IEEE Consumer Electronics Magazine - November/December 2019 - 49

Overclocking
Overclocking the Raspberry Pi has always
been possible, but since September 2012, Raspbian includes a safe option to perform it through
the raspi-config application. If this option is used,
the system will automatically disable overclocking
if temperature reaches 85  C. Any other attempt to
overclock the Raspberry Pi will permanently set a
bit inside the SoC, which can be checked in the file
/proc/cpuinfo. Revision information that starts by
1000 implies that the Raspberry Pi has been overclocked outside of the allowed limits.
GPIO Logic Levels and Serial Access
The GPIO pins of the Raspberry use a voltage
of 3.3 V and do not have any protection against
overvoltage. This means that any voltage higher
than 3.3 V may destroy the block inside the SoC,
so connections must be done very carefully. As
an example, the GPIO pins can be used to access
the console through the serial port, but a logic
converter will be required as the serial port uses
5 V logic.
Real Time Clock Absence
In order to reduce costs, the Raspberry Pi does
not have a real time clock, given that it would have
increased the final cost because of the extra area
requirements to hold the clock, the battery and
other required components to make it work. The
absence of a real time clock means that date and
time are not stored internally, which is critic for
functionalities, such as certificate validation or
other cryptographic actions. In order to recover
the correct time after reboot, the Raspberry Pi
can get the hour from a Network Time Server,
which implies having a network connection.7
Xenon Flash Shyness
The Raspberry Pi 2 reboots if it is pointed
with a laser pointer or a xenon flash.8 This kind
of light confuses the processor core power regulator and generates a voltage drop, which makes
the Raspberry Pi 2 reboot. A simple solution is
to cover the chip marked as U16 with an element, such as Blue-Tack.

SOFTWARE ANALYSIS
The Raspberry Pi needs an OS in order to
work. There are some OS ready to be downloaded

November/December 2019

and easily installed from the official Raspberry Pi
website. In this section, an analysis of the security of some of the systems that can be installed
on the Raspberry Pi 2 will be performed. The
analyzed OS are: Raspbian, Windows 10 IoT,
OpenELEC, Ubuntu, and RiscOS. For each system,
we have analyzed: default users and passwords,
available public services, and if possible, an
attack to the public services.
A default password is a security breach in a
system, given that any attacker could easily
access the system after discovering the system
type.9 Unnecessary services can also be a source
of security issues as they may be misconfigured
and exposed to bugs without providing any useful.

Raspbian
The two analyzed versions of Raspbian are
Wheezy, released on May 2015; and Stretch,
released on August 2017. The installation of a
Raspbian system creates the default user -pi- and
its default password -raspberry. This system does
not let the user choose this username and password during the installation. Only after finishing
the installation the user may change the password, as they would do in a regular Linux system.
Regarding the public services of Weezy, NMap
only discovers an SSH server in the port 22. This
is an OpenSSH server, version Debian-4þdeb7u2
1.0.1e 11 Feb 2013. This version could be vulnerable to the UserRoaming bug but it is not. This is
because the stdio buffers used in GNU/Linux are
cleaned after use.10 Concerning the Heartbleed
bug, this version is not vulnerable to it because
the package installed in this version of Raspbian
(OpenSSL 1.0 2þrvtþdeb7u16) has the bug
fixed.11 Stretch does not have any public service
according to NMap. This result is expected as
Raspbian has its SSH server disabled by default
since the release of November 2016.12 This service can be activated from the Raspbian configuration menu.
Windows 10 IoT
For the Windows 10 IoT analysis, two Windows IoT versions have been analyzed: Insider
Preview 10.0.10556.0, from November 2015 and
Insider Preview 10.0.15063.0, from September
2017. Windows 10 IoT 10.0.10556.0 has a default
administrator user -Administrator- and password

49
IEEE Consumer Electronics Magazine - November/December 2019

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - November/December 2019
