Previous Thread
Yep, this issue was addressed a long time ago. There is a checkbox in the security settings of the Pogoplug UI that enables you to enable or disable SSH access. However, the Pogoplug resides behind your router and firewall, and doesn't require ports to be opened, so it's very, very safe regardless.
Hello everyone.
I am thinking of purchasing a Pogoplug and did a little research on it. I hear a lot of good things and I must admit seems like a great product, however, Something I read did catch my attention.
http://robpickering.com/2010/01/beware-the-pogoplug-7
This thread talks about a high risk security gap that really concerns me. I cannot seem to find any information addressing this on this website or other sites I have looked at. Is there anyone here that might be able to explain how high a risk it is and if/or not Pogo Plug has addressed this issue? I would really like to know as I am considering ordering a few of these and just want to the full lowdown on it before I decide to go with it. Thanks in advance to anyone that can clarify.
Editor
- member since: 04/21/2009
- rank: 3 of 13232
- 43 articles authored
- 76 forum threads started
- 615 comments
February 25, 2011 3:59 PM
May 18, 2011 4:31 PM
Peter Redmer said: Yep, this issue was addressed a long time ago. There is a checkbox in the security settings of the Pogoplug UI that enables you to enable or disable SSH access. However, the Pogoplug resides behind your router and firewall, and doesn't require ports to be opened, so it's very, very safe regardless.From what I can tell, my router does not block port 22 and allows it to flow through to the pogoplug. This exposes the plug to a brute force attack. Unless I'm mistaken, but I was able to SSH to root@my.pogoplug.com and get a terminal session. I can't log in, but with a brute force attack, there is no need to log in. The intention is to bring the server to it's knees. I'd recommend keeping that SSH option disabled unless you absolutely need it.
May 19, 2011 10:51 AM
I have already purchased half dozen of these pogoplugs and have been working great for me. I have disabled ssh and will continue to monitor them and look up more information on security gaps. Thanks for your replies
May 19, 2011 12:23 PM
i was able to get a terminal session as well. however, this looks like it ;s going to CE's server my.pogoplug.com, not any individual users pogoplug. it;s ipaddress is 38.126.11.29
Cloud Engines might want to close this hole to their servers. atleast change the SSH port to something other than 22.
Add Your Reply
Copyright © 2012
Capable Networks LLC.. All Rights Reserved.
RSS |
Privacy Policy |
Advertise With Us |
Terms of Use |
About Us |
Contact Us |
Site Map
Our Capable Community Network:
DVR playground |
Explore3DTV |
MediaSmart Home |
MotoDash |
My Open Router |
Pogoplugged |
DijitCommunity |
Robo Community |
Sansa Community |
TechLore |
TiVo Community |
TouchSmartDevZone
Pogoplug™ is a trademark of CloudEngines, Inc. PogoPlugged.com is not affiliated with CloudEngines, Inc.
