CVE-2021-38545 in Pi 3 B+ (Glowworm)
Summary
by MITRE • 08/12/2021
Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the Raspberry Pi supplies power to some speakers. The power indicator LED of the Raspberry Pi is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects the Raspberry Pi's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the Raspberry Pi, we can recover the sound played by the speakers.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/16/2021
This vulnerability represents a sophisticated side-channel attack targeting Raspberry Pi devices through electromagnetic interference and optical signal analysis. The flaw exploits the direct electrical connection between the power indicator LED and the device's power line, creating a correlation between audio output power consumption and LED brightness that can be exploited by adversaries. The vulnerability specifically affects Raspberry Pi 3 B+ and 4 B models through August 9, 2021, and demonstrates how physical security considerations extend beyond traditional network-based threats. This attack vector aligns with CWE-310, which addresses cryptographic weakness, and represents a form of electromagnetic side-channel analysis that falls under the ATT&CK framework's technique T1059.001 for command and control communications through system services.
The technical implementation of this attack leverages the fundamental electrical properties of the Raspberry Pi's power delivery system where the power indicator LED serves as an unintended information leak channel. When audio equipment draws power from the Raspberry Pi, variations in power consumption directly translate to fluctuations in LED brightness that mirror the audio signal being played. Attackers can utilize a telescope coupled with an electro-optical sensor to capture these subtle light variations from a distance, effectively reconstructing speech signals from the visual data. The attack requires specific environmental conditions and proximity, but demonstrates the vulnerability of embedded systems to physical side-channel attacks that exploit the inherent electrical characteristics of device components rather than software flaws.
The operational impact of this vulnerability extends beyond simple privacy concerns to potentially enable sophisticated surveillance operations where adversaries can remotely eavesdrop on conversations in proximity to affected devices. The attack's effectiveness is particularly concerning in environments where Raspberry Pi devices are used for audio applications such as home automation systems, security monitoring equipment, or IoT deployments. Organizations deploying these devices in sensitive locations face potential exposure to unauthorized information recovery, with the attack requiring minimal specialized equipment beyond standard optical and signal analysis tools. The vulnerability demonstrates how seemingly innocuous physical components can create security risks when not properly considered in threat modeling.
Mitigation strategies for this vulnerability require both hardware and operational security measures to prevent exploitation. Physical shielding of the power indicator LED through the use of optical filters or enclosures can prevent unauthorized light capture, while proper device placement away from sensitive areas reduces attack surface. Network segmentation and monitoring of power consumption patterns can help detect anomalous behavior that might indicate active exploitation attempts. Security awareness training for personnel deploying Raspberry Pi devices should emphasize the importance of considering physical security implications alongside traditional cybersecurity measures. Additionally, organizations should consider implementing regular security assessments that evaluate the potential for side-channel attacks on embedded systems and IoT devices, as this vulnerability represents a broader class of attacks that exploit the physical characteristics of computing hardware rather than software vulnerabilities.