Hello Everyone My nodered server has been hacked, by adding some invisible nodes to my flows.json while I was working on it. I detected it because of a nodered message stating that some nodes where changed without ay action from me. Looked like someone edited another instance of the flows.json fil…

[image] jbudd: count by a notification on the editor once successfully logged in Nice idea but what is the call to action if I see this message? Is there a log with IPs and even then, it's the past so I can't know whether those IPs will come again. A message like this is more confusing than …

[image] gregorius: A message like this is more confusing than useful - IMHO - since there is nothing I can do except click it away. You could also investigate as to what was connecting to your device. The message itself is a call to do something, whether you or others do is entirely in your …

[image] dceejay: Obviously there could be more - as per blocklists allowlists etc - but ideas on making those easy to setup much appreciated. What about a restriction on the local network (192.168.1.1/24) - the script can get the IP address and ask the user if it is correct? I fear that the …

I was just thinking - at the moment - of counting bad password submissions, not really connected to blocking outside attackers. It could be my bad keyboard skills, someone else in the office trying to share my work or aliens from the internet. Not actually sure how NR could maintain a count (over …

[image] GogoVega: I fear that the idea of Jbudd will come too late I suppose I am imagining a NR installation with username "admin" and password "Tr0ub4dor&3" where port 1880 is forwarded. A bot quickly spots Node-red is there and sets about login attempts. In this situation one might expec…

I know, but doing it during the NR installation would be more beneficial because very few people will do it before having pain.

[image] E1cid: The message itself is a call to do something, What? There is a message and I don't know what to do ... but I have to do something. If I was a newbie and saw that message, what would I do? Probably come here and ask ... That shouldn't be the point of the message.

If you don't know, then you ask, or play stupid your choice.

[image] jbudd: Not actually sure how NR could maintain a count (over reboot/restarts), never mind a list of IPs. Create a flow, use the flow context to store the IPs and block as seen fit. Using a http-in node as the entry point and bob's your uncle! My blog is one http-in node and many litt…

Node-RED

Node-RED Forum

Nodered hacked by adding invisible nodes

General

E1cid 6 January 2024 13:19 116

This has been offered here How to 'whitelist' IP address's that can access Node RED

Topic		Replies	Views
Dashboard suddenly asks for password (Hacked Node-RED servers) General security	128	4481	4 December 2022
Node Red starts mining Monero coins without my consent! General security	34	433	28 July 2025
Have I been hacked? General security	62	1359	2 January 2024
The password/security settings article mentioned on the page General	49	5685	17 February 2019
Configuring Public Node-RED Server on RPi General	29	1762	23 July 2020

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Nodered hacked by adding invisible nodes

Related topics