March 2020 - iot-wg - mailman.ripe.net

Re: [iot-wg] New on RIPE Labs: Visualisations of Periodic IoT Traffic
by Eliot Lear 25 Mar '20

25 Mar '20

Hi Poonam Thanks. The concern here is that the device could choose to identify as something else through a set of false communications. It is indeed an interesting area of research. I am not saying there is nothing to be done, but it is something that requires careful consideration as we aim toward automating policy. I fear in particular that the cloud makes this quite a bit harder, and IOT manufacturer use of their own DNS infrastructure will make it yet more difficult, because we are all using the same cloud infra. Eliot On 19.03.20 15:42, Poonam Yadav wrote: > > Dear Elliot, > > Thank you for your very important question. In the current setting, > our router verifies packets using devices' MAC addresses; it means the > router has a list of mac addresses of all IoT devices. For another > work, we used certificate-based authentication between the router and > device MUD server, something > similar: https://docs.microsoft.com/en-us/azure/iot-edge/how-to-authenticate-downstr… > > We used off-the-self IoT devices so its not easy to integrate many TEE > based solutions. > > Best regards, > > Poonam > > > > On Thu, Mar 19, 2020 at 12:47 PM Eliot Lear <lear(a)ofcourseimright.com > <mailto:lear@ofcourseimright.com>> wrote: > > Very interesting work! > > A cautionary question: > > If I wanted to pretend to be one of these devices on your network, > how hard would it be? > > Eliot > > On 19.03.20 12:56, Poonam Yadav wrote: >> Thanks for sharing! >> >> We have analysed similar pattern in many IoT devices and >> presented periodicity in IoT traffic as FFT (fig 4 - of IoTDI >> paper attached for reference) and some initial results here in >> this report: >> https://www.repository.cam.ac.uk/handle/1810/284092 >> and full paper is here: >> https://dl.acm.org/doi/10.1145/3302505.3310082 >> >> Best regards, >> >> On Thu, Mar 19, 2020 at 10:31 AM Mirjam Kuehne <mir(a)ripe.net >> <mailto:mir@ripe.net>> wrote: >> >> Dear colleagues, >> >> IoT devices often perform activities on a periodic basis. >> Thymen Wabeke >> of SIDN Labs shares his analysis of periodic network traffic >> from IoT >> lightbulbs. Read it on RIPE Labs at: >> >> https://labs.ripe.net/Members/thymen_wabeke/visualisations-of-periodic-iot-… >> >> Kind regards, >> Mirjam Kühne >> RIPE NCC >> >> _______________________________________________ >> iot-wg mailing list >> iot-wg(a)ripe.net <mailto:iot-wg@ripe.net> >> https://lists.ripe.net/mailman/listinfo/iot-wg >> >> >> _______________________________________________ >> iot-wg mailing list >> iot-wg(a)ripe.net <mailto:iot-wg@ripe.net> >> https://lists.ripe.net/mailman/listinfo/iot-wg >

3 2

Re: [iot-wg] New on RIPE Labs: Visualisations of Periodic IoT Traffic
by Mirjam Kuehne 19 Mar '20

