61

According to ARM themselves, the processor cores used in all models before the Pi 4 are not vulnerable. The majority of Arm processors are not impacted by any variation of this side-channel speculation mechanism. A definitive list of the small subset of Arm-designed processors that are susceptible can be found below. [see link for the table] The ...


33

I've been using my model B as a router with traffic shaping, using just the one Ethernet port it comes with. Here's a quick-and-dirty on how: Enable IPv4 Forwarding, so your Pi acts as a router by forwarding any traffic it receives Configure your Pi with static network configuration so it will not be influenced by DHCP changes suggested below. Here are the ...


27

The core affected package is libssl1.0.0, which if you can, just replace with the patched version, restart everything. You can try to download a binary, and manually install an arm-hf, using dpkg with the version 1.0.1e-2+deb7u5 for wheezy. You can also use the jessie repository, just for this single one time update, which should get you version 1.0.1g-1. ...


22

The Pi (all versions) is not vulnerable. Spectre and Meltdown both require out-of-order execution. The Cortex-A7 used in the early Pi 2 and the Cortex A53 used in the later Pi 2 and the Pi 3 is a strictly in-order architecture. The ARM11 used in the Pi 1 is partially out-of-order, but not in a way that permits Spectre or Meltdown to work. ARM confirms ...


17

Since consumer SD cards use top-secret Flash Translation Layers and actually have more capacity than advertised to remap bad blocks or for general wear leveling this is impossible via shred. The writes to a file might not end up at the same place where it currently exists on the disk at all. You have four choices : 1) Physical destruction. 2) Shred single ...


15

Yes, your Pis are vulnerable until the patched versions of the Debian packages are available for Raspbian. Edit: The patched versions are now available for Raspbian.


13

CA certificates are located in /etc/ssl/certs as well as /usr/share/ca-certificates/ and in some cases /usr/local/share/certificates. In general CA certs should not be manually added to the local trust store. There are reasons why certain CAs are not included. Without further research, it's unclear why this particular CA root cert was not included in ...


11

Having looked at the RPi, it seems like a fairly secure device out the box, as long as you do a couple of things. The default user/pass needs changed. At the very least, change the password. For better security again, change the username as well. (Add a new user, then disable PI. Check that ROOT is also disabled from SSH login, though I think it is by ...


10

Having a little network background, the first thing that comes to mind is use it as a Snort box, and then you don't have to worry about only having one interface. You would setup your switch/router to forward all traffic to the Pi, but also pass it onto the end device. This is known as a switchport monitor, but your device may not support it. You may need ...


10

This is a trace of a default script (introduced in the November 2016 Raspbian release) which checks if you changed the password for the user pi. The script is stored in /etc/profile.d/sshpasswd.sh and displays a warning if the SSH deamon was turned on, but the password for the pi user had not been changed from the default one (raspberry). It is called on ...


10

I'd like to offer my different take on this. About Meltdown, it's a very specific vulnerability in some processors, so if ARM says the CPU in Raspberry Pi is not vulnerable, then it can probably be trusted. However, Spectre is a more general vulnerability. So far, only two variants have been demonstrated but I'm pretty sure there are more variants. The ...


9

Linux is a multi-user environment by default. Each user has his own folder in /home/TheUserName Users are highly restricted outside that folder. They only have read access to most things. By default, the Raspberry Pi comes with a single user called pi. This user has a home directory called /home/pi/. The catch: By default the pi user has the ability to ...


9

Auto-login is simply a convenience feature. By default, on the local console or UI, it provides the ability to not have to enter your user password before continuing loading the user's environment. It's insecure only if anyone else has direct, physical access to your Pi. Over SSH remotely, the user's password will still be required (so you definitely should ...


8

how about this for a start sudo apt-get install ecryptfs-utils sudo apt-get install lsof sudo ecryptfs-migrate-home -u pi There will be a bit more to it but thats the main part - it will only cover your home folder. If you want to do more then its something like: https://www.howtoforge.com/how-to-encrypt-directories-partitions-with-ecryptfs-on-debian-...


8

You can disable the HDMI output on your Pi by running: /usr/bin/tvservice -o (the option is documented in the code here) The USB ports can apparently be disabled by running: echo 0x0 > /sys/devices/platform/bcm2708_usb/buspower However, since the USB and Ethernet share a controller, turning off the USB also disables the Ethernet... which isn't great, ...


