HELP! Someone Hacked my system? Lights and other turning on and off randomly. OH3 Snapshot

I see mqtt in your log. Is that driving this? If so, have a look at the log file of your mqtt broker.

Do You know where to find mqtt logs? I will check them

Well I don’t know your system. Are you using mosquitto as a broker?

Yes. Everything set by openhabian-config.
It was working over 2 years.
Month ago update to OH3.

But not everything of this turning on and off items are mqtt. Dimmer light is xiaomi binding. But it is in same group as other mqtt lights.

The logs might be in /var/log/mosquitto I don’t use openhabian myself. However I believe it forces you to use a password. Have a look at your logs.

I found something like this in log file:

2020-12-06 03:54:00.272 [WARN ] [ore.io.rest.auth.internal.AuthFilter] - Unauthorized API request: Error while processing JWT token

That means that someone tried to get into my system?

I have no idea. What log file is this?

==> /var/log/openhab/openhab.log <==

I can’t speak to this. What did the mosquitto log files say?

there is nothing but client connections. and there are only connections from inside of net.

Dear Kamil

It might be a hacked system or just some kind of weird malfunction.

  • Check if there is any kind of processes out of openHAB that are consuming unuasual high memory / CPU.
  • Check if there are processes / services running of which you are sure they shouldn’t

I suspect that a hacker would not drive the operations of OH in such a way. i.e. it would be to obvious. Most of these kind are in the meaned to use the hijacked system for other purposes.

It took me about a week to find the source process

Regards
Stefan

You should never open ports let alone to devices with poorly updated firmware. openHAB has the Free cloud So you don’t need to open any ports.

1 Like

This may not be relevant to your particular situation, but at one point I added a Zwave Steinel outdoor floodlight to my system and it caused all manner of “weird” behaviour with my OpenHab setup (other devices turning on, not responding to commands, etc). Once I removed it, everything else returned to normal. So, is it possible you added some new device that could be messing the rest up?

hmmm
I didnt add anything new, but one of my sonoff switch is reseting once in few days. maybe this time something else went wrong?
But strange is that whole day nothing happens. Only after dark.

I have one rule to turn on 3 lights after dark, ant turn off all lights after 1:00am. but newer had problems with it. And even if this is the problem that doesnt explain what is happening with other items.

but this is only one open port for separate IP from outside to one IP stictly for camera inside my net, not for IP where OPENHAB is.

I’d suggest rolling back any changes you’ve made, one by one, to see if the problem still persists.

I turned off cameras and changed passwords. Today is ok. So I dont know what it was.
Will se if it get back.

One thing that I found was that one of my cameras were connecting and disconnecting from mqtt server after every state change.
So there was lag on mosquitto and maybe mosquitto malfunction? I dont know. after turning camera off for now it stopped doing crazy stuff:)

I trashed some generic clone IP cameras, because I found they all had backdoors and where communicating to IP’s located in china, despite all cloud settings being disabled. They would also randomly spike and transmit several hundred megs. they all went in trash.

4 Likes

Could someone have gained access to your wifi network? I.e a pesky neighbor?

If this happens again, you may want to check your router for new device connections.

Also, if you’re router supports it, you may find it more secure to setup a openVpn connection to access your network remotely when you are not home.

This keeps you form exposing ports to the outside which is constantly being scanned for open ports and services that can be compromised.

I think general cyber security is really lacking for the general home user.