# Slightly OT: Major leak of Orvibo user data

**URL:** <https://discourse.nodered.org/t/slightly-ot-major-leak-of-orvibo-user-data/12830>\
**Category:** Hardware\
**Created:** [2 July 2019 16:13 UTC](https://discourse.nodered.org/t/slightly-ot-major-leak-of-orvibo-user-data/12830 "2019-07-02T16:13:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [2 July 2019 16:13 UTC](https://discourse.nodered.org/t/slightly-ot-major-leak-of-orvibo-user-data/12830/1 "2019-07-02T16:13:32Z")

</div>

Hi all, slightly off topic but since it is quite possible people have some of these devices.

Change passwords straight away ...

> **[Report: Orvibo Smart Home Devices Leak Billions of User Records](https://www.vpnmentor.com/blog/report-orvibo-leak/)**
>
> vpnMentor‘s research team found a leak in Orvibo’s user database. Our expert cybersecurity research team, led by Noam Rotem and Ran Locar, ...

> **[Billions of records exposed by company that makes smart home devices](https://www.komando.com/happening-now/577596/billions-of-records-exposed-by-company-that-makes-smart-home-devices)**
>
> A recent security hole is affecting smart home products from around the world. Thanks to a flaw in a manufacturer's database, profiles on millions of customers are now unprotected on the web. These profiles contain personal data like location and…

> **[Report: Orvibo Smart Home Devices Leak Billions of User Records | | IT...](http://www.itbusinessnet.com/2019/07/report-orvibo-smart-home-devices-leak-billions-of-user-records/)**
>
> By vpnMentor vpnMentor's research team has uncovered a massive, potentially harmful leak in Orvibo's user database. The leading VPN comparison sites' expert cybersecurity research team,

---

<div class="post-metadata">

**Author:** ![afelix](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/afelix/32/9743_2.png) [@afelix](https://discourse.nodered.org/u/afelix)\
**Post date:** [2 July 2019 16:31 UTC](https://discourse.nodered.org/t/slightly-ot-major-leak-of-orvibo-user-data/12830/2 "2019-07-02T16:31:28Z")

</div>

The vpnmentor article is spot on when explaining the impact. I’ve seen several vulnerabilities on individual devices before, but never as big of a scale. All but one of the reports went ignored, but judging from the screenshots it was a different yet similar kind of leak.

Slightly off topic but still relevant for security of Node-RED based systems. If you run on Linux, and you use SupervisorD, make sure the remote monitoring is disabled, and firewall rules are present to prevent these ports from opening. Being able to tail server logs, whether INFO or DEBUG level doesn’t make it less bad if too much info is logged (such as full text and links of a password reset email), is a huge risk. Being able to do that from a web browser is an even bigger risk.

[http://supervisord.org/introduction.html](http://supervisord.org/introduction.html)