October 2018 - iot-wg - mailman.ripe.net

InnoITeam - a new Center of Excellence in IoT Science and Technology
by Artūras Serackis 01 Jul '19

01 Jul '19

Dear Colleagues, We are excited to introduce you a new initiative a Center of Excellence in IoT Science and Technology (InnoITeam). The CoE will leverage the knowledge, experience, and resources of three Lithuanian institutions – Kaunas University of Technology, Vilnius Gediminas Technical University and State Enterprise Centre of Registers of Lithuania - with the support of two advanced EU partners from Sweden – Linköping University and Interactive Institute Swedish ICT in Norrköping. During the first five years, the Consortium will focus on four R&D topics: 1. User interfacing and interaction design approaches for Smart Environments based on IoT. 2. Cybersecurity aspects of the Smart Environments based on IoT. 3. Data analysis and visualization approaches for data-intensive IoT environments. 4. Cognitive IoT technologies for Smart Home Environments. The InnoITeam project is funded by the European Union’s Horizon 2020 research and innovation programme and coordinated by the Kaunas University of Technology. The project has been already started in September (2017) and is finishing its first phase. During the second phase in a five-year period, the InnoITeam is planning to become a self-sustaining organization, integrating and supporting research excellence and innovation development in Lithuania, the Baltic Sea region, and Europe. Meet our team and recent news on our web page: https://www.innoiteam.com Follow us on social media: https://facebook.com/innoiteam https://www.linkedin.com/company/innoiteam/ https://twitter.com/innoiteam

8 9

Re: [iot-wg] "The Internet of Threats: Fighting FUD with MUD"
by Töma Gavrichenkov 24 Oct '18

24 Oct '18

...and now bringing my question/suggestion to the mailing list. Previously on topic: we've agreed (haven't we?) that MUD is not currently targeting industrial IoT and connected health. So, smart homes. (By the way, it is more proper to directly specify the issue you're handling before proposing a solution. As MUD doesn't solve the security problem of IoT in general, let's then call it a solution for smart homes, but not a solution for IoT.) The issue with smart homes, wearables etc. is that a contemporary commodity IoT device is not connected to the Internet in order to really provide a service to the customer. Instead, it collects, processes and sends data and telemetry which is precious for its vendor, which said vendor would then be able to sell. - https://www.theverge.com/2017/7/24/16021610/irobot-roomba-homa-map-data-sale - https://www.warc.com/newsandopinion/news/general_motors_generates_new_radio… - et cetera. Expecting a vendor to cut their own cables themselves is a strange move, isn't it. Hence, "default policy is no access" stuff isn't just going to fly. And, setting a firewall will only slightly help because of countless reasons. a) We have agreed today (haven't we?) that an IoT device needs to be updated frequently, and probably via the Internet. Let's now phrase it in a different way: we have agreed that an IoT device has a right to connect to a server of its vendor and exchange encrypted data with that server. Good luck telling updates from telemetry streaming then. b) Given a), a vendor will have an 100% legitimate excuse for denying you a service (i.e. remotely switching off a device, or more precisely, *not switching it on*) if the device doesn't have an Internet connectivity. c) Moreover, if a data collected by roombas would be actually worth selling, we can prophesize that ToSes for devices would start to *include* that connectivity requirement. I.e. if you don't want to share data with a vendor, then you must not buy this $9 vacuum cleaner but should rather go for that $199 vacuum cleaner, because it costs $150 to produce the device and for the former, the remaining $141 are covered by selling the data you don't want to share now. I'd be thrilled to see if anyone would be really going to spend additional $190 for privacy and security. d) Also, if said data is worth selling, setting up a firewall won't help because an IoT device will then use whatever radio technology built-in to connect to the Internet without your nice firewall. The only outcome would be an increased manufacturing cost because of additional radio module (and yes, it's the customer who's gonna pay for this). Sorry guys. Nothing personal, it's just business. e) You cannot possibly set a firewall between the Internet and wearables, SmartTV, cars, etc. ... I'm curious how does MUD address those concerns. | Töma Gavrichenkov | gpg: 2deb 97b1 0a3c 151d b67f 1ee5 00e7 94bc 4d08 9191 | mailto: ximaera(a)gmail.com | fb: ximaera | telegram: xima_era | skype: xima_era | tel. no: +7 916 515 49 58

