This might be a long post so please bear with me.
This is a scenario that took place a year back when I had very almost no knowledge of raspberry pi. Right now I am trying to learn some stuff about it hence this post.
In our apartment area in the university, a lot of the students including my roommate used raspberry pi for the purpose of WiFi through the Ethernet port provided by the uni. And my roommate was kind enough to share the wifi with me. For a few weeks, the wiFi was working fine, when one day it suddenly stopped working.
It looked like the Ethernet port was blocked by the uni IT guys. When contacted them they said (it is a year ago, so I might have misunderstood something or forgotten something but this is the rough idea behind it): They received complains from the Network Provider that some of the raspberry pis were being used for the SSH bruteforce attack(?) and they received complains from the network provider. So, they had to either block the pi mac address/ block the port the pi was on.
Can someone please provide their insights on this about how it must have happened?
There were quite a few people using the same pi method for their wifi but all of them were not too close to each other (few hundred meters apart). How can the hacker possibly know which wifi was the one with the pi? Even if the ssh password was the default, he still needed to connect to the pi to ssh with the wifi password? Similarly, how could he have done this all, I mean, unless he had a wider view of all the devices that were connected to some university level network?
I don't know if this sounds crazy, I am just starting learning this and it may not make much sense some of the things that I said. But I would really appreciate if you all can provide some of your knowledge and sort of reverse engineer this case and explain as to what could have happened. I would be really interested to know this.