19 Mar '20

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Eliot, Thymen asked me to pass this on to you (but I believe he is now subscribed to the list): - -- Eliot has a valid point. We didn’t focus on this aspect yet, but it’s good to keep that in mind. In general, adversaries can fool any machine learning model once they know the model parameters. One can exploit the parameters to craft so-called "adversarial examples” that will generate a specific output/classification. This is actually a research topic on it’s own called adversarial machine learning [1]. This blog [2] shows some famous examples using images of pandas. [1] https://en.wikipedia.org/wiki/Adversarial_machine_learning [2] https://openai.com/blog/adversarial-example-research/ - --- Kind regards, Mirjam On 19/03/2020 13:47, Eliot Lear wrote: > Very interesting work! > > A cautionary question: > > If I wanted to pretend to be one of these devices on your network, > how hard would it be? > > Eliot > > On 19.03.20 12:56, Poonam Yadav wrote: >> Thanks for sharing! >> >> We have analysed similar pattern in many IoT devices and >> presented periodicity in IoT traffic as FFT (fig 4 - of IoTDI >> paper attached for reference) and some initial results here in >> this report: https://www.repository.cam.ac.uk/handle/1810/284092 >> and full paper is here: >> https://dl.acm.org/doi/10.1145/3302505.3310082 >> >> Best regards, >> >> On Thu, Mar 19, 2020 at 10:31 AM Mirjam Kuehne <mir(a)ripe.net >> <mailto:mir@ripe.net>> wrote: >> >> Dear colleagues, >> >> IoT devices often perform activities on a periodic basis. Thymen >> Wabeke of SIDN Labs shares his analysis of periodic network >> traffic from IoT lightbulbs. Read it on RIPE Labs at: >> >> https://labs.ripe.net/Members/thymen_wabeke/visualisations-of-periodi c-iot-traffic >> >> >> Kind regards, >> Mirjam Kühne RIPE NCC >> >> _______________________________________________ iot-wg mailing >> list iot-wg(a)ripe.net <mailto:iot-wg@ripe.net> >> https://lists.ripe.net/mailman/listinfo/iot-wg >> >> >> _______________________________________________ iot-wg mailing >> list iot-wg(a)ripe.net >> https://lists.ripe.net/mailman/listinfo/iot-wg -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJec4DqAAoJEIZoWwVN2sgM2hUP/RBvIpcXAfHp97uMnfeqzYE4 rSR5Sa5GkQ6uOC3Pu/4uO96ln2m9H/Oy9Bgnz/k3U1KpFPW5MqJHom1Ckmgdxs0a u9/ruzdk/rVCggtWXifY1TIjm0PJ2sOVKd7ERACITlzMOG0xnMll2Ah8NX5AsV2O j+KIO47vbnoZdaqyq/pmCvDQMazEcT2hU9z6KLwIvE436Er6YqluCkvuMPyacARL slj7K2o9gUZJ+3ianIRuRBpGRgTDruSJfEs7XAB+Lfms6BhfspgTANNaRHPMzqLN r8TeaQ7A2swpDnKOyUWWTqT/P/7qK/eZkt/ErWtM55ZFgV8wMZcd8KCsifU+Z1nv oZw67sgJUL618PCHzYdii28FAjciqQaQbLWGDgyOS4ItgSKYh4R2YwcpkqkJHvv4 YY/YjJYqM1cARLlUx3TZzk5PXvWMPc70XQTPpFyyM3t+hIDhnU7qZyt6wBBv2JUP 6j5ep/44XZ4tF4zWkbZZlKbrmkUxCNYPIwHmRZr94Sq8atQMTfw4QoK6hLxw9jf7 XpqAZmsU/2t+6hRHeAack/tvOoVUC1Xzue+upyjrYs8j3otgOPaznWWFN1vIEGZv 8h35qzp+QeQGoB4LjVxVelhdP0uf7GlXjgGgRs+0O308ApMZOz3n4ArO+8SynFhH I/hriOFDdJMqKK8rA6Ci =qLA6 -----END PGP SIGNATURE-----

1 0

New on RIPE Labs: Visualisations of Periodic IoT Traffic
by Mirjam Kuehne 19 Mar '20

19 Mar '20

Dear colleagues, IoT devices often perform activities on a periodic basis. Thymen Wabeke of SIDN Labs shares his analysis of periodic network traffic from IoT lightbulbs. Read it on RIPE Labs at: https://labs.ripe.net/Members/thymen_wabeke/visualisations-of-periodic-iot-… Kind regards, Mirjam Kühne RIPE NCC

2 1

IoT BCOP Document
by sandoche Balakrichenan 18 Mar '20

18 Mar '20

Dear all and Michael, I am piggybacking on Michael's last mail on the IoT BCOP document. We have been discussing this topic for a while and we need to go further. Last time, we discussed there was a brief consensus for this subject within RIPE Scope : "/Best Current Operational Practice (BCOP) document in RIPE scope for proactively mitigating IoT attacks/". If there is an alternative opinion, *please express*. There were proposals from Eliot and others, that we should begin with an *outline*. The initial outline was as follows: ------- The threat Some background on device capabilities and limitations Who can do what to improve the situation? Devices CPE gear Upstreams IoT Manufacturers Consumers (let's not ask much) ------- The functionality for controlling the home network traffic would typically include: Insight in all the devices connected to the home network. Possibility to block traffic. End-user friendly GUI and traffic management possibility. Option to have the traffic management outsourced (e.g. to an ISP). Blocking of compromised IoT devices. ------- We could have discussion on the following points: 1. Outline 2. Volunteers (who wish to contribute) 3. Champions (who will lead the work) - We could limit the number of Champions 4. A deadline These are my two cents. Please feel free with your feedback/contributions. Sandoche.

1 1

Interest for a virtual RIPE 80 meeting
by sandoche Balakrichenan 18 Mar '20

18 Mar '20

Dear all, As you all know RIPE 80 will happen between 11-15 May 2020 in Berlin. With the Covid-19 situation, there is a query from the RIPE meeting Organisers to the chairs on whether there will be interests from the WG to continue with sessions and presentation in case of a remote meeting? In the event, there is a remote meeting, it will be shortened (may be it will happen in a single day) overall RIPE meeting. The chairs would like to know from the WG: A. Would you like to continue with sessions and presentations in the case of a remote meeting? B. If yes to A, do you think we could limit to one or two remote presentations (Overall max. time allocated to IoT WG could be 30 to 40 minutes)? We have already three interesting presentations planned for RIPE 80 or do you think we should allocate the time for presenting any other topic that needs to be discussed urgently. C. Would you envision anything beyond having speaker and slides available with chat and stenography? Thanks for your feedback. RIPE IoT WG Co-chairs, Sandoche and Jim.

6 6