This question already has an answer here:
First of all, sorry if all of this seems a bit stupid, but my field of expertise is software development, not security. So, here is what happened.
1/ The breach
I did something I really shouldn't have. Namely, I redirected my external network port 22 to my raspberry pi, thinking my password was strong enough to protect me. The main goal was to remotely work on my dev whenever I wasn't home.
2/ The attack
Yesterday, my father told me he couldn't send any emails anymore. Sadly I didn't think about taking a screenshot of the error message, but the basic line was: "This IP address has been blocked because it was trying to perform ssh bruteforce on port 22". My opinion is that a bot scanned my network, saw my port 22 was open, logged in my pi by bruteforce, and once logged in the pi, tried to bruteforce other devices from mine. Am I correct on this one? As noted in the comment, it may not be the case but here are my reasons to think it was:
- The rasPi is the only device accepting ssh connection from the internet (in fact, it's the only device accepting ssh connection at all)
- The only others open ports on my router are 80 and 8080. Both redirecting to the rasPi
- When we discovered the issue, I unplugged the Pi, rebooted the router and all worked fine. It may be worth noting that when we rebooted the router, it made some sort of "quarantine" stating "you'll be connecting to Orange (French ISP) network in 5 minutes", that's the first time I see this message.
3/ The recovery
This is the main part of my question: what actions should I take now to recover? Since yesterday, my pi is unplugged, both power and ethernet, and all my port redirection have been shut down. We don't see any suspicious trafic anymore, but is there any risk that my entire network has been compromised? Can I reuse the pi as it is with more security mesures? Should I wipe it out and start from fresh? Should I worry about the data on my desktop computer/smartphone or my family ones?
Thanks a lot.
What should I do if a device on my home network has been used by a third party to perform bruteforce over the internet?