AutoPi Cloud and Device security
AutoPi is constantly evolving and improving security, to ensure safe usage of the AutoPi devices. For this we conduct penetration testing and security audits together with external companies and institutions.
From the AutoPi Cloud you can access your device remotely. This also means that if unauthorized users have access to your user account, this could be a possible security risk. Brute forcing into the AutoPi Cloud is virtually impossible due to the use of PBKDF2 for password hashing. Additionally there is rate limiting on all attempts, so connection attempts are refused after a certain number of attempts. All our servers are secured with HTTPS protocol, to encrypt data so that logins and data cannot be intercepted and also removes the threat of man-in-the-middle attacks.
The biggest threat to get access to the AutoPi Cloud is through Social Engineering. The method is characteristic of a physical person attempting to gain access to your password, using either phone or e-mail to impersonate an employee from AutoPi. This is also why we will never ask for your password at any time. We have a number of strictly defined workflows with restrictions on what information can be shared with a customer, or a person impersonating a customer, to prevent any social engineering attacks from succeeding. We also recommend that you always keep your password safe with you and never share it. We recommend that you use a strong password, that is unique for the AutoPi Platform and is changed on a regular basis.
Communication from the AutoPi Cloud to the AutoPi device is performed using ZeroMQ built into the SaltStack platform. Information is pushed from the AutoPi Cloud to the devices, where the AutoPi Cloud initiates all communication to the devices in order to ensure a secure one-way connection from the AutoPi Cloud to the device. Authentication of the devices is performed using device ID and RSA keys. When initially authenticated, all subsequent traffic sent is encrypted using Advanced Encryption Standard (AES). This specific setup prevents any kind of spoofing attacks.
The AutoPi platform is designed to be open and used by the users to build custom solutions. This is why the AutoPi is open and accessible by SSH using the WiFi hotspot, built into the device. Even if the platform is designed for openness in mind, we still value device security highly. This is why the device is preconfigured with firewall rules and security built in. Together with KTH Royal Institute of Technology, Stockholm Sweden, we recently had a security audit on our device and this revealed a CVE (CVE-2019-12941) in the device WiFi hotspot. Essentially access could be gained to the device by brute forcing the WiFi hotspot password, in some way similar to what previous was done on WiFi/network devices with a default password supplied from the factory.
The AutoPi is shipped with a unique default password from the factory, to allow users to gain access to their device by part of our openness/ease-of-use approach.
This is also why we always recommend that you change your default WiFi hotspot password and why you are presented with a reminder every time you log into the AutoPi Cloud.
Always keep your AutoPi Cloud password secret.
Change the default WiFi password.
Make sure all passwords are strong (https://en.wikipedia.org/wiki/Password_strength).
Never share your passwords.
Change the passwords regularly.
If you have specific questions about AutoPi security, make sure to reach out to us on firstname.lastname@example.org.
Other blog posts for further reading
Speak to your car with Google Assistant - almost like K.I.T.T. from Knight Rider
Wouldn’t it be cool if you could speak to your car and give it commands? We remember our childhood in the last millennium where Michael Knight (David Hasselhoff) and his intelligent Pontiac Trans Am named K.I.T.T. solved crime together. While we may not be able to have a meaningful conversation with our car just yet, it’s now a possibility to talk to your car and give it commands to execute. We are here giving a short introduction to how this can be accomplished using the AutoPi.io system and Google Assistant.
Switching from Raspberry Compute to Raspberry Zero
During the design phase of the AutoPi, it was decided to use the Raspberry Compute Module. The Raspberry Compute Module is small, versatile and expandable in a lot of ways, which suited the AutoPi project perfect. All the pinouts from the Broadcom BCM2835 processor is available through the SODIMM DDR2 interface on the Compute Module. This gave us a lot of possibilities during the design phase of the AutoPi and therefore the Compute module was an obvious choice for us as a main processor.
Build your own Black Ice Detection system for your car using AutoPi
The term “Black ice” refer to a winter phenomenon, where a layer of ice on the road is so thin it becomes transparent and thus appears “black” from the road below. This is a very common situation during winter times and can create hazardous situations for vehicles and pedestrians. The phenomenon often occurs when the temperature is right around freezing point and when a light rain hits a road surface which is below freezing point.