We’ve been waiting for this one. A worm was written for the Internet-connected Arduino Yun that gets in through a memory corruption exploit in the ATmega32u4 that’s used as the serial bridge. The paper (as PDF) is a bit technical, but if you’re interested, it’s a great read.

The crux of the hack is getting the AVR to run out of RAM, which more than a few of us have done accidentally from time to time. Here, the hackers write more and more data into memory until they end up writing into the heap, where data that’s used to control the program lives. Writing a worm for the AVR isn’t as easy as it was in the 1990’s on PCs, because a lot of the code that you’d like to run is in flash, and thus immutable.

In the end, the worm is persistent, can spread from Yun to Yun, and can do most everything that you’d love/hate a worm to do. In security, we all know that a chain is only as strong as its weakest link, and here the attack isn’t against the OpenWRT Linux system running on the big chip, but rather against the small AVR chip playing a support role. Because the AVR is completely trusted by the Linux system, once you’ve got that, you’ve won.

ArduWorm: A Functional Malware Targeting Arduino Devices
http://www.seg.inf.uc3m.es/papers/2016JNIC.pdf

The basic idea is to have an Arduino Yun ping the local IP addresses of my phone to see if I’m home. With this, I can establish a set of events or settings based on my presence. Step one is having a door that can unlock itself based on certain criteria. (i.e. I’m home, I email it, it’s a certain time of day, RFID, etc.)

There are many different ways to keep your plants watered on a schedule. [Luca Dentella] just created a new one by building the irrighino watering system. He used standard off the shelf, hardware to keep it simple. Irrighino is a complete watering system based on the Arduino Yun, featuring a user friendly AJAX interface. This allows scheduling in a manner similar to creating appointments in Outlook. It’s also possible to manually control the various water solenoids. The code is fully customizable and open source, with code available from [Luca’s] github repository. The web interface is divided in to three tabs – “runtime” for manual control, “setup” to configure the scheduling, and “events” to view system logs.

irrighino
http://www.lucadentella.it/en/2015/08/04/irrighino/

Irrighino is a complete watering system, based on Arduino Yun.

The main features are:

a configurable number of solenoid valves
an AJAX web interface
a weekly schedule
manual activation / deactivation

https://github.com/lucadentella/irrighino

According to [Squonk42], nope. And we think he’s probably right.

The Yun is an Arduino Leonardo with an Atheros AR9331 WiFi SoC built in. It’s a great idea, pairing the Arduino with a tiny WiFi router that’s capable of running OpenWRT. But how is this no longer Open Source Hardware? Try getting an editable board layout. You can’t.

[Squonk42]’s hypothesis is that Arduino must have done what any “sane” engineer would do in this case when presented with a super-complex piece of hardware and a potentially tricky radio layout: just use the reference design (Atheros AP-121). That’s what everyone else in the industry did. And that’s smart, only the rest of the consumer electronics industry isn’t claiming to be Open Source Hardware while the reference design is protected by an NDA.

So it looks like Arduino’s hands are tied.

Is this a change of strategy for the Arduino folks or did they just make a mistake?

COMMENT:

maybe it is time for Open hardware class
tier 1: All opensource including IC
teir 2: Opensource exclude IC
teir 3: exclude any kind of module, NDA layout
teir 4:exclude any binary driver, NDA code

I think the Yún is the project of the Martino-led Arduino company now being sued by the Banzi-headed Arduino company. The latter one pushes for the open source idea while the former does not.
http://www.heise.de/make/meldung/Arduino-gegen-Arduino-Gruender-streiten-um-die-Firma-2549653.html

Actually Banzi has griped about Arduino clones that don’t pay money to him.
Yet many $3 clones are custom designs that use cheaper serial chips than the ch340 and sometimes have a beefier 3.3v regulator than the $30 uno.

The Arduino Yún was the first of a new breed of Arduinos that added a big honkin’ Linux System on Chip to the familiar ATMega microcontroller and unique pin headers. It’s a surprisingly powerful system, but also very simple: basically, it’s just an Atheros AR9331 running Linux, an ATMega32u4 doing its Arduino thing, both connected by a serial connection. The Atheros AR9931 is also found in a router popular amongst hardware hackers. It really was only a matter of time before someone ported the Yun software to a router, then.

Wicked Device has released the WildFire board to the world. WildFire is a an Arduino compatible processor board with a Texas instruments CC3000. WildFire adds a few interesting features to the typical ‘Duino clone. Instead of the ATMega328 used in the Arduino Uno, the WildFire uses an ATMega1284p

As with any non-standard Arduino board, the WildFire does require some modification to the Arduino IDE. This took a bit of time with the pre-release board. Wicked Device has streamlined the process since then.

Once the IDE is up and running, its easy to get the WildFire’s CC3000 connected to your local access point. From there the internet is your playground.

For the longest time, the creators of the Arduino have been looking at how to bring the Arduino platform into the cloud. Ethernet and WiFi shields technically work, but if you’re processing data scraped from a web page, a lowly microcontroller really isn’t the best option. Enter the Arduino YUN. At its core, it’s a regular old Arduino Leonardo. Underneath that metal plate on the board? That’s an SoC running Linux.

Basically, the Linux side of the Yun is pretty similar to a WiFi router running OpenWRT. There’s a USB port for plugging in peripherals, native WiFi support (802.11n, even!), an Ethernet connector, and enough RAM to do all the interesting stuff a small computer connected to the Internet can do.

SAN MATEO, Calif. – Massimo Banzi launched a $69 board that aims to plug do-it-yourself-ers into the cloud. The Yun is the first of a family of low cost, low power Arduino cards that run Linux and Wi-Fi, surfing the trend toward the Internet of Things.

Yun, named for the Chinese word for cloud, aims to let the average tinkerer link a new Linux gadget to the Web using a simplified browser interface. “We want to make it easy for people to create complex Web apps,” Banzi told a packed crowd at the center stage of the Maker Faire event here.

Yun links to the Web via the Hornet AR9331 Wi-Fi chip from Qualcomm Atheros which supports 2.4 GHz networking and runs a custom distribution of Linux, said Federico Musto who had the idea for the board and did the initial design work. Musto shared his idea with Banzi when the two met by accident on a train in December.

Musto showed a Qualcomm Atheros representative at the Consumer Electronics Show in January an early version of the board based on a reverse engineered smartphone module using the AR9331. A technical director of the company subsequently gave approval to supply the chip for the open source boards.