May 2017 - iot-wg - mailman.ripe.net

[iot-discussion] Reminder: Security BoF, relation between (IoT) devices and infrastructure
by Marco Hogewoning 24 May '17

24 May '17

Dear colleagues, If you are attending RIPE 74, please be reminded that tonight at 18:00 we will organise a BoF to explore the link between insecure devices and infrastructure security and stability, especially what we would like to discuss is the possible role of the access providers in the system. •What role do service providers want to play? •What role can service providers play? •What do we need from manufacturers? •What is the role of governments? Please join us at the Tutorial Room (opposite of the maIn room) at 18:00 local time. Groet, MarcoH

2 2

[iot-discussion] Proto-charter for IoT working group
by Anna Wilson 12 May '17

12 May '17

Hello all, At the IoT BoF this evening, there was positive discussion about forming a working group. Some volunteers got together after the meeting to start to hammer out a charter. This is what we came up with. Draft: The Internet of Things working group will work on the areas of: - what role do service providers want to play - what role can service providers play - what do we need from manufacturers - engaging with governments and regulators - educating stakeholders - recommendations for vendors, service providers, end users and relevant stakeholders Best regards, Anna -- Anna Wilson Service Desk Manager HEAnet CLG, Ireland’s National Education and Research Network 1st Floor, 5 George’s Dock, IFSC, Dublin D01 X8N7, Ireland +353 (0)1 6609040 anna.wilson(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270

10 22

[iot-discussion] IoT discussion during closing plenary at RIPE 74
by Suzanne Taylor 12 May '17

12 May '17

Hi all, As promised, here's a summary of the brief discussion that took place during the closing plenary session at RIPE 74 about the potential creation of a new RIPE Working Group focused on IoT. Anna Wilson provided a brief explanation of the BoF that took place and Hans Petter Holen presented a slide on the draft “proto-charter" submitted by the team of volunteers. Hans Petter said that a slot will be made available during RIPE 75 to focus on this topic and to decide whether to form a Working Group. You can find the slides here (the video recording is not immediately available because there was a problem with the recording equipment): https://ripe74.ripe.net/presentations/160-RIPE74_Closing-Plenary.pdf Cheers, Suzanne

1 0

Re: [iot-discussion] Persirai - Yet another...
by Victor Reijs 11 May '17

11 May '17

<without attachement as that seem snot to be allowed> Hello all of you, Having tried within two ISPs to push for some 25 years the next generation of the Internet, I am looking at other tactics. For Internet of Things I want to have a client focused direction. Following more or less also the ideas that Internet 2 (the USA NREN ISP) has around Internet of Tings a few workgroups: http://www.internet2.edu/communities-groups/advanced-networking-groups/inte… I have investigated the ideas our clients have around Internet of Things, see: https://www.heanet.ie/blog/what-can-the-iot-do-for-the-educationresearch-se… And now I am in the process of setting up a Special Interest Group (attached are some of the subject that came up after this consultation with clients). Of course similar subjects came in your discussion, and I hope a posisble RIPE WG can be complementary to this. Just my few cents. All the best, Victor <With a hat of a non commercial server provider to a closed user group: the Irish education and research sector> On 11/05/2017 13:58, Marco Hogewoning wrote: > Thank you Gordon, > > May I again urge the participants to try and not only focus on the problems or particular incidents. > > While of course these examples help and can be used to learn from, I would really like to focus on wha this community can contribute towards solutions. Of course there is still a pretty wide spectrum of options from education to some smart technical solutions that could recognise and filter bad traffic. > > While I am pretty sure we can’t fix everything, I personally still believe there are things where we, the operational community, can add to solutions. But for that to occur we do need to look slightly beyond the problem itself. > > - What are the common causes > - What can be improved > - Who can make these changes > > We are certainly not unique in recognising there is a problem, but we some unique expertise and a very open model, which I think we could put to good use. But the message should be slightly more advanced than pointing out they are doing it all wrong… > > MarcoH > (no hats) > _______________________________________________ > iot-discussion mailing list > iot-discussion(a)ripe.net > https://lists.ripe.net/mailman/listinfo/iot-discussion > -- Victor Reijs Network Development Manager and International Relations HEAnet CLG, Ireland’s National Education and Research Network 1st Floor, 5 George’s Dock, IFSC, Dublin D01 X8N7, Ireland +353 (0)1 6609040 victor.reijs(a)heanet.ie www.heanet.ie Registered in Ireland, No. 275301. CRA No. 20036270 (h)

1 0

[iot-discussion] Persirai - Yet another...
by Gordon Lennox 11 May '17

11 May '17

New IoT malware targets 100,000 IP cameras via known flaw http://www.csoonline.com/article/3195825/security/new-iot-malware-targets-1… Persirai: New Internet of Things (IoT) Botnet Targets IP Cameras http://blog.trendmicro.com/trendlabs-security-intelligence/persirai-new-int… https://pierrekim.github.io/blog/2017-03-08-camera-goahead-0day.html And anyone thoughts / experience when it comes to Shodan? https://www.shodan.io Gordon ------- https://twitter.com/internetofshit - Lennart Koopmann‏ @_lennart May 8: Is this a good moment to ask myself why my lightbulb started talking to a TOR exit node on UDP port 123 this morning?

