3

One thing I love about my Raspberry Pi 2 is that I can use them as tiny air-gapped devices (I know I could use the Zero too: but they're not as powerful and kinda hard to find). I'm using one to run Google Authenticator and another one to sign crypto currencies transactions while fully offline.

No network cable: 100% air-gapped device. This is very secure and basically only vulnerable to "black bag" attacks or trojaned USB memory sticks that'd somehow be able to own the Pi.

Now I like the idea of a faster, 64-bit, Raspberry Pi but I'm more than concerned about the integrated WiFi.

Does it mean that you cannot fully air-gap the Raspberry Pi 3 anymore?

I see three possibilities if I want a fully air-gapped Pi:

  • install a distro and delete the WiFi drivers and cross fingers that I don't have a trojaned system with WiFi sneakily up?
  • physically disable the WiFi on the Raspberry Pi 3 (is this doable ?)
  • stockpile Raspberry Pi 2's while there are still some for sale

Also what's next? An integrated webcam and microphone?

  • 4
    Without physical security and a secure boot your existing Pi's are equally vulnerable – Steve Robillard Feb 29 '16 at 11:21
  • How did you solve the problem in the meantime? @goobering - which one is the wifi-module that would need to be unsoldered or the traces cut thereto? How does it look like & where can it be found on the board? (also it would be good to know the same about the bluetooth-module) Thanks in advance – boreas93 Jul 7 '17 at 16:32
  • How, pray tell, would you have a completely air gaped RPi and still use Google Authenticator? – Jacobm001 Jul 7 '17 at 18:58
7

There's nothing I'm aware of that'll prevent you from physically removing or disabling the WiFi chip by desoldering it and/or cutting its traces. Alternatively, you just stick the whole thing in a tinfoil bag or a lead box. Given the relatively huge number of questions asked here relating to problems persuading a Raspberry Pi to connect to any kind of network, I'd imagine it should be pretty straightforward to completely bork your configuration files to prevent any connections.

Your applications don't sound tremendously computationally taxing. That being the case, I'd suggest it would save you some squinting through a magnifier burning your fingers if you stuck with the Pi 2 (or even an A+/B+) for the time being.

  • 1
    I don't think even a magnifier would cut it. Pun intended. – PNDA Mar 19 '16 at 13:13
0

I think that if you operate the device within a Faraday cage, no WiFi can escape. Run the Raspberry Pi from batteries. A Faraday cage can be fashioned from a cardboard box lined inside and out with conductive foil. This sounds silly, but you might be well off making one using a refrigerator box like the one my kids used for a fort when they were small.

0

Turn off the WiFi, wrap it in foil and store it in a microwave. If unauthorised physical access can be gained then:

  • your SD card can be read

  • a USB WiFi dongle could be used

  • a USB exploit could be introduced

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.