IEEE Consumer Electronics Magazine - November/December 2019 - 50

Consumer Electronics Security

-p@ssw0rd. This password can be changed after
the installation using the command line.
A default installation of this OS keeps eight
open ports with their services. These services
are: FTP (port 21), SSH (22), Microsoft Windows
RPC (135), Samba (445), remote debug (4020),
remote management (5985), web server (8080),
AllJoyn (9955), and WinRM (47001). Among these
services, the most interesting ones are FTP and
HTTP. The FTP service is an anonymous FTP
server with read and write rights on all folders,
including system ones. This means that anyone
that can access the Raspberry Pi will have complete control of the system as they could modify
or delete any of its configurations.
Regarding the default administrator password,
it can now be chosen if the IoT Dashboard utility is
used to create the image. Moreover, the FTP
server does not run anymore as a start-up daemon.13 In both tested versions, the configuration
of Windows 10 IoT can be set up using the Windows Device Portal, available through the web service on the port 8080. The access to this service
requires authentication, but it is done in clear
text, so it is easy to crack. An attack against this
service using man in the middle and ARP-spoofing
can be performed and the password of the administrator can easily be discovered using Wireshark.

OpenELEC and LibreELEC
The version of OpenELEC analyzed in this
paper is the 8.04 and the LibreELEC one, 8.02. For
both systems, only a Samba server is installed by
default. Both systems are installed by default
with the user -root- and the password -openelec.
These parameters cannot be changed. If a user
needs to change these values, he will need to
recompile the whole system from its sources.14
The two systems have two easy-to-access
services that do not require any authentication
to access to them: an HTTP server and a Samba
server. The HTTP server provides, through a
web interface, complete control of the system as
if it was a remote controller. The Samba service
gives access to the media -so it can be handled
easily- and it also shares some configuration files
of the system. This shared information includes
Samba's configuration, so it would be easy to
modify the configuration file to share the whole
system as a resource.

All these shown security issues are already
known. In their forums it is warned that OpenELEC is only an entertainment system and that it
has not been designed targeting security.14 As
LibreELEC is a fork of OpenELEC, this can also
be applied to it.

Ubuntu
The Ubuntu version used for the analysis is
16.04. By default, no services are installed, but
for this exercise Open SSH has been installed
during installation. Ubuntu creates a normal
user with superuser rights instead of asking
for the root password creation. The username
and the password of this user will be asked during the installation. This avoids the creation of
default users or passwords, increasing security.
NMap shows, as expected, a single public service
which is an SSH server listening in the port 22.
The installed versions of OpenSSL (1.0.2g) and
OpenSSH (7.2) are neither vulnerable to Heartbleed nor to UserRoaming bugs.
RiscOS
RiscOS is an OS created in 1987 by Acorn
Computers. It was designed to run on RISC processors, which is precisely what ARM is. This O.
S. is a single user operating system. This means
that only one user can be logged in at the same
time. It also counts on WIMP (Windows, Icons,
Menu and Pointer) to let the user interact with
the system.6 The RiscOS version analyzed is the
15, released on May 2017. This version can be
downloaded from the official website of Raspberry Pi and installed easily in an SD card. After
a default installation, NMap cannot discover any
public service. This means that the system cannot be accessed remotely. If someone wants to
access the system, they will require physical
access to the hardware, screen and input devices -keyboard and mouse. Taking into account
these facts, RiscOS is a highly secured system
after a default installation.

DISCUSSION AND CONCLUSION
After analyzing the hardware, it can be concluded that the Raspberry Pi hardware design is
more focused on decreasing costs than on security (Refer Table 1). This becomes obvious when

IEEE Consumer Electronics Magazine

IEEE Consumer Electronics Magazine - November/December 2019

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - November/December 2019