2 2

[iot-discussion] Call for Papers: International Workshop on Secure Internet of Things - SIoT
by Jim Reid 11 May '17

11 May '17

FYI. The announcement below just popped up on an IETF list. > Begin forwarded message: > > From: Sofiane Lagraa <sofiane.lagraa(a)inria.fr> > Subject: [Cfrg] Call for Papers: International Workshop on Secure Internet of Things - SIoT > Date: 11 May 2017 at 11:53:00 BST > To: cfrg(a)irtf.org > > ======================== > Apologies for any cross-posting > ======================== > > CfP - International Workshop on Secure Internet of Things - SIoT 2017, 14 - 15 of September, Norwegian University of Science and Technology (NTNU), Oslo, Norway > > Workshop Description and Scope > ============================== > > The International Workshop on Secure Internet of Things 2017 (SIoT 2017) will be held in conjunction with the European Symposium on Research in Computer Security (ESORICS 2017) in Oslo, Norway at the Norwegian University of Science and Technology (NTNU), on September 14-15 2017. The proceedings of the workshop will be submitted to IEEE Explore. > > SIoT is a community where interested stakeholders, from academia and industry, can present their original work on providing a secure environment for connecting systems in an Internet-specific structure. The wide spread of mobile and embedded devices, able to connect to a network and share information, requires a careful look at the security risks taken by end users. In this context, the workshop will focus on contributions related to the security of mesh and machine-to-machine networks, secure software stacks running on ubiquitous network nodes, and algorithms used to provide secure end-to-end communication between nodes. > > Workshop Topics > =============== > The focus of this workshop is to create a secure environment for connecting systems in an Internet-specific structure. These may include, but are not limited to, the following topics: > * Threat Models in Internet of Things > * Attack Strategies for Internet of Things > * Security Architectures > * Secure Mobile Applications > * Secure Mobility Management > * Intrusion and Malware Detection > * Security in Wireless Sensor Networks > * Reliable Interactions with Network Services > * System and Data Integrity > * Scalability and Robustness for Internet of Things > * Identity Management in Internet of Things > * Trustworthiness in Internet of Things > * Secure Operating Systems > * Privacy in Internet of Things > * Adaptive Security in Internet of Things > > Important Dates > =============== > * Submission Deadline: June 25th, 2017 > * Author Notification: July 29th, 2017 > * Camera Ready: August 14th, 2017 > * SIoT Workshop and ESORICS Conference: September 14-15th, 2017 > > Submission Guidelines > ===================== > Papers submitted for publishing must adhere to the IEEE template and should be at most 10 pages in this format, including the bibliography and well-marked appendices. The original settings of textwidth and textheight should be preserved. > > Accepted papers will be submitted to IEEE. Note that authors of accepted papers must guarantee that one of the authors will register and present the paper at the conference. > > For more details, please visit our website: http://siot-workshop.org/ > > _______________________________________________ > Cfrg mailing list > Cfrg(a)irtf.org > https://www.irtf.org/mailman/listinfo/cfrg

1 0

[iot-discussion] ITU activities
by Gordon Lennox 11 May '17

11 May '17

For people on this list and not in today's Cooperation WG session, I can strongly recommend checking out Marco’s presentation on the ITU’s IoT activities. Gordon

