RISK ASSESSMENT RATING: 6.33
How often the rogue device is used in the wild to conduct real-world attacks, with 1 being the rarest, 10 being widely used.
The Raspberry Pi is very cheap and very available, both very attractive features to attackers (both of the white hat and black hat varieties). In addition, the large number of security-related distros tailored for the Raspberry Pi have both fueled the popularity of the Raspberry Pi hardware for rogue devices and stand as a testament to its use.
The cost or “DIY burden” of the device, availability (ease of acquisition), and degree of skill necessary to deploy/operate the device, with 1 being expensive/difficult to build, not publicly available, and requiring deep technical expertise to operate, 10 being low-cost, available for purchase online, plug-and-play operation.
The Raspberry Pi is uniquely easy and cheap to acquire, making it an almost disposable tool. However, while the Raspberry Pi was built for teaching purposes, it is ultimately a device that requires extensive modification and experience to use effectively as a rogue device. The existence of a number of distros for this purpose and tutorials for the Raspberry Pi help to alleviate the challenge, but some expertise is required to create an appropriately attack-ready Raspberry Pi.
The potential damage caused by successful execution of the attack, with 1 being exposure of trivial information from the target, 10 being organization-wide superuser-level compromise or equivalent.
Extreme covertness and ease of modification make the Raspberry Pi a fairly powerful tool, but its abilities are ultimately limited by its lack of processing power. In addition, its lack of onboard wireless makes it ungainly for wireless attacks and the need for a battery pack to run off the grid negates some of its covertness benefits.
Released in 2012, the Raspberry Pi is an ARM single board computer which has became immensely popular with the hacker and maker crowd. Originally intended as an educational tool to get children interested in programming and computer science, the incredible flexibility and extremely low cost of the Raspberry Pi made it an instant hit inside and outside the classroom. It has since gone on to sell over 5 million units, and has found its way into more hacks and projects than its creators could ever have imagined. Unfortunately, not all of these projects are entirely without potential ill effects.
Based on hardware originally intended for the smartphone industry, the Raspberry Pi is about as large as a credit card and requires very little energy; making it exceptionally well suited to covert deployments. While not nearly as powerful as a desktop computer, its ARM processor is fast enough to run standard Linux distributions (including security oriented releases such as Kali and customized Pi security distros), as well as many of the most common Linux security tools. As with many of our rogue devices, this makes it perfect both for offensive security and for potential attacks on organizations’ sensitive data and systems.
- CPU: ARM1176JZF-S @ 700 MHz
- RAM: 512 MB
- OS: Linux, BSD
- I/O: Ethernet, USB, HDMI, Composite Video
- Storage: SD Card (no built-in storage)
In order to reach its extremely low purchase price, there is no built-in storage on the Raspberry Pi; the user-supplied SD card holds both the bootable operating system and whatever files need to be saved in the course of operating the device. Without an SD card inserted, the Raspberry Pi will not function.
While many may see this as a drawback, it has the benefit of allowing the user to maintain separate SD cards for each operating system instance they wish to run. For example, one SD card could be used to boot the Raspberry Pi into a desktop-oriented distribution of Linux such as Ubuntu, and another card could be used to boot Kali for pentesting. The ability to quickly switch operating systems is unique to the Raspberry Pi, and makes it very easy to try out new tools and systems relatively risk-free. It also makes it a useful tool for running different types of attacks with one set of hardware, giving an attacker increased flexibility.
On the networking side, the inclusion of an Ethernet port on such a small device is welcome, however, wireless was completely omitted. Requiring USB adapters to perform wireless tasks is somewhat ungainly, but not unreasonably so. The onboard Ethernet is connected internally as a USB device, which means it must share bandwidth with other USB-connected hardware. This means users may experience a performance hit when trying to simultaneously use Ethernet and a USB device. As such, the Pi is maybe not the best wireless attack hardware, as this can be especially problematic while attempting to perform advanced network manipulation, such as in a rogue access point.
The Raspberry Pi is more powerful than many other embedded devices in this size and price range, a major boon for attackers. In the grand scheme of things, however, it isn’t even on par with a mid-range smartphone. While not as powerful as a smartphone, the Raspberry Pi can run some substantial offensive tools relative to its incredibly low cost. While processor intensive tasks such as decryption or real-time network manipulation may not be a great fit for the Raspberry Pi, it can still hold its own in many useful roles, both offensively and defensively.
The Raspberry Pi with a wireless adapter can be used for nearly any attack that does not require intensive processing. Raspberry Pi security distros often run anything from port scanning (nmap) to packet sniffers and WiFi cracking (aircrack-ng) to Man-in-the-Middle attacks (ettercap), in addition to a large number of other network and wireless offensive tools. As with most easily modified rogue device hardware, the Raspberry Pi’s capacity to “do evil” is heavily dependent upon the tools that the attacker or tester chooses to load and use.
The Raspberry Pi’s small size and modification-ready build lend itself well to disguise, so unlike many rogue devices (which can be conspicuous) the Pi can go completely unseen in most locations. Security researchers have incorporated it into any number of dropbox formulations, even going so far as to actually build it into other devices and items (meaning that the device itself isn’t even externally visible). For a pentester or attacker, the ability to completely hide a rogue device is absolutely invaluable.
Costing only $35 and readily available from many online retailers, the Raspberry Pi is perhaps the most easily accessible rogue device hardware currently on the market. Even with the potential added cost of purchasing a USB WiFi adapter and battery pack to keep it running off the grid, the Raspberry Pi is so cheap it’s essentially disposable. A number of groups have seen the attractive possibilities of using the Raspberry Pi as a penetration testing tool, and accordingly a number of security related distributions are now available for it, such as PwnPi, PwnBerryPi, and Raspberry Pwn. With these distros and some experience, the Raspberry Pi can prove to be a fairly serious attack tool.
That said, the last-generation smartphone hardware the Raspberry Pi is based on does trade performance for cost, and some may be frustrated with its rather sluggish performance. The shared USB bus, compounded by the fact the entire operating system runs off of a relatively slow SD card, can lead to some painful bottlenecks, greatly hindering the Raspberry Pi’s real-world usefulness as a legitimate security tool.
Note: A faster version of the Raspberry Pi is currently being rolled out to replace the existing model, which costs the same but features a much more powerful processor. This new version of the hardware should alleviate the performance issues which hold the original Raspberry Pi back, but until it becomes more common, the original version is much more likely to be seen in the wild.