Liquid security scenario

Question

I'm a part of a small team of undergraduate developers taking a course on developing Arduino and Raspberry Pi applications with a focus on the Internet of Things. Our current task is to imagine, design, and implement some useful system with the following requirements:

1. We must make use of a Raspberry Pi
2. We must use some external sensor or actuator in tandem with the Raspberry Pi
3. We must implement a web system supporting the physical device in some way

We've decided to make use of a magnetic valve to prevent unauthorized users from accessing a liquid. Use cases could include safely storing hazardous or poisonous liquids, preventing the theft of valuable liquids, or preventing minors from accessing alcohol.

To be more specific, we have connected our Raspberry Pi to the magnetic valve and to a number pad. When you enter a certain PIN, the valve opens temporarily to allow the flow of liquid and then closes after a fixed amount of time. This setup is considered one device.

We've developed a web system that allows a user with one of these devices to register an account with us. They are required to have a key located on the device to register an account. Once their account with us has been made, they can register additional devices if they have them. The user establishes a PIN for each registered device through the web system. They can use the web system to change their password for their web account, change PINs for any of their devices, and view reported logs of every time their device was successfully accessed.

Once a user has one of these devices and has registered online and established a PIN, their device is ready to dispense their liquid. The valve is attached to a very hardy container that locks into the mechanism, preventing an unauthorized user from simply removing the container of liquid from the device. Assume that the physical security of the valve itself, the container, and the locking mechanism are ensured for the purposes of this academic scenario.

When a user wants to access their securely stored liquid, they enter the associated PIN into a number pad attached to the Raspberry Pi. Their PIN is hashed and sent over the Internet to our server for comparison with the hashed PIN stored in our database. If the PIN is correct, the server returns to the device with a success signal. When the device receives a success signal the valve is opened for a fixed amount of time, set so that a certain volume of liquid will be dispensed before the valve closes once again. The server takes note of when the successful request occurred for logging purposes.

My problem is that the valve is opened and closed with two simple functions located on the Raspberry Pi itself. The application we've developed for controlling the device waits until it receives the success signal before opening and closing the valve, but I don't know how to stop a malicious user from writing their own application and making use of these two functions to open and close the valve.

The Raspberry Pi has both a video port and USB ports on the side. A malicious user that happens to be alone with the device could bring their own monitor and keyboard and hook up to the Raspberry Pi and run an application that could call the same functions that open and close the valve. How can I prevent this from happening?

Do I need the Pi to be secured physically so that the user can reach the number pad, but not the Pi itself? Is there a way to be to block the available ports from being used? Any suggestions as to how to handle this situation would be greatly appreciated. Security is not the main focus of this assignment, but I'd like to do the very best that I can.

Answer 1

Depending on your threat model you could add enclosures, alarms, CCTV, access controls to the room, a security guard etc... but without knowing what you want to do it is hard to say where to stop.

I would certainly consider securing the Pi itself - a locked metal container, securely fixed to the wall/device will make any attack harder/noisier/more obvious. Adding an alarm will also improve this.

If you can find an enclosure which incorporates a secure keypad (ie one that is hard to break and is tamper evident) that will help you prevent an attack.

Sealing ports can help, but if an attacker gets into the enclosure, they could access the traces on the PCB so while it has some deterrent value, I wouldn't recommend it.

Answer 2

The Raspberry Pi has both a video port and USB ports on the side. A malicious user that happens to be alone with the device could bring their own monitor and keyboard and hook up to the Raspberry Pi and run an application that could call the same functions that open and close the valve. How can I prevent this from happening?

Superglue.

This may be "everything looks like a nail," but to me it seems like the easiest attacks on your system are going to involve that Internet connection.

---

Their PIN is hashed and sent over the Internet to our server for comparison with the hashed PIN stored in our database.

If I understand correctly, the pinpad sends hash(pin) over the network, and the server stores hash(pin), so there's no real difference between this and a system that sends pin in plaintext and stores pin in plaintext, is that right?

Are you at all concerned that an attacker might be able to sniff hash(pin) (a.k.a. the real password) from what you send over the Internet, and replay it later to generate a success signal from the server? (See replay attack.)

For a possible solution technique, see Challenge-response.

---

If the PIN is correct, the server returns to the device with a success signal.

How complicated is this "success signal"? Are you at all concerned that an attacker might be able to spoof a success signal? That is, are you concerned that an attacker could masquerade as the server and replay a success signal at the client, regardless of what's happening on the pinpad at the time?

If you just want to make the success signal hard to counterfeit (which might be your original concern?), then consider having the server sign the success signal, and have the device verify that signature (by storing on the device a copy of the server's public key). Again, beware of replay attacks.

---

Finally, how many digits is the average PIN? Does your server have any protection against brute-force attacks? You say that the user can

view reported logs of every time their device was successfully accessed

but what about the unsuccessful access attempts?

If the PIN is between 0000 and 9999, and if it takes 4 seconds to try out each possible PIN, then an attacker can crack the PIN by brute force in (4×10000/3600) = 11 hours. If it takes one second to try each possible PIN, the attacker can crack the PIN by brute force in 2 hours 45 minutes.