Here are more reasons why the HiveOS diskless PXE boot is such a massive, critical problem:
Per the HiveOS team's own Telegram post:
They tell you:
"How to avoid this kind of attack:
- use secure passwords"
The problem with this, of course, is that if you are using HiveOS that was installed on a hard drive, SSD, or a USB flash drive (which, by the way, if you got hacked/hijacked like this, you couldn't simply just reboot to wipe out the stuff that the hacker/attacker has done), then sure, you can change the password to your heart's content when you first boot up and everything will be a little bit more secure from that point forward.
But if you are using HiveOS' diskless PXE, the hacker/attacker hacks/hijacks your system, you reboot it to reset everything, which sounds great in theory, until you realise that it also restores your system to the default password "1".
So much for having a more secure password.
In other words, if you ACTUALLY want to abide by the HiveOS team's recommendations of using a secure password, a reboot and/or a power cycle on your rig/worker/system will wipe out said secure password and restore it back to the default unsecure password. Once that happens, then a hacker/attacker can hack/hijack/attack your system again. Rinse. Repeat.
This flaw exists REGARDLESS of whether you have port 22 open on your modem/router.
Even if you secured your network, the fact this massive, critical flaw that still exists with the HiveOS diskless PXE system means that your network and your rig/worker/system(s) are still at risk.
Even if you secured your network, the fact this massive, critical flaw that still exists with the HiveOS diskless PXE system means that your network and your rig/worker/system(s) are still at risk.
In other words, you want to actually abide by the HiveOS team's recommendation. But literally a reboot and/or a power cycle on your rig later, and your diskless PXE rig/worker/system would be just as unsecure as it was before you tried to use a secure password, pursuant to said HiveOS team's recommendations on how to avoid this type of an attack.
And in talking to at least the HiveOS forum moderator(s) and administrator(s), they are CLEARLY in denial about this massive, critical security flaw.
Again, the two things that I can think of that would make this vastly more secure would be:
1) If you actually WANT to abide by the HiveOS team's recommendations of using a more secure password, said HiveOS team would have to modify the pxe-setup.sh so that it will ask you want you want the default rig password to be (so that it won't just automatically deploy "1" as the default password to all of your rigs), and then it will deploy all of your diskless PXE rigs with the default password that you specified (that isn't stored in some config file somewhere, in plaintext).
2) An even better option, in addition to pxe-setup.sh asking you what you want the default password to be, would be if it asked you if you wanted to disable password authentication for ssh completely in the first place.
That way, you would have to worry a lot less about:
"How to avoid this kind of attack:
- use secure passwords"
BOTH times that I've written about this in the HiveOS forums and BOTH times, the post and the comments were deleted in regards to this. IF the HiveOS Team ISN'T able to or aren't willing to put the time in to actually make their diskless PXE more secure GIVEN these GLARING, massive, and critical security flaws with it, then they shouldn't advertise said diskless PXE as a feature on their HiveOS features page. That way, said HiveOS team won't have to worry about this gaping security flaw anymore.