7

I would use TrueCrypt. Some of it's main features (from the site) include: Creates a virtual encrypted disk within a file and mounts it as a real disk. Encrypts an entire partition or storage device such as USB flash drive or hard drive. Encryption is automatic, real-time (on-the-fly) and transparent. Parallelization and pipelining allow data to ...


7

I have used the Raspberry Pi for routing, and it worked well. As you say, you need at least one more network interface, as the Raspberry Pi has only one Ethernet port. You can add another interface connected to the USB port. I have used a GSM modem and a Wi-Fi stick. Things to note: Use a powered USB hub. Wi-Fi and GSM devices demand more power than what ...


7

Extra trick on raspbian with usermod usermod command won't run if there are any processes of the to-be-changed user running on the machine when the command is run. If your on console of the pi there is a way to get around this without having to make another user (or set a pw on root): Assuming nothing else is running with your username other then the ...


7

There's nothing I'm aware of that'll prevent you from physically removing or disabling the WiFi chip by desoldering it and/or cutting its traces. Alternatively, you just stick the whole thing in a tinfoil bag or a lead box. Given the relatively huge number of questions asked here relating to problems persuading a Raspberry Pi to connect to any kind of ...


7

You need to use raspi-config to enable SSH. Previously the default value was "enabled" but in November 2016 this has been changed due to the security issues and the default value is now "disabled". For more info see here. Alternative method is to place a file ssh in /boot partition of the SD card. Content of the file is not important.


6

To add a new user in raspbian: sudo useradd -m -G pi,sudo,gpio,audio,video steve Then: sudo passwd steve Explaination: -m - Create a new home directory -G group1,group2,group3 - Add the user to these groups, don't add sudo if you don't want the user to have sudo privileges. steve - Name of new user passwd - Linux requires a password to login, so set ...


6

Syslog contains data in cleartext. So whatever a process deemed fit to be logged could be read by anyone. It could however be argumented that it would be very unreasonable for any service to log confidential data such as credentials but do you really want to put your trust on that? Even in the clear there could be data that you might not want to distribute ...


6

If you are really concerned about protecting your intelectual property then you can combine your Rapberry Pi based application with some external custom made micro controller (MCU like AVR, PIC, 8051...) based hardware key (connected to Pi via USB, RXTX, I2C, SPI, 1wire...). For example, Pi side application generates a random number which is sent to MCU, ...


6

How much do you trust this company? You don't specify how this device will be connected to your computer, but I assume that it will be able to see every site you visit - this would include your bank, medical info, what you shop for, your email etc. Therefore, your question comes down to are you comforable sharing this info with them, and any person/group ...


6

In the preface of Securing your Raspberry Pi the author says: This documentation will describe some ways of improving the security of your Raspberry Pi. This is followed by a conglomeration of options. I would name it "best practice list": Change your default password Changing your username Make sudo require a password Ensure you have the latest ...


5

If someone were to hack the router, it would be nice if the PI restricted access to itself from any computer other than one I have specified (my laptop). You can't, since if someone hacks the router, they could (for example) kick one of your other computers off the network and replace it using the same internal IP and MAC address (MAC addresses are easily ...


5

Here's the cite from the NST website: The toolkit was designed to provide easy access to best-of-breed Open Source Network Security Applications and should run on most x86/x86_64 platforms. RaspberryPi uses ARM CPU so it's not possible to directly use NST on it. You would have to recompile everything and probably do some other changes in order to run ...


5

If you have two ethernet devices (eth0, eth1) you can bridge them like this: ifconfig eth0 0.0.0.0 ifconfig eth1 0.0.0.0 brctl addbr bridge0 brctl addif bridge0 eth0 brctl addif bridge0 eth1 ifconfig bridge0 up Now you've got a passive bridge called bridge0 where all traffic send through eth0 and eth1 can be sniffed via wireshark/tcpdump or whatever.. ...


5

No, nothing is stored on the Pi hardware itself. Everything is saved on the SD card, and as a result SD cards are interchangeable between different Pis. No one could recover any information off the Pi (sans SD card) as it simply isn't there.


Only top voted, non community-wiki answers of a minimum length are eligible