golfinguy
Posts: 19
Joined: Wed Aug 21, 2013 3:07 pm

Securing the SD card

Wed Aug 21, 2013 3:23 pm

There are a few cases I've found that can secure the SD card, but I was hoping for a less expensive option. Are there others out there that I have not found yet? May have to look into developing our own case, but that may derail the project once upper management realizes what we're doing (they think its just a black box we're purchasing - a DIY realization may change their view ;)

The concern we are looking to protect against is someone swapping the SD card with their own build and being on our network with any tools they have on there. Obviously you can crack the case and do it anyway, but hell - you can do that with a PC too. Just taking away the obvious would be good enough.


SD Card secured - France - best option thus far it seems. Would like to stay away from currency exchanges and such though.

Complete security from the environment - over-kill for our purposes

Industrial case - another one that is over-kill for us


Anyway - looking for other options before I go to a fabricator and see what we can do ourselves.

elatllat
Posts: 1337
Joined: Sat Dec 17, 2011 5:05 pm

Re: Securing the SD card

Wed Aug 21, 2013 7:23 pm

This would help prevent people from stealing sdcards but not much more (Ethernet cable is still exposed).
You could lock the whole thing in a monitor/desk like Chapters does... but people still take the keys off the keyboard. so I would opt for glass touch screen and no keyboard/mouse.
SBC with 32GB RAM: https://hardkernel.com

FAQ : https://raspberrypi.stackexchange.com

Unanswered: https://www.raspberrypi.org/forums/search.php?search_id=unanswered

User avatar
tonyhughes
Posts: 951
Joined: Wed Dec 26, 2012 3:46 am

Re: Securing the SD card

Wed Aug 21, 2013 7:49 pm

MicroSD card adapter, then close over the slot on any standard case?

https://www.modmypi.com/sd-cards-and-ad ... rd-adaptor

golfinguy
Posts: 19
Joined: Wed Aug 21, 2013 3:07 pm

Re: Securing the SD card

Thu Aug 22, 2013 3:52 pm

elatllat wrote:This would help prevent people from stealing sdcards but not much more (Ethernet cable is still exposed).
You could lock the whole thing in a monitor/desk like Chapters does... but people still take the keys off the keyboard. so I would opt for glass touch screen and no keyboard/mouse.
I didn't really explain the use case, but suffice it to say its much different than you have assumed.

Its not a public access device, not even a device that has a keyboard our mouse attached (audio/video outputs only). All other precautions have been taken (OS hardening, etc.), but if someone swaps the SD with their own build all bets are off. That is our concern.

golfinguy
Posts: 19
Joined: Wed Aug 21, 2013 3:07 pm

Re: Securing the SD card

Thu Aug 22, 2013 3:53 pm

tonyhughes wrote:MicroSD card adapter, then close over the slot on any standard case?

https://www.modmypi.com/sd-cards-and-ad ... rd-adaptor
Interesting option. Not obviously better than the expensive case, but an option nonetheless.

dan3008
Posts: 1172
Joined: Wed Aug 15, 2012 1:05 pm

Re: Securing the SD card

Thu Aug 22, 2013 5:06 pm

dan3008 wrote:Pays your money, takes your choice

elatllat
Posts: 1337
Joined: Sat Dec 17, 2011 5:05 pm

Re: Securing the SD card

Thu Aug 22, 2013 5:46 pm

golfinguy wrote:
elatllat wrote:This would help prevent people from stealing sdcards but not much more (Ethernet cable is still exposed).
You could lock the whole thing in a monitor/desk like Chapters does... but people still take the keys off the keyboard. so I would opt for glass touch screen and no keyboard/mouse.
I didn't really explain the use case, but suffice it to say its much different than you have assumed.

