There's probably loads of port mapped pi's sitting behind NAT'd routers.

I'm sure it happens but it's hard for me to imagine someone knowledgeable enough to port forward 22 and possibly other ports across their NAT to a Raspberry Pi but not knowledgable enough to realize that enabling themselves to access the Pi over the Internet with the default username and password also enables the same ability for everyone else.

Honestly kinda wild you can’t imagine this person, because when I was in my teens it was me.

You don’t care about security or don’t understand the implications, and why would you!? You’re having fun!

Fun is the deal. If you focus on the fun path you will jump right past any non fun, which is security.

Think about smart kids who get hurt. Were they capable of preventing the injury? Definitely. We’re they having fun? Absolutely. Fun wins every time.

Absolutely! I distinctly remember when i was learning to develop with PHP, and i specifically chose the mysql over mysqli extension (it was at the time mysql was starting to get deprecated because it was vulnerable to SQL injections and what not) because "I don't care about security, it's just a blog I'm developing, nobody would even know it exists".

I still remember the day a young me discovered shodan.io for the first time. before that day, I had no idea just how quick and easy it was for strangers to scan the entirity of the internet and just naively assumed that there was no way anyone could find me or my devices amongst the vastness of the internet. needless to say that was a turning point for me and my security posture when it comes to anything internet-related.

I honestly still can't imagine it, and I was playing with this kind of stuff in my teens as well. Changing default passwords is part of early setup fun, and nothing spoils the fun as much as unwanted visitors in your network. I can imagine being distracted enough to actually forget about it, sure, but I can't imagine outright neglecting to do it because "fun".

I think that sounds extremely likely. You know exactly how the average tinkerer loves to follow tutorials that they don't fully understand.

"Access your raspberry pi from the internet" probably doesn't sound to the layman like anyone can access your raspberry pi with zero effort

I dunno, Im sure there are lots of people who have opened things up so their xbox/ps/whatever works properly (or just enabled DMZ for everything) - and just added the Pi as they would do for those.

> but it's hard for me to imagine someone knowledgeable enough to port forward 22...

I was supposed to be a "knowledgeable" IT expert, but back in the 90's I managed to open-relay my company's mail server...

I did so many and different walks of shame that week.

Don't underestimate people's laziness. I've seen Pis with the default password being setup in internal networks and then exposed to the Internet (either via an actual public IP or via a port forwarding) without any change. There was even at least one case where the use left the thing like that after my remarks about security, saying it was just a temporary setup and that nobody would find it anyway...

Also don't forget the classic case of people simply forgetting that they set something up, likely originally for some very temporary purpose.

Automatic upnp is a thing

there is a shortage, while there are plenty of IPv4 addresses. It is an interesting duality.

But just search for "raspberry pi hosting" on your favorite search engine. There are tons of companies providing hosting on Pis, as crazy as it sounds and those come with IPs (but for a semi professional hosting place hopefully with different credentials ... but given how cheap many of those are it's more hope than expectation)

Could be uPnP setting up port forwarding

If a distro configures sshd to use UPnP out of the box is deliciously evil. It wouldn't surprise me after some of the shenanigans I've seen through the years.