0

Suppose I acquire a second hand unit, or maybe I lend mine to a friend. Can I be reasonably sure the unit hasn't been malwared?

Consider the nightmare scenario. My friend borrows my Raspberry Pi but I keep my SD card. He adds his own SD card, starts up the device and because reasons, visits all the dodgy websites, downloads many dodgy executables and runs them all. The machine is running all the botnets and it's terrible. Finally, he unplugs the power, removes his SD and returns the device to me.

I put my own SD back in, power it up and log into my bank. Am I going to have a problem in this hypothetical?

Reading another question it seems that the "BIOS" is unchangeable at a hardware level, which is great. Does that mean I don't have to worry about malware if I'm sure my SD card doesn't have any?

For the purposes of this question, I'm only thinking about modification of the Raspberry Pi from a black-box point of view. IE, only counting attacks through the various ports. I imagine someone could solder in a key-logger into the circuit board and maybe even one that's super tiny and invisible to a casual inspection, but that would require my friend to be actively evil rather than really stupid.

4
  • 1
    There's no user accessible long term storage on ANY raspberry pi (except for a Compute Module with EMMC). Everything is normally on the SDCard.
    – Dougie
    Nov 2, 2020 at 13:22
  • @Dougie Thank you. That would make a great answer.
    – billpg
    Nov 2, 2020 at 13:23
  • @Dougie And what do you call the EEPROM? There is a EEPROM in the Raspberry Pi 4 that holds the "BIOS" the theoretically could be manipulated to do malicious tasks. Nov 2, 2020 at 16:07
  • The EEPROM isn't user accessible and the code that runs from the EEPROM isn't ARM or ARM64. So it can't be considered a risk.
    – Dougie
    Nov 2, 2020 at 16:11

1 Answer 1

2

There's no user accessible long term storage on ANY raspberry pi (except for a Compute Module with EMMC). Everything is normally on the SDCard.

There is the EEPROM on a RPi4 or 400 or CM4 but it isn't user accessible and the code that runs from the EEPROM isn't ARM or ARM64. So it can't be considered a risk.

2
  • I would also add your comment about the EEPROM.
    – Ingo
    Nov 2, 2020 at 19:37
  • 1
    @Ingo added that.
    – Dougie
    Nov 2, 2020 at 20:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.