throws up results as per their criteria.

Maybe you should ask their support dept for a comment to your specific question? support@shodan.io

How can you know that they had the default un and pw without logging into them?

Did he say anywhere that he wasn't logging into them :)

> …I could have just logged into with root privileges if I wanted

He did say it, though indirectly :)

[edit: And then I got downvoted. Oh humans. Lol.]

They only logged in as pi -- didn't bother to sudo as root :P

People who don't change the default password probably aren't those that would remove sudo privileges.

I logged in via script. If the login was successful the IP was added to a list. Was younger and stupider.

I bet some of those were internet connected weather stations. We got one built around a Pi.

Lol I thought I was being bad just shoulder surfing for ssh commands.

This is why I run `fail2ban` on my pi.

If I know the default login, how would fail2ban help you? Doesn't it mine only the failures?

Right, I changed the default, and now I ban anyone who tries it.

Then what's making a difference for you is that you changed a default name or password.

fail2ban is nice and all, but irrelevant to this post about a default login.

I guess I should’ve said “Scripts like this…” instead of just “This”.

My entire point being that any client that tries a default account should be insta-banned. That’s what I get from this.

stout policy

fail2ban wouldn't help as he used the default password, it would have let him in. All you have to do is change the password or force key only logins (which is what most security conscious people do)

fail2ban is such a clumsy solution when one can just disable password authentication and change the default port.

It is. If you really want to get after the password scans, iptables and connection tracking. After N number of new connection requests, drop for X minutes.

Any IPs that are trusted, put ahead of that logic.

I know you logged in to some of them... :)

Careful now. That's a felony.

Phew, good to know my Pi is safe from meddling Americans.

Throw some US legalese in the SSH MOTD.

Reply on news.ycombinator.com