Should I have that IoT device on my home network?

Yesterday I wrote about my cousin’s smart oven, and the risks of having it networked. Does this mean that you should have no IoT devices in your house? If not, how should you decide which ones are worth connecting? Here are three questions you might want to ask.

Does connecting the device to your network offer you any perceptible value?

Sometimes the answer is going to clearly be “yes”. For example, if you are taking a vacation in the middle of the winter in some cold place, you might want to know that your home’s heater broke down before your pipes froze. Having a thermostat configured to alert you to this fact might prove very useful. On the other hand, if you are in a place where such a concern is unwarranted or you would have no reason to worry about such things, maybe that same device does not need connectivity.

Will the device function correctly without connectivity?

Don’t expect an Amazon Echo to function, for instance. There is a reason why a great many IoT manufacturers are requiring Internet connectivity for their devices: the more intelligence they can move into their servers, the less intelligence is needed in the device itself, making it cheaper to build. If you are going to have a function like this in your house, this is actually an environmentally friendly way to go. Fewer parts require fewer resources used to build and to later dispose. But if a device does function properly and fully without Internet connectivy, why plug it in?

Does that device need continuous Internet connectivity?

You are unlikely to connect and reconnect your television every time you want to watch a video, but maybe you only need that thermostat connected while you are on vacation, for instance, or maybe an appliance needs a firmware update via the Internet. Occasionally connecting a device may make sense. However, take care: if you only plug in devices while you are on vacation, someone may be able to notice that and choose that time to break into your home.

Some Internet routers have the ability to block devices at certain times. Typically this is used to limit children’s access. However, one can also use these filters for other purposes. The problem is that this is nearly as annoying as having to deconfigure devices themselves. I’ll discuss this more in the near future.

Think before you buy!

The risk to your home and your privacy is real. Realistically, however, you will have some IoT devices in your house. Think about what value you derive from them, and what can go wrong if they are attacked before you buy.

Would you want your cousin using a connected oven?

Recently my cousin installed a smart oven into her home. It is top of the line. She wrote on social media that it texted her to tell her that it needed to clean itself, which it did before her second cup of coffee. How cool is that?

I immediately feared for her safety. Here is a slightly edited version of what I wrote to her:

IoT is a nice convenience, but there are a few things you should know. First, I guarantee that there are vulnerabilities in the device, even if some have yet to discover them. This is true for *any* connected device. Those vulnerabilities may be exploited at some point. What will happen then?
First, it’s possible that attacker could simply disable the oven. They probably won’t do this unless they are able to communicate with you. But since the oven seems to be sending you messages, it’s possible that they will do this and ransom you to re-enable it. (If that happens, don’t pay.)
Whether or not you can control the oven from the app, don’t think for a moment that hackers won’t be able to gain that level of control. That presents a far more serious risk: a fire, especially if the hackers are able to detect that the cooking temp is supposed to be 350, and turn the thing up to broil or clean.
The other thing that will happen is that the oven will attack other Wifi-enabled devices in your house or elsewhere. If you have a Wifi-enabled thermostat, maybe it will attack that. Some of those devices have cameras and microphones. The attackers aren’t going to be nice about what information they collect. They’re out to make money or worse.
Will any of this happen? Yes – to many people. Am I being paranoid? Maybe a little. Appliance manufacturers may know how to make excellent oven mechanisms, refrigerator compressors, stove top elements, etc, but they generally know very little about Internet security and their risks. Even those who know a lot get it wrong all the time, simply because we’re human.
And so are you gaining any great convenience by having the Wifi turned on, apart from a 5:30am wake up call to let you know that it needs to clean itself? If yes, you have a trade off to make. If not, just disable its darn Wifi.

This is how I feel about technology and the ones I love. Presumably you have some of those. There are definitely times when IoT is necessary, and when convenience is probably worth the risk. But consumers really need to think about this long and hard, and we professionals need to provide them a decent decision framework. I’ll talk about that next.

Shining City Upon a Hill

9/11 has harmed our values. We need to return to them.

I have been struggling with 9/11 for a great many years.

While I lost a cousin, we were not close. I stand in support of my family who were devastated, and who I love, and with my country who was attacked, and who I love. I’m glad we went after OBL and the Taliban in response. But for me to claim that I was a victim of this attack seems a form of self-aggrandizing that is disrespectful to those people who really did suffer. I do not need to light a johrzeit candle for someone who died on that day, but to support those who do.

But I have suffered a loss.

The terrorists who do not deserve naming killed 2,977 people on that day. Another 6,000 were injured. That’s a lot of people to lose in one day to a hateful act. and it required a response. But those criminals cannot be held responsible for harming our ideals. Only we can do that. And so we have done.

A great many of my friends see the attack as victims in such a personal way that it has allowed them to justify acts in our name by our government, without any sense of proportion.

They say, “Never Forget!”

That phrase is holy to me. It means that we should remember the loss of
6 million Jews who died at the hands of a society who accepted hatred and bigotry as an excuse for genocide, and that we should understand the causes of the deaths of those people, and never ever allow it to happen again. To me, it is blasphemous to use the expression in any other context.

