The ultra-cheap Raspberry Pi computers have a security flaw which results in the devices generating a weak and predictable SSH key, new research suggests. The researchers say the computer’s operating system, Raspbian, should be patched to avoid the flaw.
"As soon as the systems start up systemd-random-seed tries to seed /dev/urandom, but /var/lib/systemd/random-seed is missing, because it hasn’t been created yet", explains the developer oittaa.
"/etc/rc2.d/S01regenerate_ssh_host_keys is executed, but /dev/urandom pool doesn’t have that much entropy at this point and predictable SSH host keys will be created", he continues.
According to the report, there are two ways developers can create random numbers, through /dev/random and /dev/urandom functions.
The /dev/random one is better, as it requires user-generated input such as mouse movements, keyboard input or various hardware-generated activities to create numbers. However, the function will freeze the system until it has enough data to generate strong random numbers, which is why developers opt for /dev/urandom instead.
This function generates random numbers based on a PRNG (Pseudo-Random Numbers Generator) algorithm, regardless of the user entropy data it has at its disposal.
In Raspbian’s case, because of an incorrect boot sequence, there is not enough data, not even in the /dev/urandom function, and if the OS is set to generate SSH host keys right at startup, it will put together predictable values that are far less secure than what it would generally be needed for SSH data.
The Raspbian and Raspberry Pi projects have worked together to put out a fix.
Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.