I set up my raspberry pi 2 as a VPN and port forwarded 22 also so I could access it elsewhere.

I left the root password as toor but didn't really expect to be targeted.

When I logged into my RPI2 recently I found a bunch of strange binary and shell files in my home and / directory.

I googled one of the names and the first link was a malware analysis confirming that it was some windows virus.

I panicked and immediately ran rm -rf /.

I didn't think about any other options so I can't find any log files?

Anyway, my question is what do I do now that some personal details were probably copied elsewhere

and also

how + why do hackers just find and bruteforce SSH logins?

Should I microwave the micro SD card or is it safe to plug in to my laptop and overwrite given that rm -rf / had lots of permission denied errors so it's not fully erased?

closed as too broad by Ƭᴇcʜιᴇ007, DavidPostill, Jakuje, karel, MariusMatutiae Oct 23 '16 at 9:30

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • When I first set up my latest firewall on the public Internet, I checked the logs, and within a very short period of time (10 minutes or so), I had dozens of break-in attempts on all the well-known ports. The bad guys have automated machines that run day and night, trying to break into every public IP address. Every once in a while, I check the logs, and it is relentless. Security by obscurity is like leaving a spare house key under the welcome mat because you don't think anyone is targeting you. – Ron Maupin Oct 23 '16 at 3:35
  • How can I set up my router to not respond to requests from unknown ip addresses a bit like amazonaws? – user3573987 Oct 23 '16 at 3:38
  • In general, port forwarding on consumer-grade devices just opens ports to everyone. Using a firewall or router that allows you to configure specific ACLs will allow you to only allow traffic from specific addresses. – Ron Maupin Oct 23 '16 at 3:42
  • 1
    By the way, I work at home, in a nice neighborhood, on a corner with a front door that is not hidden from view, and about once a week during normal business hours, someone tries my front door to see if it is unlocked. – Ron Maupin Oct 23 '16 at 3:46
  • This is why. Your system almost certainly contributed a small part of this. – Michael Hampton Oct 23 '16 at 4:56

There's so much wrong here that I'm not sure if this is a troll - that is to say, this is a perfect storm of things that shouldn't have happened. I do think any sensible distro would not nuke your system with rm -rf / and depending on the nature of the hack, chances are your system was just a dumb node for a wider botnet - I'd do sensible things like changing your passwords, and keeping an eye out for strange transactions but not panic so much.

Using a default password is dumb. I rarely use the word, but it totally is suitable.Brute force-scanning for ssh and other vulnerabilities like old phpmyadmin versions is trivial, when you already have an army of badly secured systems with passwords like toor floating around. The obscure dinky little machines, the RPIs and IP cameras are the weapons of choice these days, since they're badly secured, as yours was. One machine is meh, a hundred are scary... well these comedians took out chunks of the internet, and machines set up as yours were "oh, no one will ever hack us" are part of the problem. For that matter, from my own (painful) experience, I'd consider a pure password SSH login, without a key insecure. Having toor as a password would just be unacceptable.

So in future, you'd want to pop the SD card into another box to run an AV scan or zip up the contents, copy it over to another system and scan the archives. That should tell you exactly what the threat is.

You'd also want to disable root ssh logins (which are a terrible habit). I actually typically don't even set up a root password, preferring to use sudo as needed. If you're VPNing in anyway, consider restricting SSH to your VPN and home IP address ranges.

While microwaving is a little extreme, a full reformat and reinstallation, and setting up your rpi to sensible defaults is a good idea.

Not the answer you're looking for? Browse other questions tagged or ask your own question.