10 32

serious vulnerabilities FreeRTOS
by Jim Reid 23 Oct '18

23 Oct '18

As surely as day follows night, there’s news of another example of scary/buggy/crappy IoT firmware. A large number of security vulnerabilities have been found in FreeRTOS and other variants which presumably share the same code base. These include information leaks, DoS and remote code execution. Nice. One of those variants is SafeRTOS -- oh the irony! -- that’s "certified for use in safety critical systems". Whoops! https://blog.zimperium.com/freertos-tcpip-stack-vulnerabilities-put-wide-ra… According to the above link, "FreeRTOS and SafeRTOS have been used in a wide variety of industries: IoT, Aerospace, Medical, Automotive, and more.”. The vulnerabilities are apparently in the TCP/IP stack. How is this possible? Rock-solid public domain TCP/IP code has been around since BSD4.4 20+ years ago. Or even earlier. Why would someone shun that, write their own code and do it badly? I just don’t understand the thinking(?) behind that. Does anyone have more info on the actual devices/applications which could be vulnerable?

3 2

In response to questions on ReD (RIPE 77)
by Marco Hogewoning 20 Oct '18

20 Oct '18

Dear all, If you followed the discussions during RIPE 77, I did not have an immediate answer to the process of establishing a Delegated Act. Meanwhile a helpful person has supplied me with some more details: The document here https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementi… contains some more information regarding the process. There is also a website that allow you to track delegated acts being prepared: https://webgate.ec.europa.eu/regdel/#/home And of course my advise remains to also consult with your national regulator on your position under this Directive and its potential extensions. Regards, Marco Hogewoning -- External Relations - RIPE NCC

2 1

GrowthEnabler's "Market Pulse Report for Internet of Things"
by Töma Gavrichenkov 18 Oct '18

18 Oct '18

Hi all, Apparently, the report I've mentioned today during the WG session is available on the Web, feel free to take a look: https://growthenabler.com/flipbook/pdf/IOT%20Report.pdf | Töma Gavrichenkov | gpg: 2deb 97b1 0a3c 151d b67f 1ee5 00e7 94bc 4d08 9191 | mailto: ximaera(a)gmail.com | fb: ximaera | telegram: xima_era | skype: xima_era | tel. no: +7 916 515 49 58

1 0

code of conduct for IoT devices
by Jim Reid 16 Oct '18

16 Oct '18

The UK's National Cyber Security Centre and the Department for Digital, Culture, Media and Sport has just published a code of conduct on security for consumer IoT devices. It's full of the usual advice: no default passwords, update firmware, protect personal data, etc. The document's available here: https://www.gov.uk/government/publications/secure-by-design/code-of-practic… In case anyone's wondering DCMS is the government department which (amongst other things) looks after Internet matters.

3 2

another heave on the co-chair selection procedure
by Jim Reid 15 Oct '18

15 Oct '18

Colleagues, the selection process needs another nudge. Although there have been a few expressions of support and no objections, I’m reluctant to declare consensus because only a handful of people have spoken. I’d *really* like to declare victory so we can get on with the job of finding a co-chair. It’s uncomfortable to do this when the WG has argely been silent about how the leadership is selected. So could you please indicate your support or opposition to the following? Thanks. I would also ask the WG to avoid the temptation to rat-hole or over-think the selection procedure, for instance by proposing elaborate steps to apply in corner cases that in all probability will never arise. We're only appointing a WG co-chair, not the Internet's Supreme-Leader-for-Life. The WG can always change the suggested process later if practical experience proves it is broken or needs improvement. Note too that there is no mention of elections or votes. This is deliberate. (1) The IoT WG will have 2 co-chairs who serve staggered 2-year terms. (2) A co-chair cannot serve more than 3 consecutive terms. (3) Each year, the longest serving co-chair will stand down and subject to (2) may make themselves available for re-appointment. (4) The incoming co-chair will be chosen by the WG using consensus and the remaining co-chair will make the consensus determination. (5) Any circumstances not covered by the above will be resolved by the RIPE Chair whose decision will be final. Vote early, vote often. Well OK, we don’t vote but I hope you get the point. :-)

15 21

New on RIPE Labs: RIOT in Amsterdam
by Mirjam Kuehne 15 Oct '18

15 Oct '18

Dear colleagues, Please find on RIPE Labs a summary of the RIOT Summit that took place in Amsterdam last month. The RIOT Summit is the yearly get-together of the community around the RIOT operating system for the Internet of Things (IoT). https://labs.ripe.net/Members/martine_sophie_lenders/riot-in-amsterdam Kind regards, Mirjam Kühne RIPE NCC

