I think I was hacked - need advice

Configuration
1

I just got back from a vacation and logged in to my HA server using the local IP address. I just got a blank page that said “HACKED” in the upper left.

I’ve since blocked HA from the internet, closed all ports that point to HA, changed my password, and enabled 2FA (I know, I should have done this earlier). What else do I need to do? How do I get HA to load when I go to my local IP address instead of seeing the “HACKED” message.

I don’t see any issues within HA, so I’m hoping it was just someone messing around and not looking to do anything nefarious.

2

Don’t know how to help you with the HACKED message when using the local ip, other than maybe trying to restore from a backup if the system will let you.

As far as other preventative measures you can take, you can add ip_ban to your http key in your configuration.yaml

http:
  ip_ban_enabled: true
  login_attempts_threshold: 5

and you can install and use CrowdSec for the extra mile.

1 Like
3

I would wipe the whole installation. Do a backup first, then wipe + restore. How were you accessing HA remotely when this happened? Opened port 8123 and logged in through that? Do you re-use the HA password on anything else on your network, like a NAS for example?

2 Likes
4

It could be so simple that “they” just changed your landing page, anyways you are not very informative in regards to your home-network, but i assume you have checked even your Router Settings etc.

What else ?, After such an “incident” i would Wipe Everything, factory-reset the Router, re install HA etc.

If you don’t do above, you will be “Hoping” the rest of your life, and suspect every strange issues in future as bogus “maybe caused by your lack of security” And that “incident”

The feeling and consequences of “Hoping” vs “Knowing” are miles apart

You could be “lucky” or someone might actually have “placed” a backdoor, in your network

PS: You also don’t tell whether you get this “hacked” note from one specific device(phone) or from all devices, so noone can’t exclude anything, as there is not sufficient info here, to tell from where you were hacked etc.
Maybe your “house keeper” just playing you, and had some fun while watering your plants :joy:

5

Taking your message at face value, the only correct answer is to assume that everything on your network is compromised, and copies of every file you have are on the internet now.

Format everything, reinstall operating systems and apps, restore files from backup, and do better next time.

9 Likes
6

Just want to give that point more emphasis - if HA was on your primary LAN and any of your other systems had vulnerabilities it’s possible other systems got breached too.

Note: If you use your primary laptop on public WIFI / coffee shops etc having a breach on your LAN probably isn’t any worse than that - other than the hacker may have more time to attack your laptop using HA as a bastion.

Not just HA - every machine you have.

For everyone else

  • Don’t put HA on the same VLAN as all your most valuable computers, either:
    • Put HA in its own sandbox. or
    • Move your most trusted computers into a more secure VLAN.
  • Don’t allow incoming connections to HA from the internet.
  • Ideally don’t allow HA to connect to the internet at all (no outbound traffic) - I had to give up on that.
  • For IOT devices don’t allow them internet access either (again I had to allow one device out).
  • Consider running HA under docker - it is much easier to reset a docker container.
1 Like
7

How exactly were you accessing HA remotely?

8

I use Nabu Casa to access HA remotely.

9

Please do not resolve the hacked message.
Just be glad they left that there to inform you.
If you resolve only that then think about closing the more then likely backdoor too.
Wipe and restore would be the only thing to consider here

10

Any email addresses compromised may also be (eventually) flagged in HaveIBeenPwnd.

Contents of your browsing history may also provide useful compromise fodder.

Assume the worst. Act accordingly.

11

Ok so what was with the open ports?

1 Like
12

It’s very unlikely that it comes from NC and as Tom is trying to get to surface: do you have any other services/ports exposed?

Are you using MFA on HA (and other publicly accessible services)?
If not: time to start using that.
Unique passwords?

As already mentioned: check on https://haveibeenpwned.com/

Also, depending on many factors: everything that is connected to your network can be touched as well.

Apparently NC does not keep traces of connections.
If possible/available: check your router logs which might give you more insight.

It could be just this and at the same time you might have bigger problems so I would approach this as worst case scenario.
Good luck!

13

I had some open from before I started using Nabu Casa and I was using Nginx to reroute a login to my Blue Iris server. All ports to HA are now closed.

I was on a cruise ship and used that WiFi to access HA via the companion app. I’m wondering if that somehow caused this.

I have a backup from 10 days ago. I’ll wipe and restore from that. Is there any way to tell if that backup goes far enough back before the hack?

Oddly, when I visit HA’s local IP address on my desktop computer I don’t see the “HACKED” message, HA loads as normal. When I visited it on my laptop I see the “HACKED” message. The computers are on the same network. Any idea why?

14

Also with local IP?
Did you use your laptop on that cruise?

Regarding that 10 day old backup: it all depends when all this happen and if any other device on your network has been compromised.

15

Did you have this Laptop on your vacation also ?, anyways wipe it !
And check your HA logs and files for changes/timestamps etc. “clues/evidence”
As i mentioned earlier could be that HA is Not “Hacked” but your Laptop/browser is “infected/hacked” ( 11 hours ago i asked whether you’ve tried to access Ha from other devices, and you tell people now ? )
Anyhow, if you don’t have the knowledge to search through your devices, for Clues , evidence, etc. the best advises have been mentioned several times, Wipe everything

16

No, I brought my work laptop on the cruise; my personal laptop is where I see the “HACKED” message. I only accessed HA on the cruise via my phone and the companion app.

17

Do not forget to CHANGE PASSWORDS

I would potentially consider slowly changing all passwords unless you get a clear idea of

How this happened
when this happened
What is affected

1 Like
18

Check if you have any browser hijacks on that system.
What OS are you running on that laptop and is it up-to-date?

1 Like
19

VPN!!!
On public wifi’s always use vpn. If you don’t have it set it up now. I have vpn always active on my phone, no matter how it’s connected. Same on laptops, tablets… when i use them out of my home.

1 Like
20

Ehh, just never, ever use public wifi

1 Like