# Nodered hacked by adding invisible nodes
**URL:** https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860
**Category:** General
**Tags:** security
**Created:** [20 December 2023 08:54 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860 "2023-12-20T08:54:44Z")
**Posts on this page:** 20
**Page:** 6
### Author:  [@gregorius](https://discourse.nodered.org/u/gregorius)
#### Post date: [5 January 2024 16:36 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/101 "2024-01-05T16:36:35Z")
> [@TotallyInformation](#):
>
> So we shouldn't be over-engineering Node-RED to compensate.
That's my biggest fear TBH. I really like Node-RED for its flexibility and allroundedness - it's just a visual frontend for coding NodeJS after all 😉
But as more people get into it, the more the pressure will be there to make it do everything - a good example of what can happen is the Ruby on Rails framework that - sorry to say, IMO - has become bloated and inflexible. Updates are hard and everyday more stuff is being added.
I really believe that more time should be invested in finding ways to provide even more extension possibilities (such as more events being generated at specific points in the start up phase) than pushing more functionality into Node-RED ... less is more!
---
### Author:  [@jbudd](https://discourse.nodered.org/u/jbudd)
#### Post date: [5 January 2024 17:05 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/102 "2024-01-05T17:05:30Z")
> [@TotallyInformation](#):
>
> I think even in a home environment some people might have a default gateway that wasn't their router.
It's hardly proof either way but some of my Raspberries with Node-red cannot connect to my 5GHz only router (192.168.1.1) so there is a 2.4GHz access point at 192.168.1.2. Nevertheless the Pies know the correct gateway:
```auto
route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.1.1 0.0.0.0 UG 600 0 0 wlan0
192.168.1.0 0.0.0.0 255.255.255.0 U 600 0 0 wlan0
```
Is it really true that a connection forwarded from beyond the router appears to have the gateway IP?
Using @marcus-j-davies' [whitelisting strategy](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990) NR can easily whitelist all possible private IPs. But if the gateway IP has to be excluded it's much more difficult. NR might be installed at one location (school) to use at another (home) or used at multiple locations.
---
### Author:  [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)
#### Post date: [5 January 2024 17:30 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/103 "2024-01-05T17:30:05Z")
> [@jbudd](#):
>
> Is it really true that a connection forwarded from beyond the router appears to have the gateway IP?
Unless I have got the current discussion point wrong (entirely possible, it is Friday 😀)
But the IP info that is forwarded by the gateway does retain the original IP header info.
I momentarily opened up my NR (port forward), where a HTTP node just wrote out `req.ip`
This is the IP my mobile phone was reported to have (I disabled WiFi on my phone), so does not appear to be my router or gateway
If I am not mistaken, the reported IP will be the last node to enter the WAN space.
Example : my mobile provider likely has various routers/gateways before my mobile enters the WAN space and the below IP address will likely be the last Node to forward traffic to my gateway/router (at least when speaking about WAN)
Many mobile phones will have this same IP for the same provider (and likely same region)
---
### Author:  [@jbudd](https://discourse.nodered.org/u/jbudd)
#### Post date: [5 January 2024 18:11 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/104 "2024-01-05T18:11:07Z")
Thanks. So in that instance at least, NR does know that the connection is from a public (routable?) IP address. It certainly makes sense that it should know that.
So your scheme can perhaps safely whitelist all private IPs, thus by default allowing connection from devices on the LAN but forbidding it from the Internet (including your phone).
I think that would be effective on all platforms too.
No idea about any impact of IPv6
---
### Author:  [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)
#### Post date: [5 January 2024 18:17 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/105 "2024-01-05T18:17:26Z")
Yup - that is my understanding.
