How hard is code copying?

security

#1

Hi guys,

We are deploying quite a few resin devices (regular RPi3) in the field. Say one of those devices is stolen (and we don’t immediately notice, or only after a few days):

How hard would it be for a malicious person to mount the SD card and copy our python code?

Is the code ‘right there’ in the file system or would the malicious person first have to mount docker images etc?

Thanks!


#4

I guess it would be as hard as doing forensics on a docker container, simply mounting it and looking inside.


#5

So I’ve never tried myself, but I’d imagine that it’s basically 0 effort for anyone who has a vague idea what they’re doing.

Best thing to do is just assume from day 1 that anything you write and deploy to a Pi is immediately compromised, and design your solution accordingly.


#6

Haha, OK, understood.

Thanks!