IEEE Consumer Electronics Magazine - May/June 2023 - 79

FIGURE 4. Communication between ATmega
microcontroller and Linino using the Bridge library.
Firmware Analysis Regarding software vulnerabilities,
communication between both modules-Arduino
and Linux-is done using the
Bridge library, which can also be exploited. An
attacker can take advantage of buffer vulnerabilities
on any of the parts while using the Bridge
library.30 Thus, an attack coming from the Arduino
microcontroller can impact on the Linux side
and vice versa.
Some old Yun boards are delivered with the
old Linino Linux version, which contains too
many security issues to move it to a production
system.40 Some issues that a user may experiment
with this old version may include: liability
of bridge library, Wi-Fi stability, undeveloped
functions (like fileio), and stability when reading
big files. Reported issues were fixed on the
OpenWrt version.
At the time of writing this article, included
Python version is 2.7, which end of life date was
April 2020.43 This means that current version of
OpenWrt contains an almost outdated version of
Python that must be updated shortly. Developers
should foresee this update and code accordingly
to this situation.
OpenWrt has security breaches, including
passwords in plain text, unpatched daemons, vulnerable
kernel or lack of integrity checks on critical
files.30 Keeping default configuration for
production devicesmay imply security issues too.
Default configuration is a common vulnerability
existing in devices with OS, which also
applies to the Arduino YUN. Part of this default
configuration involves default password and
nonsecure HTTP requests. Moreover, this vulnerability
may even impact uploaded sketches.
As an example, the default root password,
which is used to connect to web-CLI, (a web-based
Command Line Interface) or through ssh, is
FIGURE 5. Response time of ping command while
performing a DoS attack in an Arduino YUN.
" Arduino. " This password can be changed through
CLI but as it is served using the nonsecured connection,
any attempt to change the password may
be sniffed. HTTP API requests are done, on default
configuration of Arduino, using a nonsecure channel.
As previously mentioned, the HTTP server
used in the analysis is uhttpd, and its configuration
file can be found in /etc/httpd.conf.44
An attacker knowing the Arduino Yun Linux
password, and with access to the same network of
the device, will be able to upload any sketch. Arduino
software-online or local-detects if an Arduino
Yun is connected to the same network and
allowsthe user to upload the sketch through Linux
using the network. Arduino password will be
requested. Thus, this passwordmust be kept safe.
Unlike the Arduino unit, the Linux part can run
applications with stack protections. Existing stack
vulnerabilities on applications running on
OpenWRT can be minimized on production systems
using protection techniques. These protection
techniques, like ASLR or Stack Canaries, will
force the application to stop if the expected flow is
not followed. The booting process in the two Arduino
Yun sides are completely independent and
with no synchronization. On one side, the AVR
ATmega32U4 microcontroller runs an uploaded
sketch as any other Arduino board. On the other
side, the MIPS Atheros AR9331 microprocessor
boots theOpenWrt-Yun Linux distribution.
The two Arduino Yun modules can be also
reset independently using the corresponding reset
buttons. This means that if the microcontroller is
reset, the Linux system keeps running. It also
works the other way around: if the microprocessor
is reset, only Linux will reboot and the microcontroller
sketch continues running.
May/June 2023
79
IEEE Consumer Electronics Magazine - May/June 2023

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - May/June 2023