In this context, it has been used as an excuse to harm our ideals, the best modern expression of which were said some 30 years ago:

I’ve spoken of the shining city all my political life, but I don’t know if I ever quite communicated what I saw when I said it. But in my mind it was a tall, proud city built on rocks stronger than oceans, wind-swept, God-blessed, and teeming with people of all kinds living in harmony and peace; a city with free ports that hummed with commerce and creativity. And if there had to be city walls, the walls had doors and the doors were open to anyone with the will and the heart to get here. That’s how I saw it, and see it still.
Ronald Reagan, January 11, 1989

Since 2001, the wars in which we engaged have taken the lives of anywhere from 200,000 and 1 million people, and Afghanistan is not much better off than when we went in. But that is nothing to me compared to the mentality that we have taken on, in which we act out of fear, spite, and vengeance, and that we have lost our compassion for those beyond our borders. That so many are scared of the people who come here with nothing but the shirts on their backs shows just how far we have fallen from grace.

On September 13, 2001, I wrote that I saw my lot in life not to be a victim, but to support the victims, to keep calm and carry on. I wanted to do what I could to preserve the shining city on the hill. I still believe all of that, only now, sadly, the goal is restoration.

Most of us are not victims and we have to stop acting like victims. And we have to stop using a victimization mentality as an excuse for vengeful, uncharitable, and bullying behavior.

My hope is that as we approach the 20th anniversary of the attacks, we can begin as a society to reclaim our American ideals, so that we can once again be that Shining City On the Hill.

RFC 8520 on Manufacturer Usage Descriptions Released

Today the RFC Editor released RFC 8519 (the ietf-acl model) and RFC 8520 (Manufacturer Usage Descriptions). The ACL model provides for a programmatic YANG-based interface that is flexibly extensible. Manufacturer Usage Descriptions (MUD) extend this model so that manufacturers are in a position to request the network’s assistance.

MUD’s declarative model for manufacturers to describe to customers what network resources their devices are designed to use. No guessing games are required. Manufacturers use simple abstractions to describe what access a device needs, such as a domain name for cloud-based service, or same-manufacturer or my-controller for local devices.

Even when one doesn’t use automated tools, there is benefit to manufacturers in writing MUD files. A study by the University of New South Wales found that IoT devices often conflict with enterprise network policies, and that this goes largely unnoticed by administrators who don’t understand the needs of those devices. What we can say is that if manufacturers do a little bit of work, they and our customers can both derive a whole lot of value from the network.

A fair amount of software already exists for MUD, including the NIST MUD Manager, and the tools built by CIRA, not to mention Cisco’s open source version, and osMUD.org, and commercial versions built by Yikes! and Cisco. Google has implemented a MUD manager as for build management. And of course you can build your own MUD file for your device by going to https://www.mudmaker.org.

MUD is part of a nutritious meal, but it is not the whole meal. Manufacturers should always use best coding practices, and update firmware and software promptly when they learn of vulnerabilities and exploits

Next Steps

It’s time for manufacturers to implement! Protect your devices with MUD!

New Paris Cyber-Accord: Nice words. What comes next?

The accord and Macron’s words are a bit “aspirational”.

Recently France has taken the initiative to produce what they call The Paris Call for Trust and Security. This call has garnered signatures of some 57 countries and and several hundred companies and organizations (including that of my own employer).^* What President Macron and others have recognized is that there is a risk of both state and non-state actors interfering in the lives of everyday people, possibly causing them great harm.

Every day provides a new example of why protection of our institutions is necessary. This video was made some time ago. We’d like to think that security of our infrastructure has improved, but Marriott proved us wrong last week, with over half a billion customer records having been stolen.

The Paris Call seems to address itself to these sorts of civilian attacks, which to me is appropriate. In particular, it focuses on the following areas (I’m condensing just a bit):

Protection of critical infrastructure,
Protection of electoral processes (Gee, I wonder who that is aimed at),
IPR protection,
Tools development to prevent the spread of malware,
No hack-backs, where people attempt to take the offense as a either a defense or a means of deterrence,
Acceptance of international norms of behavior.

The Call does not create or call for the creation of any new mechanism to pursue these points, but rather the use of existing mechanisms. Instead, what we appear to be witnessing is the creation of a voting bloc inside existing multilateral and multi-stakeholder processes, as well as a non-binding commitment among the signatories themselves to pursue these principles. It’s all motherhood and apple pie until we understand what the actual instantiation of these principles means. Does it mean, for instance, an end of free software in order to protect content providers? Will it require content publishers to actively protect all rights of copyright holders, even if those holders are unknown?

Also, should these principles apply equally to civilians and the military ? Let’s take for example the Stuxnet attack, where some state actor attacked Iran’s nuclear weapons facility. Should that attack have been prevented by these principles? To what end? Helping Iran gain an offensive nuclear capability? If the choice was a cyberattack against a military installation versus a physical attack, where people would surely die, I’ll take the cyber attack any time.

There is another big topic that isn’t covered. Right now governments are all struggling with how to handle cross-border law enforcement. That is- if someone in Jurisdiction A hacks into or uses a computer in Jurisdiction B to attack a person in a third Jurisdiction C, who can reasonably ask Jurisdiction B for the data? This is a massive topic that the Council of Europe has been attempting to address for years. These are knotty issues, because of the limitations on the powers of each country relating to search and seizure.

In short, while this is nice text, it doesn’t seem to me to accomplish much on its own.

It does seem to be a slap at Russia and China, two notably absent countries. Three other notably absent countries are the U.S., Israel, and Iran. Coincidence? I think not.

^*The views of my employer surely vary from my own today.