0

My question is how secure can I make an Arduino? The project I am working on would put the Arduino out in the public (school campus inside a trash can to sense how much trash is in it) and I want to make sure random people can't access it and mess/change the code. Any suggestions would be helpful.

It will also be connected to the network and be sending data to a database.

  • Define "secure". Put in it a safe and it's "secure". – Majenko Mar 6 '19 at 18:19
  • I'm voting to close this question as off-topic because it is about physical security, not Arduino. – Majenko Mar 6 '19 at 18:25
  • 2
    I think the OP was asking about software security. That seems like a valid topic. – Duncan C Mar 6 '19 at 18:26
  • Software-wise, and Arduino is completely insecure. There is no login, there are no passwords, nothing. You just need a computer and access to the USB port. You will need to use physical security to protect it. – Duncan C Mar 6 '19 at 18:27
  • 1
    No. If somebody has access to the USB port, there is no security. – Duncan C Mar 6 '19 at 19:05
1

If I understand your question, then you want ensure, that nobody is able read and change your code to see, what are you doing and to send you fake data from that Arduino.

What are problems here:

  • It can be stolen (eventually with the entire trash bin) - means no fake data and no data
  • It can be vandalised/destroyed in matter of minutes (max) - again no (real/fake) data
  • The arduino can be reprogrammed by normal way (via bootloader) and send fake data - you can prevent that by changing the bootloader
  • Arduino can be read and reprogrammed by ISP and send fake data - you can lock it (by setting SPIEN) to prevent both reading its memory and to reprogramming it this way
  • the lock can be cleaned and chip erased and reprogrammed (but not read) by Chip Erase command from High Voltage programming. You can make it more difficult, if needed pins are attached to some devices or ground/power.
  • the chip can be desoldered, reprogrammed and soldered back to avoid problems with connected devices.
  • also the whole Arduino can be swapped with already tampered Arduino
  • another Arduino can be atached to the net to inject fake data (and maybe prevent the original from normal transfers by interference) (so it have problems with physical security)

To mess with your data (send fake) such program need to be able send data in (somehow) correct format over the net. Without source code or at least the code in Arduino the format of the data could still be sniffed from transmissions and deciphered (but it is difficult task to do) and you can employ some crytography to make it even harder (but it would eat a lot of memory and computing power from your code).


Well, in practical life your problem is stolen/vandalised arduino and simple attacks, which can be blocked by locking the Arduino fuses and bootloader (but you would have hard time put update there after locking it) and using some cryptography.

  • thank you for the response it was very helpful – Dax Yeen Mar 13 '19 at 17:06
0

Software security features are not available in Arduino. However if you want to prevent people from flashing a new code to some extent, you can desolder the USB pins or use a version of Arduino like ProMini, that requires external USB connector for coding.

  • yes, just to some extent. – gilhad Mar 7 '19 at 2:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.