- iot-wg - mailman.ripe.net

some experiences with deny-by-default for IoT devices
by Michael Richardson 29 Mar '21

29 Mar '21

The CIRALabs SHG project (https://www.cira.ca/labs/projects/cira-secure-home-gateway ) has been trying to get our systems into the hands of 50+ in-house alpha testers, but the pandemic has set us back: sorting people's network plumbing without visiting their house is a challenge. There will always be someone with something that just isn't wired up right, and non-technical people don't want to screw with their setup when they need it for minute-by-minute school work, etc. (Ironically, our home routers probably make their network better if wired right). So, our team has been onboarding devices and letting our SPIN/SHG hybrid system do analysis of the devices to form filtering policies. We have leant that this is harder than we'd like. For instance, I got a $20 Globe Suite single outlet back in December. It's in green so that it will match your Xmas-tree. https://globe-electric.com/en/product/globe-electric-wi-fi-smart-plug-no-hu… Our system is set up to accept new devices online, but to drop traffic from them by default until the administrator says, "okay". The device wants to put into onboarding mode by having a button held down for 5s, and then it flashes fast, and it is supposed to be discovereable by the phone. I'm unclear if it gets discovered by BT or via 2.4Ghz public frames. The app is repeatedly very specific: "Make sure you are on 2.4Ghz WIFI" My app just could not discover my device despite repeated attempts. No obvious errors, just "not there".... I went back to our SHG app, saw that in fact a new device was now present. (Yes, there is a bug with delays with Notifications that we haven't figured out yet). I then enabled access for this new device. NOW, I could onboard the device. Apparently, it attempts to join the WIFI, connect to Internet, and connect to the cloud, and if anything fails, then everything fails, and the device appears to not even be found! That's terrible UI. Now for the kicker: one might assume that the device is really controlled through the cloud then, right? So after plugging in a light to test it, and confirming I could turn it on and off with my phone, I turned wifi off on my phone, and tried to control it via LTE. What's the latency that way? Infinite, as I don't think it can be controlled via the Internet. Yes, you can onboard it to Siri,Alexa,Google Home, and I imagine you can control it that way. The device needs Internet to onboard, but doesn't apparently use it. Firmware updates? Maybe. The onboarding fails in less than human reaction time, so I could never actually enable access for the device via any kind of UI! -- Michael Richardson <mcr+IETF(a)sandelman.ca> . o O ( IPv6 IøT consulting ) Sandelman Software Works Inc, Ottawa and Worldwide

1 0

To be published: Architectural Considerations for IoT Device Security in the Home
by Constanze Dietrich 01 Mar '21

01 Mar '21

Hi everyone! Since RIPE 81, the "BCOP" document was refined again and now declared DONE under the title: "Architectural Considerations for IoT Device Security in the Home" (document attached). The next step is making it an official RIPE document which requires consent from the members of the working group. (Note: If you're subscribed to the list, you're one of them!) *As in previous queries the response on the list was rather quiet, this time I'll take silence as "Sure! Go for it! Great work!".* *That said, I strongly encourage you to read it and post your comments to the list.* Have a nice weekend! Constanze

6 7

Open PhD Position in IoT
by sandoche Balakrichenan 08 Feb '21

08 Feb '21

Dear all, Thanks for diffusing the information in your circle: https://www.afnic.fr/fr/l-afnic-en-bref/recrutement/offres-d-emploi/open-ph… Sandoche.

