4

I bought an el cheapo 3.5" LCD for my Raspberry Pi from Amazon. It turns out there are many people making copies of the design, to the effect that the first(?) manufacturer says that their LCD is being "pirated". Amazon reviews sent me to the Waveshare site to download the drivers, and there is an SD Card image available as well. Adafruit's 3.5" LCD gives you similar options to manually install the drivers/kernel, or use their prefab SD Card image.

I understand and appreciate the manufacturers making it easy for Linux n00bs to use their hardware. However, how do I know that there isn't malware, spyware, or other undesirable software bundled with their SD card image?

Hailing from Windows, as most people are (5:45), it doesn't make sense that I have to replace the kernel to add a driver to a Raspberry Pi, or that an LCD driver is hundreds of MB. But Linux is different, so OK.

Maybe not historically, and maybe not soon, but at some point, some kind of bad software will make it into these SD images. How can I vet such images? How can I scan them for malware or other unwanted software? It may not be a virus or a trojan that gets bundled, but some kind of cryptocurrency mining software, or some kind of data exfiltration software. Some kind of Internet Transmitted Disease (ITD).

I understand there is a whole industry devoted to Infosec, but what are the first things a hobbyist could do, learn, or have as "common sense" for this situation?

  • There are virus scanners for linux, e.g., clamav, which is packaged in Raspbian. It's billed mainly as a mail gateway tool but can scan directories, etc. – goldilocks Nov 12 '17 at 7:53
8

To answer your question, you cannot guarantee any software is safe; most of us rely on the reputation of the supplier.

To address the other point you made you DO NOT need a custom kernel or OS to install a driver. It should be possible to install the required files, and most reputable sites, even those that supply pre-built images, do have instructions, although these often are complex and require some Linux skills.

Indeed installing a custom kernel or OS is a bad idea; it will soon be become out of date (if not already) and will be overwritten by updates.

  • 1
    Great hint. Those random images recieve little care or updates and the next thing you know is that the seller went bankrupt and then you're stranded with an ancient kernel and driver BLOBs ... – flakeshake Nov 27 '17 at 8:48
0

One possible approach.

  1. Establish a change control relationship with the supplier to notify you of any planned changes to the software image bundled with the SD card.
    • Many reputable suppliers will have change control and product revision policy publically
    • The best will actually stick to it.
  2. Audit a sample SD card from a supplier, this can be done in a variety of ways, usually requires a linux or security expert.
    • In the simplest case this is as simple as a hash check against a released raspbian image of the same vintage, not possible if SD card vendor bundles additional software.
  3. Compare subsequent cards from same supplier against the golden sample.
  4. Repeate step 2. every time the supplier issues a Product Change Notice (PCN)

These conveniences aren't just for "noobs", in the commercial world many memory manufacturers will offer a pre-programming services for components purchased from them.

Recently I was configuring a fleet of 20 raspberry pi's for an industrial deployment, and opted to go for a raspberry pi branded pre-programmed SD cards, the extra cost was more than worth the saved time of having to image SD cards myself.

In other words, I would not be wary of pre-programmed SD cards just because they are pre-programmed. It depends completely on the supplier and your trust in them.

Typically, if designing a commercial product or purchasing for commercial use, one will establish a (human) relationship with important suppliers. If security is important to you, then it is up to you to find the supplier that is willing to work to build that trust and deliver on your expectations.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.