6

I'm currently spitballing ideas for an Internet of Things device. It will be running Linux on a widely available development board, I'm not too concerned about physical security or the end user doing something bad to it however I'd like to secure it from botnets such as the mirai botnet.

For things such as the root user account, how should I secure it: should I use key based authentication or just a regular password? I want to be able to give end users access to the root user account upon request or provide it out of the box.

I don't want to have any extra user accounts or store any authentication details on my servers in case of a breach.

Improve this question

2 Answers 2

Reset to default
3

Great question! Several things you should keep in mind.

1. Default passwords

This is really basic, and you've probably already thought of it, but let me reiterate: default or easy passwords are deadly. When I asked this question, I learned that the way the Mirai worm works is simply to attack via default usernames and passwords. Whatever you do, do not set up a default password on your IoT device.

2. Security risks with passwordless ssh (or other key based setups)

Basically, the only risk from setting up key based is if someone gets hold of your private key. Otherwise, passwordless ssh is actually more secure than typing in a password. From my perspective, there are several reasons for that:

  1. Passwords are easy to brute-force (botnets, like you suggested)
  2. Generally, key strokes aren't sent with extremely secure encryption, if any.
  3. Passwordless ssh is usually encrypted with either DSA or RSA, however you set it up. (Check this post on security.SE for details)

3. Security risks with password entry.

As I have mentioned above, passwords are relatively easy to brute force, as well as the unlikely though possible risk of password interception on route.

Do note, that if you do use passwordless ssh, you should definitely secure it with a passphrase.

Improve this answer
2
  • 1
    With SSH, the keystrokes should be sent encrypted, so logging in with a password probably should be safe from snooping. Telnet might be what you're thinking of though—it did send everything, including passwords, in clear text. Still, as you say, there's no excuse not to use key-based authentication if you're developing something on a large scale.
    – Aurora0001
    Apr 10, 2017 at 15:26
  • @Aurora0001, hmm, you have a point. And I suspect you're right about Telnet.
    – anonymous2 ♦
    Apr 10, 2017 at 15:28
3

Assuming you need to handle firmware updates (otherwise, you're insecure by default) then you will also need to sign the updates (and manage updates in a secure way). Otherwise, an attacker can simply present your device with a compromised update package. Clearly, if you do this, you make it impossible for the user to apply firmware updates in the same way, but you don't necessarily need to lock them out entirely (since they have physical access).

In addition, you'll need to provide a secure way of provisioning each device with a unique ssh key visible to the end user (but they could be contained on the device if you're accepting physical access means ownership).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.