61

According to ARM themselves, the processor cores used in all models before the Pi 4 are not vulnerable. The majority of Arm processors are not impacted by any variation of this side-channel speculation mechanism. A definitive list of the small subset of Arm-designed processors that are susceptible can be found below. [see link for the table] The ...


33

I've been using my model B as a router with traffic shaping, using just the one Ethernet port it comes with. Here's a quick-and-dirty on how: Enable IPv4 Forwarding, so your Pi acts as a router by forwarding any traffic it receives Configure your Pi with static network configuration so it will not be influenced by DHCP changes suggested below. Here are the ...


27

The core affected package is libssl1.0.0, which if you can, just replace with the patched version, restart everything. You can try to download a binary, and manually install an arm-hf, using dpkg with the version 1.0.1e-2+deb7u5 for wheezy. You can also use the jessie repository, just for this single one time update, which should get you version 1.0.1g-1. ...


22

The Pi (all versions) is not vulnerable. Spectre and Meltdown both require out-of-order execution. The Cortex-A7 used in the early Pi 2 and the Cortex A53 used in the later Pi 2 and the Pi 3 is a strictly in-order architecture. The ARM11 used in the Pi 1 is partially out-of-order, but not in a way that permits Spectre or Meltdown to work. ARM confirms ...


17

Since consumer SD cards use top-secret Flash Translation Layers and actually have more capacity than advertised to remap bad blocks or for general wear leveling this is impossible via shred. The writes to a file might not end up at the same place where it currently exists on the disk at all. You have four choices : 1) Physical destruction. 2) Shred single ...


15

Yes, your Pis are vulnerable until the patched versions of the Debian packages are available for Raspbian. Edit: The patched versions are now available for Raspbian.


13

CA certificates are located in /etc/ssl/certs as well as /usr/share/ca-certificates/ and in some cases /usr/local/share/certificates. In general CA certs should not be manually added to the local trust store. There are reasons why certain CAs are not included. Without further research, it's unclear why this particular CA root cert was not included in ...


10

This is a trace of a default script (introduced in the November 2016 Raspbian release) which checks if you changed the password for the user pi. The script is stored in /etc/profile.d/sshpasswd.sh and displays a warning if the SSH deamon was turned on, but the password for the pi user had not been changed from the default one (raspberry). It is called on ...


10

I'd like to offer my different take on this. About Meltdown, it's a very specific vulnerability in some processors, so if ARM says the CPU in Raspberry Pi is not vulnerable, then it can probably be trusted. However, Spectre is a more general vulnerability. So far, only two variants have been demonstrated but I'm pretty sure there are more variants. The ...


9

Linux is a multi-user environment by default. Each user has his own folder in /home/TheUserName Users are highly restricted outside that folder. They only have read access to most things. By default, the Raspberry Pi comes with a single user called pi. This user has a home directory called /home/pi/. The catch: By default the pi user has the ability to ...


9

Auto-login is simply a convenience feature. By default, on the local console or UI, it provides the ability to not have to enter your user password before continuing loading the user's environment. It's insecure only if anyone else has direct, physical access to your Pi. Over SSH remotely, the user's password will still be required (so you definitely should ...


8

You can disable the HDMI output on your Pi by running: /usr/bin/tvservice -o (the option is documented in the code here) The USB ports can apparently be disabled by running: echo 0x0 > /sys/devices/platform/bcm2708_usb/buspower However, since the USB and Ethernet share a controller, turning off the USB also disables the Ethernet... which isn't great, ...


7

I would use TrueCrypt. Some of it's main features (from the site) include: Creates a virtual encrypted disk within a file and mounts it as a real disk. Encrypts an entire partition or storage device such as USB flash drive or hard drive. Encryption is automatic, real-time (on-the-fly) and transparent. Parallelization and pipelining allow data to ...


7

Extra trick on raspbian with usermod usermod command won't run if there are any processes of the to-be-changed user running on the machine when the command is run. If your on console of the pi there is a way to get around this without having to make another user (or set a pw on root): Assuming nothing else is running with your username other then the ...


