Securing a Raspberry Pi and other DIY IoT devices

Securing a Raspberry Pi
and other DIY IoT devices
Presented by Ian Kluft
ISC2
Silicon Valley Chapter
Santa Clara, California
February 11, 2020

What is a Raspberry Pi
●
$35 credit-card sized computer
●
Original Raspberry Pi 1 came out
in 2012
– Raspberry Pi 4 is current
●
Made by non-profit foundation for
kids to learn computers cheap
– Estimated market size 10,000
●
Embraced by Maker community to
put a computer in any project
– ~20 million made so far

Raspberry Pi encourages experimentation
Examples of actual uses
●
Cheap desktop computer
●
Software build status display
●
Internet photo frame
●
Network music player
●
Streaming TV system
●
FreedomBox server
●
Retro arcade game
●
Weather station
●
Security surveillance camera
●
Time-lapse photography
●
Autonomous boat computer
●
Drone flight computer
●
Hang glider & experimental EFIS
●
ISS payload controller

Think about security from the start
●
Experimentation is good
●
Security holes are bad
●
Thinking about security shouldn’t deter fun experiments
●
Keep aware of security issues
●
Keep project priorities in perspective
We’ll look at prioritization after an overview of IoT security

Internet of Things (IoT) security issues
●
Awful state of IoT security
●
Consequences of neglect
– Intrusion on your private network
– Stolen/destroyed data
– Invasion of privacy
– Equipment malfunctions
– Personal/company reputation
damage
– Attacks launched at others
– etc
2018 XKCD comic https://xkcd.com/1966/

IoT security issues
●
You don’t want to be part of the problem
●
Two ways to think about this
– Protect your device from the network
– Protect the network from your device
●
Many security issues in IoT devices are not unique to IoT
– We can take advantage of security advice specific to our projects
– Tip: OWASP (Open Web Application Security Project) cheat sheets
are applicable to more than just web apps – more later

Project priorities
●
Take security seriously - but avoid overload
●
Overload is a security problem when anyone gives up on security
●
You can filter out overload by prioritizing what matters most
●
To prioritize, look at what motivates you for your project
●
At work
– Paycheck, business & technical goals, regulations, standards
●
At home
– Technical goals, learning

Project priorities: Risk Matrix
●
Consider likelihood vs impact
●
Likelihood
– How probable is it?
●
Impact
– How severe is it if it happens?
●
The risk matrix shows how to
prioritize based on likelihood
and impact of an issue
Risk matrix adapted from
Pilot’s Handbook of Aeronautical Knowledge &
Risk Management Handbook
by US Federal Aviation Administration

Setting up a Raspberry Pi: Choose OS
●
Online instructions at https://projects.raspberrypi.org/en/projects/raspberry-pi-setting-up
●
Select an OS
– Raspbian is Debian Linux for Raspberry Pi, officially-supported OS
●
Start with Raspbian if you’re new to Raspberry Pi
– Other Linux distributions:
●
Ubuntu – commercial edition of Debian Linux
●
Fedora – Open Source base used by Red Hat Enterprise Linux
●
Alpine – security emphasis, official distribution used by Docker containers
– TV entertainment centers (Linux): OSMC, LibreElec
– FreeBSD
– RISC OS
– Windows IoT or ARM64

Setting up a Raspberry Pi: Hardware
●
Write your OS to a MicroSD card
●
Insert MicroSD card in RasPi
●
Connect USB keyboard & mouse
●
Connect HDMI video
●
Connect Ethernet
– Optional: WiFi available on RasPi 3 & 4
●
Connect USB power
– Micro USB on RasPi 1-3
●
RasPi 3 requires 2.5 amps
– USB-C on RasPi 4
●
RasPi 4 requires 3 amps
●
Boot up!
Hardware diagram by Raspberry Pi Foundation

Modify RasPi settings
●
Securing your system
– Change passwords from default
– Use encryption (SSH, TLS)
●
Deny SSH root logins
– Use existing software when you can
●
don’t reinvent the wheel
●
Install software updates
– Close unused socket ports
●
“netstat -nlp” or “ss -lntu”
●
Shut down unneeded servers/ports
●
Use iptables/nftables/ufw firewalls
●
This minimizes opportunities to attack
– Set SELinux to “enforcing”
●
Securing your network
– Use encryption
●
RasPi is powerful enough to use
encryption
– Secure the client and server
●
RasPi can be on either end
– Don’t use protocols that send
passwords “in the clear”
– Assume anyone could be packet-
sniffing the network
●
A compromised RasPi can
●
And you just installed a RasPi

