#Hi all, not sure if you can help. we are
small crypt
I think its also useful to see this as urgent as he now has a backdoor into your network
jade fulcrum
You'll also want then to check how they're remotely accessing this - the Nabu Casa Cloud service or a port forward
You can (and must) disconnect the cloud service if it's set up
You also should audit all port forwards
quartz anvil
You'll also want then to check how they're remotely accessing this - the Nabu Ca...
Thank you, the system is being remotely accessed via duckdns. we are currently logged into this but I'm unsure if we can change the password and email.
quartz anvil
I think its also useful to see this as urgent as he now has a backdoor into your...
Thank you, the system is being remotely accessed via duckdns. we are currently logged into this but I'm unsure if we can change the password and email.
jade fulcrum
Just remove the port forward
It will be that simple
Then once you've got access using the link above you can disable the DuckDNS add-on
- Remove port forward
- Reset all passwords
- Remove
ssl_lines from thehttp:section ofconfiguration.yaml - Restart HA - all access will now be local and with
http: - Remove the DuckDNS add-on
Next step would be to consult for guidance on sorting out your security and incident procedurers 😛
quartz anvil
Just remove the port forward
That's what I thought, my only concern is that if we stop port fowarding we will drop control too. He is the administrator and is not willing to give us a new password via Home Assistant.
jade fulcrum
Dude
Seriously
You've got somebody malicious on the network
Close the fucking door
Stop inviting them in
Follow the numbered steps above
quartz anvil
Yep, I totally agree. This was not of my doing but I have been tasked with sorting it out
jade fulcrum
Then listen to us
quartz anvil
I have no idea why they let this happen
jade fulcrum
Or don't and argue the point, but you'll be on your own
quartz anvil
No I'm listening and I really appreciate your help
jade fulcrum
Then follow the steps above
Then audit the install to ensure they've not left you any surprises
quartz anvil
Thank you for the guide, I'll let you know how I get on.
jade fulcrum
But step #1 right the fuck now is to remove the port forward
jade fulcrum
Good luck, and do use this as an opportunity to push for some cyber security
quartz anvil
Thank you, I'm new to this so I really appreciate the help.
jade fulcrum
Ah, the bosses have thrown you to the wolves...
quartz anvil
Yes they have, but I'm willing to learn
The guy was an old school IT guy, so I'm positive that there will be a ton of stuff to sort out
I'm heading into the office shortly, I'm hopping that the router passwords haven't been changed.. I might just have to shut the lot down which the bosses will not be happy about
small crypt
"Damage control"
jade fulcrum
At times like this you have to take the least bad option - and letting somebody malicious have full control is very bad
small crypt
You can only begin mopping when you closed the valve
jade fulcrum
Also... I wonder what data they took out the door...
small crypt
mopping when the floor is still being flooded isn't really practical
jade fulcrum
You've met my wife I see...
small crypt
HAHAHA
jade fulcrum
Admittedly she was half asleep at the time, but she'll still never live that one down
small crypt
I've seen cleaners at the office mopping carpet