1 0

January 2021
by Constanze Dietrich 03 Feb '21

03 Feb '21

Hi everyone! I bet I'm not the only one feeling like things aren't moving these days. However, looking back on what's crossed our way in January IoT-wise, maybe they are moving after all. ***** Don't forget to take the survey! https://docs.google.com/forms/d/e/1FAIpQLSdVVq38C96Mn_Lv8eDgiHGzt3TgzPfx_MM… ***** After that particularly graceful reminder, here's Sandoche's and my January collection of IoT-related online finds and recommendations: ***Articles*** A wristband that tells your boss if you are unhappy: https://www.bbc.com/news/business-55637328 A thing that would likely have that wristband alert your boss: https://www.vice.com/en/article/m7apnn/your-cock-is-mine-now-hacker-locks-i… 6 core capabilities an IoT device needs for basic cybersecurity: https://www.edn.com/6-core-capabilities-an-iot-device-needs-for-basic-cyber… ***Programs*** Are they actually going to put an S in IoT? /o\ https://csrc.nist.gov/news/2020/draft-guidance-for-defining-iot-cyber-requi… as part of the "NIST Cybersecurity for IoT Program": https://www.nist.gov/programs-projects/nist-cybersecurity-iot-program The TU Delft has an opening for a fully funded PhD position on Human factors in (IoT) security and security focused network measurement: https://www.tudelft.nl/over-tu-delft/werken-bij-tu-delft/vacatures/details/… Let us know if we missed anything! ;) Constanze

2 1

[Information] [MOOC Inria] Internet of Things with Microcontrollers: a hands-on course - Start: Feb. 1, 202
by sandoche Balakrichenan 29 Jan '21

29 Jan '21

If anyone is interested: -------- Forwarded Message -------- Subject: [iot-lab-users] [MOOC Inria] Internet of Things with Microcontrollers: a hands-on course - Start: Feb. 1, 202 Date: Fri, 29 Jan 2021 10:26:38 +0100 From: Nathalie Mitton <nathalie.mitton(a)inria.fr> Reply-To: Nathalie Mitton <nathalie.mitton(a)inria.fr> To: rsd-forum(a)groupes.renater.fr, users(a)iot-lab.info, iot(a)services.cnrs.fr, echange(a)min2rien.fr Internet of Things with Microcontrollers: a hands-on course Discover, program and experience the IoT through theory & activities using RIOT and the FIT IoT-LAB testbed. in english🇬🇧and french🇫🇷 [February 1 - March 31, 2021] This online courseprovides an introduction to the IoT and hands-on experience in programming connected objects. It offers theoretical inputs and practical activities using the RIOT OS and the FIT IoT-LAB testbed. Participating in this course does not require any specific hardware or software installation. The course is accessible to any *developer, engineer, student or maker* who has programming bases (C and/or Python or Bash) and prior knowledge of the Linux system (command lines). It is organized in 6 parts (modules) which allow to acquire knowledge on the hardware, software and communication protocols commonly used in IoT. You willprogressively put your theoretical learnings into practice by remotely programming the microcontrollers of the FIT IoT-LAB testbed. The course also includes a module dedicated to *securing connected objects*. Te MOOC consists of *6 modules* that combine videos, course texts, *19 quizzes and 20 hands-on programming activities *using Jupyter notebooks. Each participant will be able to : * remotely access the FIT IoT-LAB testbed from his or her computer, free of charge and without prior software installation, * discover IoT standards and test the RIOT operating system with the help of their designers and contributors, * develop, test and reuse IoT applications on other experimental platforms. *At the end of the course, each participant will be able to develop an IoT application from the object to the cloud.* Teachers The educational content was developed by engineers, researchers and teachers from CNRS, Hauts-de-FrancePolytechnic University, IMT Atlantique and Inria. Practical information * Course dates : February 1st - March 315, 2021 * Registration deadline : March 24, 2020 * Information & registration : https://www.fun-mooc.fr/courses/course-v1:inria+41020+session02/about <ttps://www.fun-mooc.fr/courses/course-v1:inria+41020+session02/about> The MOOC is produced by Inria Learning Lab <https://learninglab.inria.fr/> and runs on the FUN-mooc platform. Follow course news on Twitter: @InriaLearnLab #MoocIoT -- -- Sandoche BALAKRICHENAN Head of R&D Partnerships @ Afnic LoRaWAN Academia WG Chair & RIPE IoT WG Co-Chair

