I have a raspberrypi with raspbian and default user and pw (I know, don't shoot me). I setup port fw on my router so that I could ssh to it from an external network. Also because my external IP keeps changing every time I reboot my router I'm using dynamic dns on the pi. After a few months of not using it I tried to ssh to it and my credentials were invalid. Tried the same original credentials loging in directly with the same result.

I've got a feeling that I've been hacked and that someone managed to change my default pw....but how?

1.How easy is it to just try to ssh every public IP on earth with default user and pw?

I'm thinking of plugging the sd card on my pc to try to recover some of the stuff that I had there.

2.What is the risk of plugging in a compromised sd card?

If the hacker did in fact manage to get hold of my Pi.

3. What is the extent of the damage caused by having a hacked machine inside my LAN?


4. How can I make sure that there are no further exploits on my local network?


Basically, you set up a honeypot, whether you intended to or not. When you port forward, any protection the router provided is bypassed. So:

  1. It's easy, but that's not generally how attackers work. Scanning is easy, and fast. Identifying what software is running is slower, so they tend to look for common flaws. Sadly, default passwords are one of those common flaws, so they probably scanned for boxes running Raspbian, and tried the default credentials on those boxes.

  2. Normally, it would be a really bad idea. However, there is a slight saving grace in that the attacker was hitting a Raspberry Pi. By default, the boot partition is a read-only Fat32 partition in normal use, while the remaining space is a Linux format (probably ext based, but there are alternatives). This means that plugging it into a Windows box is unlikely to result in further compromise through the card. Similarly, any software running on the Pi won't work on Windows. However, any malicious file based attacks could work (e.g. uploading an evil PDF which you then looked at on another machine).

    Safest option (Assuming you want to keep the card) is to format it from a live CD. Second safest option would be to access it from a Live CD from a machine with no writable drives and grab any files you need, virus scanning them before allowing onto a clean machine.

  3. Depends on your network. Worst case, all your machines are compromised, all your data has been stolen, and you've been sending out attacks for the last few months. Best case, they didn't get past the Raspberry Pi. No way to tell which is the case without access to your networked devices.

  4. Firewall everything, use strong passwords, ensure any machines which are accessible from the internet can't access the rest of your network. Standard network security stuff, basically.

  • But I can assume that the pi has been hacked,right? there is no chance that the change of credentials was a result of a sw glitch? and if in fact it got compromised...why not keep the same credentials so that I wouldn't notice?
    – Txugo
    Nov 2 '15 at 14:56
  • 1
    In many ways, it doesn't matter whether it was hacked or not - you might have reset the password, but forgotten that you did it, or your keyboard might be playing up, or all kinds of other explanations for you not being able to log in. However, you think it was left with a default password. There are even some bots that "helpfully" change systems they see with default passwords to try protect them. If you're not sure, better to assume it was compromised than leave a compromised box running.
    – Matthew
    Nov 2 '15 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.