IEEE Consumer Electronics Magazine - May/June 2023 - 73

be independent systems or be part of larger systems
like SCADA networks, cars, IoT scenarios1 or
domotic sensors.2 These embedded devices, or
the systems they are part of, may be exposed to
the Internet, which involves a risk to any element
connected inside the organization. If a device is
vulnerable, either by its hardware, software or its
non-encrypted communications, it will become an
unauthorized entry point to the network.
Arduino is a modular and easy-to-use low-cost
embedded platformused in thousands of projects
of any kind3 thanks to its low-cost, open hardware
approach and flexibility with a huge potential for
prototyping,4 small product runs,4 IoT,5 makers6
or educational electronic projects,7 among others.
The most popular Arduino board is the Arduino
UNO, perfect for beginners.8,9 Prototyping
projects usually use boards with enhanced features,
such as more pins or better microcontroller.
In these cases, the Arduino MEGA is the most
popular option.8,9 In the case of small product
runs based on Arduino, designers create their
nonofficial own Arduino-compatible boards based
on existing ones. Makers usually also use nonofficial
boards, but instead of creating their own they
use third-party nonofficial boards due to their low
cost. Wemos D1R2 stands out among the most
popular nonofficial Arduino boards10 due to its
price, UNO compatibility and embedded WiFi.
Regarding IoT, these projects require Arduino
boards with connectivity. The most popular Arduino
boards for IoT projects are the Arduino MKR
1010 boards,11 with WiFi connectivity. Other popular
boards for IoT projects are also the Arduino
YUN boards, with both Bluetooth and WiFi connectivity.
These YUN boards are also used for
more complex projects, since they are the only
Arduino devices with Operating System.12
The Arduino YUN, can run the OpenWrt-Yun
Linux distribution. In this board, Linux and Arduino
applications run on two well-defined hardware
device sections and communication between
themuses the Bridge library.
Arduino vulnerabilities and weaknesses must
be well known in order to minimize risks to production
environments. As with any other embedded
system, bad settings on either hardware or
software will lead to important security breaches
that give an attacker free way to get unauthorized
data from the organization.13
May/June 2023
However, currently, there is a gap in the literature
concerning specific vulnerabilities on Arduino.
Some works can be found regarding IoT14-22
and embedded devices security23 but almost none
are completely focused on Arduino hardware.
The research questions of this article are the
following:
1) RQ1: Are Arduino boards secure-enough devices
to be used in production environments?
2) RQ2: What hardware vulnerabilities can be
found in Arduino boards with and without
Operating System (OS)?
3) RQ3: What software vulnerabilities can be
found in Arduino boards with and without OS?
4) RQ4: What communication vulnerabilities
can be found in Arduino boards with and
without OS?
This work analyzes vulnerabilities in hardware,
software, and communication of Arduino
devices with and without OS. Thanks to the
results of the analysis the main Arduino security
issues are highlighted and can be used in order
to limit the associated risks.
This research may be of interest to researchers,
designers, technicians, engineers, and makers
who would like to use Arduino on their
projects to be aware of the potential problems
and know how to solve them. For example, projects
such as the articles by Menacho et al.,24 Garcia
et al.,25 and Rodrıguez-Robles et al.26 would
benefit from this study, since they present some
of the vulnerabilities presented here.
The rest of this article is structured in four
parts: materials and methods, which includes a
description of how the research has been conducted;
related work, where a state of the art is
provided; results, which provides the vulnerabilities
analysis of Arduino boards with and without
OS; the discussion, where the main findings
are provided in relation to the research objectives;
and finally the conclusions, where the
main contributions are highlighted.
MATERIALS AND METHODS
This research has involved four main stages:
literature review, boards selection, vulnerabilities
analysis, and associated good security practices
73
IEEE Consumer Electronics Magazine - May/June 2023

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - May/June 2023
