1. Technology Envioronment
Scope of Assessment
Technology Envioronment
Perform a Nessus “Basic Network Scan” on Raspberry Pi running a Volumio Linux distro
Summarize High and Medium Risk Findings and Recommendations
Perform a re-scan after remediation activities
Application Volumio Music Player
Operating System Debian Linux
Hardware Raspberry Pi 2 Model B
Jason Lindsley - MIS Scanning Exercise

2. Results and Recommendations1
All High and Medium risk vulnerabilities were related to the Samba daemon, which allows file and print sharing between computers running Microsoft Windows and Unix-like systems (e.g. Linux, AIX, Solaris, etc.).
Volumio uses Samba to enable users to mount shared network storage to the device to play audio files from remote devices
Users do not require the functionality associated with mount network storage in this environment. Therefore, Samba is not an essential service and can be removed. 2 29
Vulnerability
Risk
CVE Reference
Risk Rating
Recommendation
SMB Shares Unprivileged Access
Network storage shares can be accessed using a NULL session and may allow attacker to read/write data.
CVE , CVE
High
Remove the entire Samba package, including configuration files, with the following command:
sudo apt-get purge Samba
It is recommended to make a backup copy of the micro SD card prior to disabling the Samba service in the event that the change disrupts operations completely.
SMB Guest Account Local User Access
The remote host is running one of the SAMBA daemons and is configured to allow access via a guest user using a random account. This could allow unauthorized access without traceability to an individual.
CVE
Medium
SMB Signing Disabled
Signing is not required on the remote server using Samba. An unauthenticated, remote attacker can exploit this service to conduct man-in-the-middle attacks against the server.
Not Available
Jason Lindsley - MIS Scanning Exercise

3. Remediation and Re-scan Results
Samba service was removed using the “sudo apt-get purge Samba”
A re-scan provided evidence that the one High and two Medium rated vulnerabilities were remediated:
Functionality of the Volumio software was tested and determined to be fully functional
Note: Although it was not part of the scope of this assessment default privileged accounts were identified (i.e. ‘root’ and ‘volumio’). The passwords for the accounts were changed to complex passwords.
All High and Medium risk findings were addressed
Jason Lindsley - MIS Scanning Exercise