The IP address `blocklist` class I use (but in reverse)
I believe supports ipV6 - but I think you have to specify that it is an IPv6 address (as it defaults to v4)
its says v21 - but blocklist was given to us with Node v15
[https://nodejs.org/api/net.html#class-netblocklist](https://nodejs.org/api/net.html#class-netblocklist)
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [5 January 2024 21:59 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/106 "2024-01-05T21:59:57Z")
OK - one quick thing I have done is to change the Pi/Debian/Ubuntu install script to always run the node-red admin init if there is no settings.js file (IE clean install) - such that that then asks you to set up an admin password. Previously the default was to timeout and skip that. Now the default is to run it, with a command line option --no-init for those wishing to script up installs with no interaction.
I've also proposed a PR for the node-red-admin to make the language stronger around the do you want a password question - and if the answer is no then to set the bind address to 127.0.0.1 only.
Obviously there could be more - as per blocklists allowlists etc - but ideas on making those easy to setup much appreciated.
PS - I realise this is only for users of "the script", but hopefully those are the main users we are trying to catch/help right now.
PPS - PRs also considered for the script as well as ideas 🙂
PPPS - the latest script should also now fix both nodejs install on bookworm and GPIO read/write on Pi5.
---
### Author:  [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)
#### Post date: [5 January 2024 22:10 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/107 "2024-01-05T22:10:59Z")
> [@dceejay](#):
>
> I've also proposed a PR for the node-red-admin to make the language stronger around the do you want a password question - and if the answer is no then to set the bind address to 127.0.0.1 only.
An extremely potent change (for the good) - Nice work @dceejay 🙏
> [@dceejay](#):
>
> Obviously there could be more - as per blocklists allowlists etc - but ideas on making those easy to setup much appreciated.
Whilst what I posted seems small and certainly isn't "the answer" , can be the difference to a whole Network being compromised and not.
again - I like where (all) this is going - kudos
---
### Author:  [@GogoVega](https://discourse.nodered.org/u/GogoVega)
#### Post date: [5 January 2024 22:22 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/108 "2024-01-05T22:22:54Z")
> [@dceejay](#):
>
> I've also proposed a PR for the node-red-admin to make the language stronger around the do you want a password question - and if the answer is no then to set the bind address to 127.0.0.1 only.
I would add a note on what a local bind implies - to avoid future "cannot access NR from another device"
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [5 January 2024 22:31 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/109 "2024-01-05T22:31:21Z")
I did think that but I can be sure few would read anything I add after they have made their choice. But yes will try to rethink that
---
### Author:  [@jbudd](https://discourse.nodered.org/u/jbudd)
#### Post date: [6 January 2024 12:29 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/110 "2024-01-06T12:29:31Z")
👍 I'm certainly in favour of making it easier to set a password than not to.
Is it possible to move the prompts for this to the start of the install script, alongside "Do you want to install Pi specific nodes"?
Is there any hint or push towards username "admin"? (Hopefully not.)
A new frequently asked question:
I've installed Node-red on my new headless single board computer and I chose not to set a password - after all it's only accessible from my network.
But I can't access Node-red from my PC!
Is it possible to serve a static Node-red explanation page (Set up a username and password!) in this instance ?
Note that one of those recently reporting a hacked installation said
a) they had an admin password and
b) the installation was live for some months before it was hacked.
This maybe implies that the bogey spotted Node-red and then set about the password by brute force
Hopefully part of a future enhancement will be to count login attempts and report the count by a notification on the editor once successfully logged in
---
### Author:  [@gregorius](https://discourse.nodered.org/u/gregorius)
#### Post date: [6 January 2024 12:53 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/111 "2024-01-06T12:53:06Z")
> [@jbudd](#):
>
> count by a notification on the editor once successfully logged in
Nice idea but what is the call to action if I see this message? Is there a log with IPs and even then, it's the past so I can't know whether those IPs will come again.
A message like this is more confusing than useful - IMHO - since there is nothing I can do except click it away.
Perhaps something along the lines of "XY IPs have been blocked because of repeated login attempts. You can review these IPs here ``." That would a) prevent tragedy b) give me something to do c) make me feel safe!