1 0

Re: [iot-wg] RIPE document on IoT security solutions
by Apostolos Malatras 11 Oct '18

11 Oct '18

Hi all, Just my two cents that might help/contribute in this effort. In November 2017, ENISA published -with the help of an amazing group of experts- the Baseline IoT Security Recommendations, which among else provides numerous links to related ongoing initiatives: https://www.enisa.europa.eu/publications/baseline-security-recommendations-… These have also been mapped in the online tool available here: https://www.enisa.europa.eu/iot-tool We will be soon publishing more info on the topic so please do feel free to reach out to us. Best, -Apostolos ------------------------------------------------------------------------------------------------------ Dr Apostolos Malatras Network and Information Security Expert European Union Agency for Network & Information Security Address: 1 Vass Sofias Str, Marousi 151 24, Attica, Greece E- mail: Apostolos.Malatras(a)enisa.europa.eu Office: +30 2814 409 630 Mobile: +30 6985 051 401 -----Original Message----- From: iot-wg <iot-wg-bounces(a)ripe.net> On Behalf Of iot-wg-request(a)ripe.net Sent: Thursday, October 11, 2018 1:00 PM To: iot-wg(a)ripe.net Subject: iot-wg Digest, Vol 20, Issue 6 Send iot-wg mailing list submissions to iot-wg(a)ripe.net To subscribe or unsubscribe via the World Wide Web, visit https://lists.ripe.net/mailman/listinfo/iot-wg or, via email, send a message with subject or body 'help' to iot-wg-request(a)ripe.net You can reach the person managing the list at iot-wg-owner(a)ripe.net When replying, please edit your Subject line so it is more specific than "Re: Contents of iot-wg digest..." Today's Topics: 1. Re: RIPE document on IoT security solutions (Peter Steinh?user) 2. Re: RIPE document on IoT security solutions (Nigel Titley) 3. Re: RIPE document on IoT security solutions (Peter Steinh?user) 4. Re: another heave on the co-chair selection procedure (Farzad Ebrahimi) ---------------------------------------------------------------------- Message: 1 Date: Wed, 10 Oct 2018 14:40:36 +0200 From: Peter Steinh?user <ps(a)embedd.com> To: Jim Reid <jim(a)rfc1035.com> Cc: RIPE IoT WG List <iot-wg(a)ripe.net> Subject: Re: [iot-wg] RIPE document on IoT security solutions Message-ID: <6A2D21F6-53DC-48D6-9C15-76AA861DC7CE(a)embedd.com> Content-Type: text/plain; charset="utf-8" > There?s not much to learn Peter. RIPE doesn?t develop standards. In the sense that IEEE or IETF develops standards. RIPE sometimes develops policies, usually on the allocation of numbering resources. These policies are produced though the process defined in RIPE document 710: https://www.ripe.net/publications/docs/ripe-710. > > Anything can become a RIPE document, not just policies. The process is simple. Someone just says to the NCC ?please publish this as a RIPE document?. And it is done. > > For this case, I think we want something that reflects a consensus view of the WG. If you can produce an initial draft or outline and post it to the list, we can discuss that, make changes and go through a few iterations of the document. Hopefully we then end up with something that has broad acceptance from the WG. At that point, someone takes the finished article to the NCC and asks for it to become a RIPE document. > > Over to you... Got it - will prepare an initial draft. - Peter Peter Steinh?user, CEO embeDD GmbH ? Alter Postplatz 2 ? 6370 Stans ? Switzerland Phone: +41 (41) 784 95 85 ? Fax: +41 (41) 784 95 64

1 0

Bad actors
by Wolfgang Tremmel 10 Oct '18

10 Oct '18

Hi, Interesting read about bad actors of IoT vendors (well, one vendor): https://krebsonsecurity.com/2018/10/naming-shaming-web-polluters-xiongmai/ best regards Wolfgang -- Wolfgang Tremmel Phone +49 69 1730902 26 | Fax +49 69 4056 2716 | Mobile +49 171 8600 816 | wolfgang.tremmel(a)de-cix.net Geschaeftsfuehrer Harald A. Summa | Registergericht AG Köln HRB 51135 DE-CIX Management GmbH | Lindleystrasse 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net

7 15