# Nodered hacked by adding invisible nodes
**URL:** https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860
**Category:** General
**Tags:** security
**Created:** [20 December 2023 08:54 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860 "2023-12-20T08:54:44Z")
**Posts on this page:** 20
**Page:** 2
### Author:  [@iznogoud320](https://discourse.nodered.org/u/iznogoud320)
#### Post date: [20 December 2023 13:17 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/21 "2023-12-20T13:17:00Z")
> [@jbudd](#):
>
> What device and operating system do you run Node-red on?
LePotato device (Pi3 equivalent) running armbian 23.02
> [@jbudd](#):
>
> If Linux, what username did you use to install Node-red?
sudo and main user (the only one in fact)
> [@jbudd](#):
>
> Does this user have permission to use sudo without a password?
No, password needed.
> [@jbudd](#):
>
> You have obviously changed this password! Can you give us an idea of the old password - how many characters, did it use both upper and lower case, any special characters?
8 chars, letters upper and lower case + 2 special characters
> [@jbudd](#):
>
> Was it a common "I really should change that" password such as "Password1"?
Nope
> [@jbudd](#):
>
> You had port forwarding enabled - was it internal port 1883?
1880
> [@jbudd](#):
>
> Was the external forwarded port also 1883? ie 1883 forwarded to 1883?
yes. I tried initially at set up to use another one on router 1 but I don't know why, there were somme issue with the https certificate. So everything was routed 1880-\>1880-\>1880
> [@jbudd](#):
>
> How long ago did you setup port forwarding?
A few month.
---
### Author:  [@jbudd](https://discourse.nodered.org/u/jbudd)
#### Post date: [20 December 2023 13:18 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/22 "2023-12-20T13:18:43Z")
Thanks. Yes, I meant 1880. Slip of the brain. 😃
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [20 December 2023 13:22 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/23 "2023-12-20T13:22:05Z")
Obligatory xkcd about password length
> **[Password Strength](https://xkcd.com/936/)**
>
> To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.
---
### Author:  [@jbudd](https://discourse.nodered.org/u/jbudd)
#### Post date: [20 December 2023 13:23 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/24 "2023-12-20T13:23:58Z")
Sorry, one more question: Was the Node-red editor password protected?
---
### Author:  [@iznogoud320](https://discourse.nodered.org/u/iznogoud320)
#### Post date: [20 December 2023 13:35 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/25 "2023-12-20T13:35:11Z")
> [@jbudd](#):
>
> Sorry, one more question: Was the Node-red editor password protected?
Yes, Both nodered editor and dashboard were password protected.
Password were the same but different username
---
### Author:  [@Colin](https://discourse.nodered.org/u/Colin)
#### Post date: [20 December 2023 13:56 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/26 "2023-12-20T13:56:25Z")
Had you checked that http access did not work?
We have not seen any cases of hacking (as far as we are aware) that required a password.
---
### Author:  [@iznogoud320](https://discourse.nodered.org/u/iznogoud320)
#### Post date: [20 December 2023 14:26 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/27 "2023-12-20T14:26:22Z")
As far as I know http was not enabled.
But for sure I might have made a mistake somewhere in the configuration. Like I said I'm not an expert and basically did the config reading papers on the net.
That's also why I thought about the discord node because the coincidence of the timing was surprising and to me a hack with https enabled was unlikely. So there is probably something else.
---
### Author:  [@Colin](https://discourse.nodered.org/u/Colin)
#### Post date: [20 December 2023 14:30 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/28 "2023-12-20T14:30:34Z")
Actually, if using brute force password guessing, which apparently can be broken in a few days with a 10 char pwd, using https won't help.
---
### Author:  [@smanjunath211](https://discourse.nodered.org/u/smanjunath211)
#### Post date: [20 December 2023 14:57 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/29 "2023-12-20T14:57:25Z")
I am changing all my passwords now. 😀
---
### Author:  [@bakman2](https://discourse.nodered.org/u/bakman2)
#### Post date: [20 December 2023 16:21 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/30 "2023-12-20T16:21:09Z")
Still dubious if someone would go to that length to crack some password on an individual.
@iznogoud320 did you verify all (open) ports from the outside ? with grc or some other service ?
---
### Author:  [@HaroldPetersInskipp](https://discourse.nodered.org/u/HaroldPetersInskipp)
#### Post date: [20 December 2023 16:30 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/31 "2023-12-20T16:30:35Z")
Can confirm that there is more than one hacker. If you see a flow labeled "SpiderPig420" or have nodes hidden in the bottom right corner of a flow with an exec node to pull a bash script then you have been compromised. I have seen this across dozens of unsecured node-red servers that can be found with a simple Google dork.