Where to get a Raspberry Pi
●
Local stores, if you can’t
wait...
– Central Computers
●
Santa Clara
●
Sunnyvale
●
Newark
●
San Mateo
●
San Francisco
– No longer at Fry’s
●
Many “starter kit” packages include
everything you need (cables, microSD,
etc)
●
Online retailers
– Lowest prices (i.e. $35 for bare RasPi
Model B board) are only from the
manufacturer
●
Newark Electronics
– Also popular among Makers
●
SparkFun Electronics (Boulder)
●
AdaFruit (NYC) – slow UPS shipping to CA
– Beware of markups by Amazon retailers!

Attack surface analysis
●
The “attack surface” is all the places attacks can potentially
come from
●
OWASP attack surface cheat sheet
https://owasp.org/www-project-cheat-sheets/cheatsheets/Atta
ck_Surface_Analysis_Cheat_Sheet.html
●
List of all parts exposed to potential attack
●
Attack surface is not necessarily vulnerabilities
– It is the list of places to look for them

What kind of target have you created?
●
What data is on your device?
– Passwords
– Web interface
●
What hardware does it
control?
– Cameras
– Home automation
– Appliances
– Unlock doors
●
What does it communicate
with?
– Routers
– Risk for man-in-the-middle
attack?
●
What does it display?
– Vulnerable to vandalism?
●
The network itself is valuable
– DDoS, botnets

Tip: lock down SSH logins
●
Create a non-root user (substitute name and user id)
useradd --comment="First Last" --create-home flast
passwd flast
●
Create a group for SSH logins
groupadd sshlogin
usermod -G sshlogin,wheel flast
●
Modify /etc/ssh/sshd_config
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
AllowGroups sshlogin
●
Restart sshd
systemctl restart sshd.service

Tip: shut down unused services
●
Find all listening network ports, either of the following:
netstat -nlp
ss -lntu
●
For each unneeded server
– Stop the program (i.e. with systemctl on systemd-based distribution)
– Uninstall the software
●
Repeat until port list shows only wanted software listening
●
Unneeded listener processes unnecessarily add to attack surface

What else adds to the attack surface?
●
Physical interfaces
– Keyboard, mouse, etc
●
Rogue USB devices
– Who has access to the ports?
●
Theft of RasPi or SD card
– For convention booth or
science fair display, put the
RasPi in a locked enclosure
●
Social engineering
– Who should have access?
– How do you know someone is
who they say they are?
– How would an attacker try to
fake a valid user?
– Do trusted users know how to
verify other users?
– Make sure all trusted users
know not to discuss the security
configuration

IoT security tips
●
Consider security from the
start
– Even if there isn’t a design
●
Code reviews help
– Ask a friend
– Offer to help friends
●
RasPi is powerful enough to
do encryption – use it
●
Use existing software when
available
– Apply package updates
●
If network isn’t needed,
disconnect it after initial
package update
●
Turn on SELinux (security
enhanced Linux) kernel
feature

OWASP security resources
●
OWASP (Open Web
Application Security Project)
has useful advice for more
than just web apps
●
OWASP IoT Top Ten
– Next slide
●
OWASP Cheat Sheets
https://cheatsheetseries.owasp.org/
– Use like security checklists
– Access Control
– Cryptographic Storage
– Database Security
– Error Handling
– Input Validation
– Key Management
– Password Storage
– REST Security
– Transport Layer Protection

OWASP IoT Top Ten, 2018 edition

Security alerts: what to watch for
●
Software updates
– Subscribe to RSS feeds when software developers provide them
●
US CERT
●
NIST NVD: National Vulnerability Database
●
MITRE CVE: Common Vulnerabilities & Exposures

Questions?
From Commit Strip comic https://www.commitstrip.com/en/2016/02/24/the-internet-of-things-has-gone-too-far/

Follow me
@KO6YQ on Twitter for technical topics like this
@ikluft on Twitter for aerospace & science topics
Ikluft on LinkedIn

Securing a Raspberry Pi and other DIY IoT devices

More Related Content

What's hot

Similar to Securing a Raspberry Pi and other DIY IoT devices

More from Ian Kluft

Recently uploaded

Securing a Raspberry Pi and other DIY IoT devices