1 0

[iot-discussion] Summary of RIPE 74 IoT BoF
by Suzanne Taylor 10 May '17

10 May '17

Hi all, As Marco promised, here’s an overview of the main topics discussed during yesterday’s IoT BoF at RIPE 74. Please let me know if you have any questions – and by all means, please contribute your own ideas and thoughts to keep the discussion going. ******** Eliot Lear from Cisco Systems kicked off the discussion with an overview of the many factors involved in IoT security, focusing on the existing divide between manufacturers, vendors, service providers, governments and consumers. His main question to the group was whether ISPs want to organise in order to try to tackle the issue of IoT security, and to try to define what part of the problem they could potentially contribute to. A lot of different potential solutions were discussed in terms of what these different stakeholders can do to mitigate the serious security threats that exist across the IoT landscape. On a technical level, these included: - banning the use of default usernames and passwords - the need for cryptographically enhanced protocols and firmware updates - the possibility of disconnecting misbehaving devices - a potential requirement for two-step verification before any new devices connect for the first time - creating “gaps” in the architecture so that things can be shutdown if necessary - intelligent computing that extends all the way to the edge On a non-technical level, ideas debated included: - the extent to which regulation can play a role - the need to educate governments about the technical aspects involved - the viability of shared standards across borders - the need to create market demand for secure devices among consumers The role and responsibility of ISPs as gatekeepers of potentially malicious traffic was also discussed, along with the difficulty in keeping up with security advances when it comes to devices that are likely to exist for years beyond their initial deployment. The group agreed that the technical community could do more to educate manufacturers about what “good security” looks like and share its expertise with them. However, the point was made that network operators may also have a direct role to play and should not simply point fingers elsewhere. What about quarantining bad actors at the ISP level, for example? Another focus was the lack of a clear chain of accountability when it comes to IoT devices that exists, for example, in car manufacturing. Who is responsible when something goes wrong? There are many layers to security, from the control of and access to devices, to what information devices produce and where this is shared. In addition, different approaches will be needed for different types of devices (e.g. light bulbs probably shouldn’t be treated the same way as pacemakers). Paul Rendek from the RIPE NCC urged participants to figure out which piece of the IoT discussion the RIPE community can most effectively contribute to and to “own that space” by actively participating in external fora such as the ITU, the IEEE and others. There was general agreement that the RIPE community should get more involved and help shape the public policy debate before regulation comes into place. The group agreed that there is a lot of interest in the IoT and how the RIPE community can help mitigate security risks, and there was overwhelming support for the possible creation of a new RIPE Working Group focused on IoT. There was also consensus that the group needed to move quickly in light of how fast things in IoT are moving forward. Volunteers came forward to draft a rough outline of a charter, and RIPE Chair Hans Petter Holen offered a slot during the Friday plenary session at RIPE 74 so it could be discussed more broadly. ******** We’ll report back on the outcome of the discussion on Friday…stay tuned! Cheers, Suzanne _____________________ Suzanne Taylor External Relations Officer RIPE NCC

3 2

Re: [iot-discussion] iot-discussion Digest, Vol 6, Issue 4
by Corinne Cath 09 May '17

09 May '17

Dear Marco, Could you maybe share the findings of the group with the mailinglist for those not physically present? Best, On Tue, May 9, 2017 at 11:00 AM, <iot-discussion-request(a)ripe.net> wrote: > Send iot-discussion mailing list submissions to > iot-discussion(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/iot-discussion > or, via email, send a message with subject or body 'help' to > iot-discussion-request(a)ripe.net > > You can reach the person managing the list at > iot-discussion-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of iot-discussion digest..." > > > Today's Topics: > > 1. Reminder: Security BoF, relation between (IoT) devices and > infrastructure (Marco Hogewoning) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 9 May 2017 11:55:09 +0200 > From: Marco Hogewoning <marcoh(a)ripe.net> > To: iot-discussion(a)ripe.net > Subject: [iot-discussion] Reminder: Security BoF, relation between > (IoT) devices and infrastructure > Message-ID: <F3406CE5-41FF-4335-B1F7-A4368389CC9F(a)ripe.net> > Content-Type: text/plain; charset=utf-8 > > Dear colleagues, > > If you are attending RIPE 74, please be reminded that tonight at 18:00 we > will organise a BoF to explore the link between insecure devices and > infrastructure security and stability, especially what we would like to > discuss is the possible role of the access providers in the system. > > ?What role do service providers want to play? > ?What role can service providers play? > ?What do we need from manufacturers? > ?What is the role of governments? > > Please join us at the Tutorial Room (opposite of the maIn room) at 18:00 > local time. > > Groet, > > MarcoH > > > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > iot-discussion mailing list > iot-discussion(a)ripe.net > https://lists.ripe.net/mailman/listinfo/iot-discussion > > > ------------------------------ > > End of iot-discussion Digest, Vol 6, Issue 4 > ******************************************** > -- Corinne J.N. Cath Ph.D. Candidate, Oxford Internet Institute & Alan Turing Institute Web: www.oii.ox.ac.uk/people/corinne-cath Email: ccath(a)turing.ac.uk & corinnecath(a)gmail.com Twitter: @C_Cath

3 3

[iot-discussion] Cerf on the ethics of IoT
by Marco Hogewoning 04 May '17

04 May '17

Dear colleagues, Somebody drew my attention to an article by Vint Cerf and Francine Berman on the ethics of IoT, some of you might find it an interesting read as well. http://www.cs.rpi.edu/~bermaf/Berman+Cerf_IoT.pdf Following this, an interview with Berman was published on The Atlantic earlier this week https://www.theatlantic.com/technology/archive/2017/05/internet-of-things-e… As a reminder, we are still setup to have a BoF aiming to discuss some of this space as well, in particular the expected or desired role of the parties providing connectivity to these devices. This “IoT Security BoF” will take place after the main RIPE 74 program, on Tuesday May 9 at 18:00 in the Tutorial Room of the meeting venue. Unfortunately, due to this being a BoF and as this room only has a very limited technical setup there won’t be any remote participation offered. So hope to see many of you in the room in Budapest next week, Groet, MarcoH

2 1