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [20 December 2023 17:06 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/32 "2023-12-20T17:06:46Z")
Not surprising. They often work in groups - lone hackers are actually pretty rare. Sometimes they work at industrial scale, especially at the nation-state supported level.
> [@HaroldPetersInskipp](#):
>
> I have seen this across dozens of unsecured node-red servers that can be found with a simple Google dork.
Yes, and of course there are specialist tools that will discover these things anyway.
* * *
The price of success I'm afraid. Based on forum posts alone, I think we've seen a really big increase in numbers over the last year. So inevitable that hackers would eventually get wise even if at least one of them wasn't also into home automation!
---
### Author:  [@iznogoud320](https://discourse.nodered.org/u/iznogoud320)
#### Post date: [20 December 2023 17:20 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/33 "2023-12-20T17:20:30Z")
> [@bakman2](#):
>
> @iznogoud320 did you verify all (open) ports from the outside ? with grc or some other service ?
Do you mean that a port could be open even if the router interface says it isn't?
I haven't tested from outside but the only port officially routed were 1880 for nodered and 80 for certbot. And that was only tested from inside. I mean I connected to router 1 locally with my mobile and tested the opened ports on router 2 with Net Analyzer on android.
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [20 December 2023 17:25 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/34 "2023-12-20T17:25:15Z")
There are plenty of port scanners - the [grc.com](http://grc.com) site has one that can be trusted.
A badly configured router might expose various ports. That bad config might come from the router manufacturer or your ISP. Some routers for example exposed UPNP to the Internet which is easily hacked to open ports. Check for firmware updates and, if the routers are old and/or default ISP routers, consider whether they are still safe to use (do some internet searching, router vulnerabilities are generally well published over time). Also check that you aren't using default passwords on them.
Don't rely on a mobile device to do security scanning. There are too many other things going on that might interfere.
---
### Author:  [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)
#### Post date: [20 December 2023 18:26 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/35 "2023-12-20T18:26:44Z")
> [@TotallyInformation](#):
>
> A badly configured router might expose various ports
Hi Julian,
Could [node-red-contrib-portscan](https://flows.nodered.org/node/node-red-contrib-portscan) be of any use for this. So that you run a scan from time to time and send a notification when unexpected ports open. I see that it is designed for LAN so not sure if it works to monitor a WAN port...
Of course you might say that it is not a good idea to run such a scan from Node-RED, because once Node-RED is compromised they can stop the scanning. However you can also say: if the scan has always been ok, then your hack won't be caused by an (incorrect) open port so it doesn't matter anymore if they stop the scan. Or am I mistaken somehow?
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [20 December 2023 21:53 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/36 "2023-12-20T21:53:00Z")
I'm afraid not for router scans. Unless you are scanning someone else's router of course or running Node-RED on a cloud server so that you can scan your wan ports - but that is a bit of a circular issue!
What you could do would be to have a flow that uses one of the scan services from time-to-time. That would work. Or there are doubtless plenty of services out there that will do this kind of thing for you. If you are lucky enough to be part of the UK public sector, including the NHS, you can use the National Cyber Security Centre's fantastic services that periodically check defined endpoints for issues. 🙂
---
### Author:  [@kevinGodell](https://discourse.nodered.org/u/kevinGodell)
#### Post date: [21 December 2023 02:16 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/37 "2023-12-21T02:16:37Z")
If you were using a hashed password, did the hash begin with `$2b$08`? If you must expose anything with a password, then at least hash it with a higher cost. You could probably use 15 or higher on your setup, if you don't mind being slowed down ever so slightly when logging in. The built-in `node-red admin hash-pw` seems to only use 8 rounds, which is a little too low for modern hardware. Hashing the password yourself and using a higher cost won't stop the brute force, but it might slow the baddies and give you a little time to notice the attempt to gain access.
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [21 December 2023 10:03 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/38 "2023-12-21T10:03:01Z")
Or better still, just don't use it at all and use a 3rd-party tool to secure access to the Editor properly. 🙂
---
### Author:  [@jodelkoenig](https://discourse.nodered.org/u/jodelkoenig)
#### Post date: [21 December 2023 10:57 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/39 "2023-12-21T10:57:25Z")
Exactly this ... 😃
---
### Author:  [@iznogoud320](https://discourse.nodered.org/u/iznogoud320)
#### Post date: [22 December 2023 05:32 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/40 "2023-12-22T05:32:35Z")
> [@kevinGodell](#):
>
> If you were using a hashed password, did the hash begin with `$2b$08`? If you must expose anything with a password, then at least hash it with a higher cost. You could probably use 15 or higher on your
I don't know and I haven't kept a copy of nodered settings to check .
But yes i did use nodered tool to hash it.
[Previous page](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860.md?page=1)
[Next page](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860.md?page=3)