7

There's nothing I'm aware of that'll prevent you from physically removing or disabling the WiFi chip by desoldering it and/or cutting its traces. Alternatively, you just stick the whole thing in a tinfoil bag or a lead box. Given the relatively huge number of questions asked here relating to problems persuading a Raspberry Pi to connect to any kind of ...


7

You need to use raspi-config to enable SSH. Previously the default value was "enabled" but in November 2016 this has been changed due to the security issues and the default value is now "disabled". For more info see here. Alternative method is to place a file ssh in /boot partition of the SD card. Content of the file is not important.


6

To add a new user in raspbian: sudo useradd -m -G pi,sudo,gpio,audio,video steve Then: sudo passwd steve Explaination: -m - Create a new home directory -G group1,group2,group3 - Add the user to these groups, don't add sudo if you don't want the user to have sudo privileges. steve - Name of new user passwd - Linux requires a password to login, so set ...


6

Syslog contains data in cleartext. So whatever a process deemed fit to be logged could be read by anyone. It could however be argumented that it would be very unreasonable for any service to log confidential data such as credentials but do you really want to put your trust on that? Even in the clear there could be data that you might not want to distribute ...


6

If you are really concerned about protecting your intelectual property then you can combine your Rapberry Pi based application with some external custom made micro controller (MCU like AVR, PIC, 8051...) based hardware key (connected to Pi via USB, RXTX, I2C, SPI, 1wire...). For example, Pi side application generates a random number which is sent to MCU, ...


6

How much do you trust this company? You don't specify how this device will be connected to your computer, but I assume that it will be able to see every site you visit - this would include your bank, medical info, what you shop for, your email etc. Therefore, your question comes down to are you comforable sharing this info with them, and any person/group ...


6

In the preface of Securing your Raspberry Pi the author says: This documentation will describe some ways of improving the security of your Raspberry Pi. This is followed by a conglomeration of options. I would name it "best practice list": Change your default password Changing your username Make sudo require a password Ensure you have the latest ...


5

If someone were to hack the router, it would be nice if the PI restricted access to itself from any computer other than one I have specified (my laptop). You can't, since if someone hacks the router, they could (for example) kick one of your other computers off the network and replace it using the same internal IP and MAC address (MAC addresses are easily ...


5

If you have two ethernet devices (eth0, eth1) you can bridge them like this: ifconfig eth0 0.0.0.0 ifconfig eth1 0.0.0.0 brctl addbr bridge0 brctl addif bridge0 eth0 brctl addif bridge0 eth1 ifconfig bridge0 up Now you've got a passive bridge called bridge0 where all traffic send through eth0 and eth1 can be sniffed via wireshark/tcpdump or whatever.. ...


5

No, nothing is stored on the Pi hardware itself. Everything is saved on the SD card, and as a result SD cards are interchangeable between different Pis. No one could recover any information off the Pi (sans SD card) as it simply isn't there.


5

I think that was the idea with the compute module all along. It should not be a problem to turn a profit. / 4. The superglue option is probably a good tradeoff. Ultimately you cannot defeat an attacker with physical access to the device. Have a look at game consoles which have probably millions invested in DRM infrastructure and they all eventually fall. In ...


5

According to the Debian Security Tracker entry for this vulnerability, updates for glibc/eglibc/libc6 will fix this issue: wheezy: 2.13-38+deb7u10 jessie: 2.19-18+deb8u3 These are available for Raspian as well. A simple sudo apt-get update && sudo apt-get upgrade should secure your box. To verify the version of your glibc, run apt-cache show ...


5

I don't see any reason why a properly secured Pi should be any less safe than a Windows machine; probably the Pi would be marginally safer. Recent versions of Raspbian (e.g. Stretch) come with SSH disabled by default, which reduces the chance of remote intrusion significantly. Since you don't need remote access, that simplifies that problem massively—just ...


5

The same version of Raspberry Pi OS works on all Pi models. https://www.raspberrypi.org/downloads/


4

I have a Certification Authority set up in a Raspberry Pi, with an Air Gap model, running xCA, which runs great on the Pi, by the way. It can do even asymetric cryptography without problems, but I would say you have to measure the amount of cryptography and the response time you need, given that very large amounts of data can take a while to process. I don'...


Only top voted, non community-wiki answers of a minimum length are eligible