0

I have the idea of deploying a product using a Raspberry Pi alike (CHIP) however I am concerned of the security issues getting a wireless device into people's homes

The device will be:

  • Using all the default passwords and settings (debian)
  • Most likely powered 24/7 or during long periods of times
  • A portion of the users will connect it to the internet (wireless network) to get updates, the rest won't, however the wireless interface will keep ON
  • The device won't do any critical task as opening your garage, it will be more like a game

So far I have came up with this security issues:

If the device is in the wireless network

  • Anyone already in the network will be able to install anything (sniffers, etc..) but they are already in your network, so you should trust them right?

If the device is not in the wireless network

  • None

How dangerous is to have an unattended wireless device like this connected to your network, or in your wireless range?

Improve this question
1
  • On one side this is a problem alright, someone may not notice an intruder on an unattended device for a very long period of time. On the other side, people do leave their PCs on for several days or weeks, and an intruder often is pretty difficult to detect in that environment too.
    – grochmal
    Commented Oct 19, 2016 at 23:22

1 Answer 1

Reset to default
1

I believe that you should not trust other users in the network, I believe that you want to use it as a black-box that is serving for a specific purpose for your clients. So they are receiving some hardware that helps to achieve some goal but they have no reason to look inside how it works..even if it could be challenging to achieve.The way I see it is that you want to use the device similarly as the boxes we receive for our TV services that are connected to the Internet.

So you should work on it to secure it, similarly as the IP Cameras we have.

I know that Google's ChromeCast can be accessed as by anyone who has access to the network, and they have decided to go in favor of easiness of usability instead of security and now any kid can start to broadcast anything on TV. The risk is not high, but our this situation where this device serves for example to open the garage and if the attacker was able only to penetrate in the network of your client, we could authenticate to that box with the default password and send a the request to open the garage allowing them to access in da house.

It is similarly problematic when routers were having default passwords, allowing malicious users to login,change network configurations to read their network traffic.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .