[kevin_b_er]

It would be nice to know what this specific "Raspberry Pi" vulnerability is, considering the software stack is almost entirely Debian.

[syn0byte]

There is no RPi vulnerability(in this article). The RPi was just used as a bastion into the internal network. It could have been any SBC. Once your already inside the internal network things get stupid lax.

EG. I can't see your Windows shared folders from the internet, but the PC in the next room can. Someone sneaked an RPi into JPL to be that PC in the next room.

See Also; Season 1 Mr Robot had this exact scenario as a plot point.

[jvanderbot]

No, they infiltrated a Rpi already on the network (e.g. a research SBC) which itself was also able to access other machines.

[giancarlostoro]

I was thinking Mr. Robot the whole time.

[jeroenhd]

> The comprehensive federal review of JPL’s systems stemmed from an April 2018 incident when someone at JPL attached the Raspberry Pi to the network there for an unknown purpose

Basically, someone plugged in a computer to the corporate network that happened to be a Raspberry Pi. Might as well have been a Beaglebone, a Banana Pi or an Intel NUC for that matter.

[jvanderbot]

JPL builds robots and robots are made from SBCs.

[chaboud]

If JPL is using a Pi off of Earth, they're doing it wrong. Stability in space requires a little more care (it's hot, cold, particle-y, etc).

[jvanderbot]

As TRL progresses, the hardware changes. Nobody buys RAD750 for each of their new ideas.

[BubRoss]

No one said anything even remotely close to that.

[inamberclad]

Probably just ssh enabled with the default credentials. IIRC, raspberry pis have their own MAC address prefix, so it's pretty obvious when you find one.

[fortran77]

My guess is this pi was connecting _out_, tunneling the network over ssh.

Or one of these things: https://blog.haschek.at/2018/the-curious-case-of-the-RasPi-i...

[blacksmith_tb]

Not impossible to imagine the credentials were the unchanged default pi/raspberry... (I imagine quite a few people who haven't done much w/ a Pi don't even run raspi-config) I assume you can scan for similar exposed RPis with Shodan etc.