---
### Author:  [@E1cid](https://discourse.nodered.org/u/E1cid)
#### Post date: [6 January 2024 13:08 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/112 "2024-01-06T13:08:14Z")
> [@gregorius](#):
>
> A message like this is more confusing than useful - IMHO - since there is nothing I can do except click it away.
You could also investigate as to what was connecting to your device. The message itself is a call to do something, whether you or others do is entirely in your or their hands.
---
### Author:  [@GogoVega](https://discourse.nodered.org/u/GogoVega)
#### Post date: [6 January 2024 13:12 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/113 "2024-01-06T13:12:20Z")
> [@dceejay](#):
>
> Obviously there could be more - as per blocklists allowlists etc - but ideas on making those easy to setup much appreciated.
What about a restriction on the local network (192.168.1.1/24) - the script can get the IP address and ask the user if it is correct?
I fear that the idea of Jbudd will come too late - that the attack was successful before the notification
---
### Author:  [@jbudd](https://discourse.nodered.org/u/jbudd)
#### Post date: [6 January 2024 13:13 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/114 "2024-01-06T13:13:09Z")
I was just thinking - at the moment - of counting bad password submissions, not really connected to blocking outside attackers.
It could be my bad keyboard skills, someone else in the office trying to share my work or aliens from the internet.
Not actually sure how NR could maintain a count (over reboot/restarts), never mind a list of IPs.
---
### Author:  [@jbudd](https://discourse.nodered.org/u/jbudd)
#### Post date: [6 January 2024 13:18 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/115 "2024-01-06T13:18:57Z")
> [@GogoVega](#):
>
> I fear that the idea of Jbudd will come too late
I suppose I am imagining a NR installation with username "admin" and password "Tr0ub4dor&3" where port 1880 is forwarded.
A bot quickly spots Node-red is there and sets about login attempts.
In this situation one might expect several failed login attempts before they are in and the damage is done. This is the window during which Node-red could call attention to the rising count.
---
### Author:  [@E1cid](https://discourse.nodered.org/u/E1cid)
#### Post date: [6 January 2024 13:19 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/116 "2024-01-06T13:19:32Z")
This has been offered here [How to 'whitelist' IP address's that can access Node RED](https://discourse.nodered.org/t/how-to-whitelist-ip-addresss-that-can-access-node-red/83990)
---
### Author:  [@GogoVega](https://discourse.nodered.org/u/GogoVega)
#### Post date: [6 January 2024 13:22 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/117 "2024-01-06T13:22:46Z")
I know, but doing it during the NR installation would be more beneficial because very few people will do it before having pain.
---
### Author:  [@gregorius](https://discourse.nodered.org/u/gregorius)
#### Post date: [6 January 2024 13:23 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/118 "2024-01-06T13:23:45Z")
> [@E1cid](#):
>
> The message itself is a call to do something,
What? There is a message and I don't know what to do ... but I have to do something. If I was a newbie and saw that message, what would I do? Probably come here and ask ...
That shouldn't be the point of the message.
---
### Author:  [@E1cid](https://discourse.nodered.org/u/E1cid)
#### Post date: [6 January 2024 13:24 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/119 "2024-01-06T13:24:57Z")
If you don't know, then you ask, or play stupid your choice.
---
### Author:  [@gregorius](https://discourse.nodered.org/u/gregorius)
#### Post date: [6 January 2024 13:30 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/121 "2024-01-06T13:30:01Z")
> [@jbudd](#):
>
> Not actually sure how NR could maintain a count (over reboot/restarts), never mind a list of IPs.
Create a flow, use the flow context to store the IPs and block as seen fit. Using a http-in node as the entry point and bob's your uncle!
My blog is one http-in node and many little switch nodes that direct the traffic, completely doable.
[Previous page](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860.md?page=5)
[Next page](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860.md?page=7)