Screenly OSE - hacked

Anthias
1

Hey all, I received a message from a client that their screen was replaced by a hacked message with just a twitter link - https://twitter.com/bjh4cker. It was not critical as I just re-setup the card

I believe the issue was when I set this up I had a custom port setup to forward to the internal screenly device, so I believe that is how it was done. Trying to get to the public IP have an authentication popup, failing was an NGINX error.

So, I did remove that port as I can now VPN in and pretty confident that will solve that. But are there any other things known as to why/how this was done (with our without the admin). The OSE doesn’t offer password authentication, but I do see some articles on how to get that.

Thanks.

2

Sorry that happened. The core issue was that the admin page was reachable from the internet without a login, so anyone who found it could change the content. Two things help now. You can turn on a username and password for the admin page in Settings, under Authentication, and you can enable HTTPS with the enable_ssl.sh script. Even so, we would not recommend exposing the admin page directly to the internet. Putting it behind a VPN is safer. Marking this as solved.