Business Offers Raspberry PI Money to Preload Malware

The Raspberry Pi Foundation revealed on Twitter that on Dec. 23, it had been offered — seemingly seriously — money to include a malware .exe file as part of the system it provides users. The offer was from an obviously non-English speaker named Linda, whose suspicious request was riddled with poor grammar.

About Raspberry Pi

Raspberry Pi was developed as a simple computer that offers multiple basic functions. It can be used as part of more complex projects because of its ability to be programmed. The device currently retails for under $35 and has already seen significant adoption, having sold over 4 million units worldwide.

The nefarious email — which was addressed to Liz Upton, the foundation’s director of communications — said that the .exe file would create a desktop shortcut that allowed users to automatically log in to a website once they clicked on it. Additionally, Upton was asked to provide a “favorable and kind quotation about PPI (price per install).”

Who Wants a Piece of the Pi?

What is really surprising about all this to Pi users is that the Pi usually runs the Linux OS, notably the ARM GNU/Linux distributions and the Snappy Ubuntu Core. The newest and most powerful version of the device is capable of using Windows 10, but Linux is the primary system, SecurityWeek reported.

The .exe designation for the malware file suggested means that it requires Windows to be run. Such a file wouldn’t execute under Linux, so why Linda would even consider Raspberry Pi as a way to effectively distribute the file is puzzling and seems rather unsophisticated.

The solicitor may have been thinking that the more powerful Pi devices would end up being used in the future with Windows, hence why the file’s shortcut would be included as well.

Foiling the Malware Plan

The Raspberry Pi Foundation did not reveal the name of the organization that approached them but did call them “evildoers.” SecurityWeek noted that some of the people commenting on the foundation’s tweet suggested that the website the email was referring to might be jogotempo.com. One user said the style of the email was very similar to other attempts received from the site in the past.

In any case, users can rest assured the foundation will not be accepting the money nor distributing the file.

Larry Loeb

Principal, PBC Enterprises

Change Healthcare attack expected to exceed $1 billion in costs

3 min read - The impact of the recent Change Healthcare cyberattack is unprecedented — and so are the costs. Rick Pollack, President and CEO of the American Hospital Association, stated, “The Change Healthcare cyberattack is the most significant and consequential incident of its kind against the U.S. healthcare system in history.”In a recent earnings call, UnitedHealth Group, the parent company of Change Healthcare, speculated on the overall data breach costs. When all is said and done, the total tally may reach $1 billion…

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

4 min read - On February 19, ConnectWise reported two vulnerabilities in its ScreenConnect product, CVE-2024-1708 and 1709. The first is an authentication bypass vulnerability, and the second is a path traversal vulnerability. Both made it possible for attackers to bypass authentication processes and execute remote code.While ConnectWise initially reported that the vulnerabilities had proof-of-concept but hadn’t been spotted in the wild, reports from customers quickly made it clear that hackers were actively exploring both flaws. As a result, the company created patches for…

Evolving red teaming for AI environments

2 min read - As AI becomes more ingrained in businesses and daily life, the importance of security grows more paramount. In fact, according to the IBM Institute for Business Value, 96% of executives say adopting generative AI (GenAI) makes a security breach likely in their organization in the next three years. Whether it’s a model performing unintended actions, generating misleading or harmful responses or revealing sensitive information, in the AI era security can no longer be an afterthought to innovation.AI red teaming is emerging…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

About Raspberry Pi

Who Wants a Piece of the Pi?

Foiling the Malware Plan

More from

Change Healthcare attack expected to exceed $1 billion in costs

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

Evolving red teaming for AI environments

Topic updates