Its not a public access device, not even a device that has a keyboard our mouse attached (audio/video outputs only). All other precautions have been taken (OS hardening, etc.), but if someone swaps the SD with their own build all bets are off. That is our concern.
If you worried about people getting what's on the sdcard vs what's on the hdmi/ethernet, then just encrypt it.
Otherwise;
What exactly could be done by swapping the sdcard that could not be done by swapping the hdmi/ethernet?
How could the hdmi/ethernet physically be secured but the sdcard not?
SBC with 32GB RAM: https://hardkernel.com

FAQ : https://raspberrypi.stackexchange.com

Unanswered: https://www.raspberrypi.org/forums/search.php?search_id=unanswered

kyled2012
Posts: 17
Joined: Wed Feb 06, 2013 11:43 am

Re: Securing the SD card

Fri Aug 23, 2013 11:00 am

elatllat wrote:
golfinguy wrote:
elatllat wrote:This would help prevent people from stealing sdcards but not much more (Ethernet cable is still exposed).
You could lock the whole thing in a monitor/desk like Chapters does... but people still take the keys off the keyboard. so I would opt for glass touch screen and no keyboard/mouse.
I didn't really explain the use case, but suffice it to say its much different than you have assumed.

Its not a public access device, not even a device that has a keyboard our mouse attached (audio/video outputs only). All other precautions have been taken (OS hardening, etc.), but if someone swaps the SD with their own build all bets are off. That is our concern.
If you worried about people getting what's on the sdcard vs what's on the hdmi/ethernet, then just encrypt it.
Otherwise;
What exactly could be done by swapping the sdcard that could not be done by swapping the hdmi/ethernet?
How could the hdmi/ethernet physically be secured but the sdcard not?

The OP wants to secure the SD card, not the HDMI or ethernet, the OP has even clarified that again in a further response to your first comment, which you may have again misread.
if someone swaps the SD with their own build all bets are off. That is our concern
Swapping the SD card would allow alternate software, possibly malicious, to run, which would be a security risk. Swapping the HDMI or ethernet will not enable this risk.

golfinguy, I'd say your cheapest option would be to use the MicroSD Adapter, and glue the slot shut, like someone else mentioned above.

OP

ame
Posts: 3172
Joined: Sat Aug 18, 2012 1:21 am
Location: New Zealand

Re: Securing the SD card

Fri Aug 23, 2013 1:12 pm

Have you looked at Cyntech's offerings?

Here's their SD card cover, which is clamped into place when the case is closed:
http://shop.cyntech.co.uk/collections/a ... card-cover

golfinguy
Posts: 19
Joined: Wed Aug 21, 2013 3:07 pm

Re: Securing the SD card

Fri Aug 23, 2013 1:24 pm

Thanks for the responses.

I missed earlier that one of the options I listed covers the audio/video ports (which I need for music on hold and digital signage) as well - oooops ;)

Anyway, looks like the Cyntech SD card cover is the easiest. The MicroSD adapter and gluing the slot an option as well.

dan3008
Posts: 1172
Joined: Wed Aug 15, 2012 1:05 pm

Re: Securing the SD card

Fri Aug 23, 2013 5:09 pm

the Cyntech SD card cover IS the easiest, with the cyntech case. and its reversable, so you can always repourpose the pi at a later date, using a normal SD card

However, the microSD adaptor and glue is cheaper. But obviously, you are resigned to only ever using microSD cards again.
dan3008 wrote:Pays your money, takes your choice

User avatar
jojopi
Posts: 3230
Joined: Tue Oct 11, 2011 8:38 pm

Re: Securing the SD card

Sat Aug 24, 2013 10:08 am

kyled2012 wrote:Swapping the SD card would allow alternate software, possibly malicious, to run, which would be a security risk. Swapping the HDMI or ethernet will not enable this risk.
An attacker who has prepared a malicious image almost certainly has a Pi that they tested it on. They can just swap the Ethernet into their Pi running their image.

You can lock the switch port to the original Pi's MAC address, of course. But if the attacker can power both Pies at the same time it is trivial to sniff the MAC and then spoof it.

kyled2012
Posts: 17
Joined: Wed Feb 06, 2013 11:43 am

Re: Securing the SD card

Sun Aug 25, 2013 4:08 am

jojopi wrote:
kyled2012 wrote:Swapping the SD card would allow alternate software, possibly malicious, to run, which would be a security risk. Swapping the HDMI or ethernet will not enable this risk.
An attacker who has prepared a malicious image almost certainly has a Pi that they tested it on. They can just swap the Ethernet into their Pi running their image.

