# Nodered hacked by adding invisible nodes

**URL:** <https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860>\
**Category:** General\
**Tags:** security\
**Created:** [20 December 2023 08:54 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860 "2023-12-20T08:54:44Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [20 December 2023 09:06 UTC](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860/2 "2023-12-20T09:06:14Z")

</div>

**!! WARNING READERS: Please no not import the above flow !!**

> [@iznogoud320](#):
>
> Any idea where could have been the breach

> [@iznogoud320](#):
>
> My server was secured by https and password

If the instance was accessible to the public, all it takes is a brute force attack, how complicated was your password, was it using words? if so, a simple dictionary cycle will allow access if the attack was prolonged.

What you have posted - has been found many times in unsecured Node RED instances, or instances using sub-par passwords (or none in some cases)

Honestly, https is great, but only to stop eavesdropping, it will not stop an attacker brute forcing the password, especially if using dictionary words.

We usually suggest using a tunnel/VPN type of access.  
please see : [Safely accessing Node-RED over the Internet](https://discourse.nodered.org/t/safely-accessing-node-red-over-the-internet/45024)

I would suggest reformatting the disk to remove traces, its likely been at work on your system(s)  
it might be worth checking over other connected devices on your network

And take your instance off-line! until you have cleaned all your potentially effected systems  
And welcome to the forums @iznogoud320 despite the unfortunate circumstance

---

_[View the full topic](https://discourse.nodered.org/t/nodered-hacked-by-adding-invisible-nodes/83860)._