Raspberry Pi Security Issues: SSH ATTACK? Case Study

Question

This might be a long post so please bear with me.

This is a scenario that took place a year back when I had very almost no knowledge of raspberry pi. Right now I am trying to learn some stuff about it hence this post.

In our apartment area in the university, a lot of the students including my roommate used raspberry pi for the purpose of WiFi through the Ethernet port provided by the uni. And my roommate was kind enough to share the wifi with me. For a few weeks, the wiFi was working fine, when one day it suddenly stopped working.

It looked like the Ethernet port was blocked by the uni IT guys. When contacted them they said (it is a year ago, so I might have misunderstood something or forgotten something but this is the rough idea behind it): They received complains from the Network Provider that some of the raspberry pis were being used for the SSH bruteforce attack(?) and they received complains from the network provider. So, they had to either block the pi mac address/ block the port the pi was on.

Can someone please provide their insights on this about how it must have happened?

There were quite a few people using the same pi method for their wifi but all of them were not too close to each other (few hundred meters apart). How can the hacker possibly know which wifi was the one with the pi? Even if the ssh password was the default, he still needed to connect to the pi to ssh with the wifi password? Similarly, how could he have done this all, I mean, unless he had a wider view of all the devices that were connected to some university level network?

I don't know if this sounds crazy, I am just starting learning this and it may not make much sense some of the things that I said. But I would really appreciate if you all can provide some of your knowledge and sort of reverse engineer this case and explain as to what could have happened. I would be really interested to know this.

Thanks guys!!!

Answer 1

I see three possibilities as to what's happening here.

1. Somebody got unauthorized login access to your PI and used it to make attacks. I suggest checking for rootkits and the like.
2. Somebody is using the wifi to make attacks. It probably looks your PI because you probably are doing NAT. It could actually be an authorized user's compromised laptop. I suggest checking all the laptops involved, and updating the Wifi authorization parameters.
3. The university people were mistaken about who or what did it. (I've seen this in a corporate environment -- the complainers set their corporate homepage to refresh every 30 seconds, my boss buried a browser window, and at the end of the day, she received a complaint forwarded by our IT from the remote site.) I suggest seeing if your IT guys can provide more information.

Answer 2

This is my answer based on how I've read your situation:

If your ethernet port got blocked by your IT sysadmin because it was being used for brute forcing SSH/some other malicious behaviour, then it's likely one of your WiFi users started to abuse your service.

It's not out of the realms of possibility that somebody complained they were getting excess / unauthorised attempts from your university, the sysadmin looked into it, and saw your IP / MAC making a series of requests to the person's box.

A university sysadmin would indeed be able to see who is conducting such attacks if the infrastructure is right. The site admin would not be able to tell it's your Raspberry Pi specifically, but they could contact the university (and it sounds like they did here) and report the malicious behaviour - then the university investigates.

Answer 3

It's better if you ask this question on another SE Site which is related to security. Although, as @Modeset said, the IT man of the university can see which connected device tried brute force attack because of the packets statistic, etc. Because the raspberry pi shares the internet (I mentioned hotspot) and sends all wifi client's data as itself IP address in L3 and MAC address in L2. Thus, it doesn't matter someone attacked by the raspberry pi or the wifi clients of the raspberry pi. In addition, the configuration of the hotspot and sharing the internet is important to find the answer, in this case.

If you find that the raspberry pi has configured like not I explained, although, there are a lot of possibilities. As I know (my knowledge gives me hand) a client can send packets by another src.ip and src.mac. I mean, maybe someone wants to happen something like this and attacks by raspberry pi's IP and MAC address (changed source addresses).

Solution: You should change the IP and MAC address of the raspberry pi. After that, it seems a new device connected to the network and everything has reset for this device on the network.