September 18: security threat affecting node-RED (does not by default effect emonPi)

[TrystanLea]

For all interested, there’s another thread here about NodeRed on the EmonPi relating to this security issue: node-RED virus >> emoncms image file

To summarise:

@Paul

does the emoncms image file have node-RED adminAuth setup by default?

@glyn.hudson

Yes, every single emonPi / emonBase / emonSD with nodered is secured with an adminAuth username / password.

From my understanding it seems that the malware has only affected systems open to the internet without secure admin access. By default emonPi / emonBase systems should not have the nodered port open to the internet, if a users chooses to open their nodered system to the internet we have always strongly recommend they change the default password.

I’ve just scanned all the nodred installations that I have access (all have adminauth) to and have not been able to find any infections.

With this in mind, I guess we should be ‘ok’ and no further action is needed other than to make users aware of the importance of changing the emonPi default nodered password, if they choose to open their nodered port to the world. Do you agree?