How to secure a linux device with physical access?

Question

Hi everyone,

I am working on an IoT product, that runs on a small Linux based ARM computer, which will be running in the customers house/network. Just like most IoT products.

I have done everything that I can to secure it against attacks via the network and I am educating myself on what could be done, to protect againsta malicius people with physical access to the hardware.

I am mostly follow these tips:

https://wiki.archlinux.org/index.php/Security#Physical_security

Do you suggest anything else?

Thanks,

Franklin

wangyeee · Accepted Answer

Generally it's very difficult to secure a device which the attacker has physical access. Even full disk encryption can't resist cold boot attack. Considering RAM on most ARM based computers are soldered on the board, it's very difficult but not impossible for an attacker to remove and examine the RAM without desolder it with heat.

Besides PCIE ports mentioned in the wiki, debug ports like JTAG also give attacker chances to breach into your system, so disable them as well.

There are some techniques which prevent attacker from tampering with your device, such as adding a backup battery and some switches which detect if someone is trying to open the case of your device, and then erase all sensitive data on your device. For example, there is a photodiode in some POS machines. And if someone opens it and inspected in under normal daylight, data like encryption keys will be erased before anyone could notice.

And last, human weaknesses are most vulnerable to attacks. Do emphasise security in your product manual!

-Ye

clem57 · Answer

Yes, you need secure boot to disallow other programs taking over. Clem