You can lock the switch port to the original Pi's MAC address, of course. But if the attacker can power both Pies at the same time it is trivial to sniff the MAC and then spoof it.

You are correct, I completely overlooked swapping Pi's/MAC spoofing, my bad! :oops:

Dilligaf
Posts: 283
Joined: Wed May 23, 2012 6:48 pm

Re: Securing the SD card

Sun Aug 25, 2013 6:04 am

golfinguy wrote:
tonyhughes wrote:MicroSD card adapter, then close over the slot on any standard case?

https://www.modmypi.com/sd-cards-and-ad ... rd-adaptor
Interesting option. Not obviously better than the expensive case, but an option nonetheless.
You don't need the adapter, most regular sd cards are only half full, the memory chip is at the connector end. You can simply cut the card in half making it half length then seal the opening in the case.

dan3008
Posts: 1172
Joined: Wed Aug 15, 2012 1:05 pm

Re: Securing the SD card

Sun Aug 25, 2013 9:04 am

kyled2012 wrote: You are correct, I completely overlooked swapping Pi's/MAC spoofing, my bad! :oops:
so you need to secure the network cable too
Dilligaf wrote:You don't need the adapter, most regular sd cards are only half full, the memory chip is at the connector end. You can simply cut the card in half making it half length then seal the opening in the case.
like: http://www.raspberrypi.org/phpBB3/viewt ... 40&t=31609

I did this, but my card was too big, and i accidentally killed a card... You have to be really careful, but when it works, its really worth while. It can be difficult to reflash the SD card once cut too. I'm making an adaptor for them soon using my broken card lol
dan3008 wrote:Pays your money, takes your choice

ame
Posts: 3172
Joined: Sat Aug 18, 2012 1:21 am
Location: New Zealand

Re: Securing the SD card

Sun Aug 25, 2013 10:12 am

How about this guy, with a MicroSD card?

http://dx.com/p/doseen-disk-nifty-minid ... een-237283

It's 23 mm long, which is 9 mm shorter than a full SD Card. Might make it short enough to 'hide' in some cases. It would stick out by 5 mm in the Multicomp case, and 1 mm in the Cyntech case.

I still think the Cyntech SD card cover is a good solution. No cutting, drilling or gluing required. Remember, it's only to prevent casual tinkering or pilfering. For anything else- once you have access to the hardware it's Game Over.

elatllat
Posts: 1337
Joined: Sat Dec 17, 2011 5:05 pm

Re: Securing the SD card

Sun Aug 25, 2013 5:05 pm

kyled2012 wrote:...I completely overlooked swapping Pi's...
...so like I said in the first answer, you need to put the whole thing in something like a locked desk if you want to accomplish any security improvement.
SBC with 32GB RAM: https://hardkernel.com

FAQ : https://raspberrypi.stackexchange.com

Unanswered: https://www.raspberrypi.org/forums/search.php?search_id=unanswered

Dilligaf
Posts: 283
Joined: Wed May 23, 2012 6:48 pm

Re: Securing the SD card

Sun Aug 25, 2013 5:16 pm

These work too, you can cut off the usb tail http://dx.com/p/2-in-1-tf-card-to-sd-ca ... ite-126299

golfinguy
Posts: 19
Joined: Wed Aug 21, 2013 3:07 pm

Re: Securing the SD card

Mon Aug 26, 2013 1:34 am

elatllat wrote:
kyled2012 wrote:...I completely overlooked swapping Pi's...
...so like I said in the first answer, you need to put the whole thing in something like a locked desk if you want to accomplish any security improvement.
Forgive me for not posting ALL of the details of my project - we are working on implementing a digital cert. (or something similar) for network access control. No matching cert. - port gets shutdown, alarms go off, etc.. We do it with our PCs today.

The SD card cover was to put 'managements' minds at ease. We all know you can crack the case open if you really want to. Steal the SD card too - so next would be encrypting it.

Or just go with the glue option and glue the damn thing in there permanently. Makes the entire unit the field replaceable rather than just a new card though.

a9971256
Posts: 43
Joined: Fri Jun 07, 2013 11:02 pm

Re: Securing the SD card

Tue Sep 10, 2013 1:08 am

Another use for duct tape!!! :P

Return to “Other projects”