while debugging some strange effects in my home network (bad video call quality due to packet loss) I found out this only happens when my RBPI is connected to the network. When I wanted to log in I discovered that the default password was not working any more. I was not thinking much about it and assumed I changed the password at some point. After a complete reinstall of Raspberry Pi OS the packet loss went away... for 1 day. After that the same effects: heavy packet loss AND again I couldn´t log in with the default password.

I finally discovered that I left the RBPI with default user settings and password exposed to the internet on port 22 (in the router settings). Stupid. I repeated the experiment a few times and found out that at some point after fresh reinstall the packet loss returns and the default user gets logged out and his password changed. Probably an automated attack on idiots like me.

I had a quick check with Wireshark to see if the compromised RBPI tries funny stuff to the other machines in my home network but couldnt find anything.

Now the question is: how can I best approach finding out what happend to the RBPI. Forensic tools that scan a SD Card / image?

P.S. I dont get why the attacker changed the default password. I would probably not have discovered the attack if I could have still logged in.

  • 1
    Nuke it from orbit.
    – hft
    Sep 21, 2021 at 22:19
  • 1
    For this context, hft is right - if you didn't have extensive logging set up prior to the attack you are unlikely to find anything useful. Best bet is simply to nuke it and build clean.
    – Rory Alsop
    Sep 22, 2021 at 8:54


You must log in to answer this question.

Browse other questions tagged .