1 0

IoT WG Survey
by Constanze Dietrich 11 Jan '21

11 Jan '21

Hi everyone! First of all, I wish all of you and your loved ones a happy and healthy 2021! To kick off the new year in the IoT WG, Sandoche and I come at you with a little survey. As announced during the last RIPE Meeting, we'd like to get to know you, learn what you think of and expect from the Working Group, what you'd like to see us do as co-chairs, what RIPE- and IoT-related topics you're interested in,... feedback that may help us, for instance, get a feeling for what we should push for and what you've possibly seen enough of by now. While we use this survey as a tool to collect feedback beyond the bounds of the list, we intend to publish and discuss the results on the IoT WG mailing list. So as to not repeat myself any further, you'll find a little more information after clicking the link to the survey. :) https://docs.google.com/forms/d/e/1FAIpQLSdVVq38C96Mn_Lv8eDgiHGzt3TgzPfx_MM… Cheers and kind regards Constanze & Sandoche

1 0

A Haystack Full of Needles: Scalable Detection of IoT Devices in the Wild
by Mandalari, Anna Maria 13 Dec '20

13 Dec '20

Hi all, We have published an interesting work on consumer IoT devices detection at an ISP and IXP. You can find all the details at https://moniotrlab.ccis.neu.edu/imc20/ The paper will be presented at IMC 2020. I thought it can be interesting for you :) Cheers, -- Anna Maria Mandalari Research Associate Dyson School of Design Engineering Imperial College London https://www.imperial.ac.uk/people/anna-maria.mandalari

2 1

IoT device lifecycle work
by Eliot Lear 21 Nov '20

21 Nov '20

We authors continue to work on the IOT white paper we presented at the last meeting (see attached) and would like to address any comments you might have. One question we have is whether people would prefer access to the Google Doc to add comments or whether a Github issue tracker would be better. We hope to complete this document by the end of the year, so comments now would be very welcome. See attached. Eliot

1 0

Results of the survey made during the second today's presentation
by sandoche Balakrichenan 30 Oct '20

30 Oct '20

Dear all, Please find as attached the results of the survey conducted today during the presentation of "*Architectural Considerations for IoT Device Security in the Home. A guide for ISPs specifying CPE devices*" at RIPE 81 IoT WG slot today.

3 5

Re: [iot-wg] IoT BCOP TF Document - Call for comments
by e.vanuden＠avm.de 27 Oct '20

27 Oct '20

Hi Eliot, I´m refering to the Stacked Router concept, so one CPE instead of two (stacked) In this case, the CPE Best regards, Eric van Uden AVM ICT GmbH Country Manager Netherlands Mr. van Coothlaan 10 6602 GT Wijchen Nederland Phone +31 24 6485381 Mobile +31 622 948356 e.vanuden(a)avm.de Bezoek onze website op http://nl.avm.de/ , vind ons leuk op Facebook of bekijk onze Google +-pagina en Youtube-kanaal. AVM GmbH for International Communication Technology, Alt-Moabit 95, 10559 Berlin, Germany HRB 48220 AG Charlottenburg, CEO (Geschäftsführer): Johannes Nill Von: "Eliot Lear" <lear(a)ofcourseimright.com> An: e.vanuden(a)avm.de, "sandoche Balakrichenan" <sandoche.balakrichenan(a)afnic.fr> Kopie: iot-wg(a)ripe.net Datum: 26-10-2020 14:21 Betreff: Re: [iot-wg] IoT BCOP TF Document - Call for comments Hi Eric, On 26.10.20 14:18, Eric van Uden via iot-wg wrote: For me this means that IoT security should be implemented in as little as possible devices connection the consumer to the internet - one device if at all possible thus avoiding stacked router scenarios that add unnecessary complexity and possibly even more IoT security issues. Precisely which device would you expect that to be: The CPE or the IOT device? Eliot

3 3