Disclosure: Supervisor security vulnerability

Blog
1
Read the full release announcement here
11 Likes
2

Thanks Paulus for the update and the push notification in HA :slight_smile:

I am wondering, was the vunerability via http access? My device (rpi) running HA is only accessable on the http port.

1 Like
3

If I understand this correctly, anyone using simple techniques to allow remote access to their instance (e.g. port forwarding through their router, DuckDNS) would have been vulnerable to this up till 1st March. Is that correct?

If so, what actions should people take to verify their system hasn’t been compromised?

Kudos to HA for announcing this prominently as an alert in HA!

5 Likes
4

Check for any suspicious addons

edit: here’s a list of the current endpoints for the api. not sure what changes it has undergone since 2017

Endpoints | Home Assistant Developer Docs (home-assistant.io)

5

Good thing I’m being paranoid and only vpn to my instance. :scream_cat:

Anyway should I “ignore” this action when it’s already been addressed?
I feel like some other button label would be more appropriate - like “confirm”, “dismiss” or just plain “ok”.

2 Likes
6

Unavngivet
so im affected by this. how do i resolve this?
im using nabu casa

7

thanks for the warning.
At the moment I am in the testing phase and I doubt that someone has had time to attack me, since my home assistant installation is not more than 2 months old and is usually always updated.
Más información sobre thanks

8

No, it was fixed with version 2023.03.1

1 Like
9

And this is exactly why I will never ever expose my HA instance to the public internet. And this is exactly why people want to secure their HA instace with an independent HTTP Basic Auth… So make this happen I guess.

Thanks for disclosing, still.

5 Likes
10

I can’t say for 100% that I was affected but I do use Duck DNS and WireGuard and I did have some strange behavior. Lutron Lights coming on when they shouldn’t, the HA web-interface not loading. Again can’t say this security issue was the cause .

11

My Firewalla Purple SE has been telling me it’s blocked Heartbleed attacks on my Homeassistant on multiple occasions (that has duckdns access). Could this be related to this security issue?

12

No. Heartbleed was a generic OpenSSL issue, read more about that here: https://en.wikipedia.org/wiki/Heartbleed.

1 Like
13

Are instances behind a firewall (no port forwarding), connected via the nabu casa cloud also vulnerable?

14

Was the system also vulnerable if you use the nginx addon?

15

Yes, those were also vulnerable and not excluded in the announcement either. Home Assistant Cloud is end-to-end encrypted, and thus they can’t intercept or filter the contents of the communication that goes through it.

3 Likes
16

Yes, as this still exposed your Home Assistant instance.

2 Likes
17

@frenck , is there a way we can check for a specific instance if this vulnerability has been used/abused ? Maybe through logging of some sort ? Can we look out for something specific ?

18

This isn’t quite clear to me.

Followed by

(To the network security uneducated, ahem, me) they feel like contradictory statements.

I’m not trying to be difficult, I genuinely don’t still don’t know if only exposing HA via Nabu Casa left me vulnerable?

I have no reason to believe that I have been affected, I’m just curious.

19

Unfortunately, there is not way to conclude that.

2 Likes
20

I have had lights etc coming on/off when they shouldn’t too, and sometimes would think, “did somebody hack my system???” But in the end it has always just been my own poorly coded automations. :wink:

13 Likes