IEEE Consumer Electronics Magazine - November/December 2019 - 51

Table 1. Summary of hardware vulnerabilities and
limitations.
Vulnerability

Description

Table 2. Summary OF OS vulnerabilities.
Operating
system

Vulnerability

Powered USB hub required for
USB devices that consumes more
than 500 mA
Raspberry Pi can be powered by
its USB due to the lack of USB
protections

Raspbian

Default user and password

Windows 10

Unsecure Windows Device Portal

OpenELEC

Default user and password (and
cannot be changed)

Overclocking

Bad configuration can burn the
device

LibreELEC

HTTP and Samba unsecured
services

GPIO logic
levels and serial
access

Ubuntu
GPIO uses 3.3 V logic. 5 V logic
may destroy the SoC

Nothing to report

RiscOS

Nothing to report

Real time clock
absence

Raspberry Pi cannot keep the
time after being powered OFF

Xenon flash
shyness

RPi 2 reboots if it is pointed with
a laser or a xenon flash

USB power and
backfeeding

observing hardware limitations, such as the
absence of a real time clock, or the lack of USB
protection. Weaknesses like the xenon flash shyness or the sensitivity to 5v logic on the GPIO
pins are also examples of how the hardware
design is focused on costs.
Users should be aware of this design goal and
must put extra effort on securing it. Physical
access of nonauthorized people must be
avoided. If untrustworthy people have access to
the physical system, they will be able to manipulate the environment easily: shutdown the system, change network connections or even
connect to the system using its ports. In the case
of Raspberry Pi 2, it is enough to take a picture
with flash to reboot the system. Hardware must
be manipulated carefully. A simple mistake
when connecting something with the wrong voltage to the GPIO pins can destroy the Raspberry
Pi. Bad quality powered USB hubs may also damage the Raspberry Pi if the output voltage is
above 5 V or if the output current is over 2.5 A.
Regarding the OS analysis, if the system is
exposed to the Internet, setting the correct configuration is a must. Table 2 lists a summary of
OS fragilities. Default users and passwords and
unsecured services are the main issues
detected. Default user vulnerability can give an
attacker free way to enter the system without
being noticed. In order to avoid this problem, a

November/December 2019

user should change the default root password
after installation. Unsecured services can also
give an attacker an easy way in to get system credentials. This is why a correct configuration of
required public services must also be performed. It is also required to remove unnecessary public services after installation.
In conclusion, a weak system in a network
exposes the whole environment, so users must
understand the risk of not spending time on
securing a system. The Raspberry Pi is a lowcost complete computer, which implies some
design and production concessions. This leads
to some limitations and weaknesses that must
be taken into account when working with it.
A default configuration might leave the system
in a vulnerable state, something that can be
exploited by malicious third parties. Being aware
of the vulnerabilities of this popular device will
help many engineers, developers and designers
to follow good practices to avoid or minimize
the risk of attacks on production systems.

ACKNOWLEDGMENTS
This work was supported in part by the projects: ETSII/UNED 2019-IEQ13 and e-Madrid-CM
under Grant P2018/TCS-4307, and in part by
IoT4SMEs under Grant 2016-1-IT01-KA202-005561.

& REFERENCES
1. J. H. Lee and H. Kim, "Security and privacy
challenges in the internet of things [security and
privacy matters]," in IEEE Consum. Electron. Mag.,
vol. 6, no. 3, pp. 134-136, Jul. 2017.

IEEE Consumer Electronics Magazine - November/December 2019

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - November/December 2019