- iot-wg - mailman.ripe.net

[iot-discussion] Heads up for RIPE 74: Security BoF: On the Linkage Between Device and Infrastructure
by Marco Hogewoning 29 Mar '17

29 Mar '17

Dear colleagues, Happy to inform you that the PC has accepted our proposal to organise another BoF during RIPE 74 in Budapest. Unfortunately the exact time slot has not been decided yet, but we hope to get this cleared up in the coming weeks. Regardless, we can start our preparation for this and maybe already discuss some of the elements on this list. In this BoF we would like to focus on the relation between access providers, gateway devices (CPE) and IoT security. In particular the fact that often the provider is the sole entity who can quarantine or disconnect devices or networks that have been compromised (I am attaching the whole abstract below). The key questions we hope to address are: - Is there a role for the access provider in controlling/limiting access of compromised devices to the infrastructure? - Are there technical means to detect and contain devices that form a potential threat? - Would it be feasible to limit connectivity for such unsafe devices? - Are there feasible alternative means to mitigate the threat that these compromised devices form to our systems? I hope to run the BoF in a similar open fashion as the one in Madrid, with a minimum of slides and lots of time for a dialogue between the participants. But if you are doing relevant work or have an idea, I am open to suggestions for discussion starters or projects that would be relevant to the questions above. Hope to see you all in Budapest. Regards, Marco Hogewoning -- External Relations - RIPE NCC ***Security BoF: On the Linkage Between Device and Infrastructure*** Whatever the definition of the Internet of Things, one thing is for sure: the number of devices connected to the Internet is constantly growing. Even the traditional access markets continue to expand their number of end users and, importantly, the bandwidth available to them. As a follow-up to the RIPE 73 IoT BoF, we plan to explore the effects of this ever-expanding network in terms of infrastructure stability and security. Botnets, including the ones made up from relatively dumb devices such as the Mirai botnet, pose a substantial threat to the very infrastructure those devices depend on for their connectivity. Not only does the phenomenal growth in the number of poorly maintained devices increase the attack surface, but with more bandwidth available to them, the threat becomes even bigger. Can we prevent the Internet from collapsing under its own weight? Aside from the ongoing discussions on the need to secure these devices, with options ranging from capacity building to regulation, this BoF will explore the role of access providers in the ecosystem. As the natural gatekeepers between the local networks and the global infrastructure, what are their options to protect their own and other networks from these attacks? This BoF will tackle the following questions: - Is there a role for the access provider in controlling/limiting access of compromised devices to the infrastructure? - Are there technical means to detect and contain devices that form a potential threat? - Would it be feasible to limit connectivity for such unsafe devices? - Are there feasible alternative means to mitigate the threat that these compromised devices form to our systems?

1 0

[iot-discussion] Request to contribute to AIOTI survey on IoT indentifiers
by Marco Hogewoning 14 Mar '17

14 Mar '17

Dear colleagues, The RIPE NCC is a member of the the Alliance for Internet of Things Innovation (AIOTI). Its standardisation group (WG3) has established a task force to look at identifiers for use in the Internet of Things (IoT). One of the task force's work items is to collect information about any existing identification systems and standards that could be considered for application in IoT and investigate identification needs and requirements from IoT implementers. They have created a short survey to gather this information and asked us to invite the RIPE community to contribute. As both the requirements and options available will probably vary significantly between different IoT products and services, we don't think it's feasible to provide the task force with a consolidated response, as compiling such an answer to some extent would duplicate the work of the task force. Instead, we encourage RIPE community members who have a stake in IoT or associated identification mechanisms or standards to respond to the survey on an individual basis. The survey is available here: https://goo.gl/forms/vT22nR1ZEh13lfzi1 You are kindly requested to respond before 7 April. Please also see the attached message from Juergen Helles, Chair of the task force. As a member of AIOTI, we will continue to monitor and contribute to the work of AIOTI WG3 and this task force. Regards Marco Hogewoning RIPE NCC - External Relations > > > The Alliance for Internet of Things Innovation AIOTI (www.aioti.org) was initiated by the European Commission in 2015, with the aim to strengthen the dialogue and interaction among Internet of Things (IoT) players in Europe, and to contribute to the creation of a dynamic European IoT ecosystem to speed up the take up of IoT. Further objectives of the Alliance are fostering experimentation, replication, and deployment of IoT and supporting convergence and interoperability of IoT standards; gathering evidence on market obstacles for IoT deployment; and mapping and bridging global, EU, and member states' IoT innovation activities. > > AIOTI Working Group 03 is a focus of European engagement and steering in the IoT standardization process: > - Maintain a view on the landscape of IoT standards-relevant activities being driven by Standard Developing Organizations, Consortia, Alliances and Open Source Software projects > - Provide a forum for analysis, discussion and alignment of strategic, cross-domain, technical themes and shared concerns across landscape activities > - Develop recommendations and guidelines addressing those concerns > - Engage the IoT community in disseminating and promoting the results and steering emerging standards > Note that AIOTI will not develop standards itself but interact with standardization development organizations and consortia in order to initiate standardization activities. > > Identification plays an important role for IoT. In addition to the identification of the Things identification of other entities will be needed. Various identification schemes already exist, are standardized and deployed. A thorough analysis of the identification needs and related standardization for IoT is therefore needed. The AIOTI WG03 IoT Identifier task force was setup specifically to > - Evaluate identification needs for IoT and related requirements > - Collect existing identification standards and ongoing standardization work and elaborate their applicability for IoT. > The results of these activities will be published in a public report on IoT Identifiers. > > The task force has setup a online survey in order to collect input for the above task. > > IoT Identifier Survey (https://goo.gl/forms/vT22nR1ZEh13lfzi1) > > We are asking RIPE Community to provide feedback to the survey until Friday April 7th 2017. > > Please also feel free to distribute this survey request to your members for their individual feedback to the survey. > > Please note, that the information that you provide will be anonymized, i.e. there will be no reference to your specific contribution to the survey in the public report. Still you can request to be listed in the report as a contributor to the survey without reference to your specific contribution. > A pdf file with the survey questions is attached for your information, but please use the only survey (see link above) for your feedback. > > In case you have questions on the survey don’t hesitate to contact the co-chair of the AITOI WG3 IoT Identifier task force (juergen.heiles(a)siemens.com, henri.barthel(a)gs1.org) > > > Best Regards > > Juergen Heiles, AIOTI WG3 IoT Identifier task force co-chair

1 0

[iot-discussion] ENISA call for IoT Security Experts Group
by Marco Hogewoning 10 Mar '17

10 Mar '17

Dear colleagues, ENISA, the European Agency for Network and Information Security, is launching an IoT Security Experts Group with the objective to gather experts in the domains of the entire spectrum of Internet of Things to exchange viewpoints and ideas on cyber security threats, challenges and solutions. More information about this call for experts and the group is available via https://resilience.enisa.europa.eu/iot-security-experts-group-1 We also would welcome any thoughts or suggestions of how RIPE NCC can contribute to the field of IoT security, which remains one of the key concerns for all stakeholders involved. Groet, MarcoH RIPE NCC

1 0

[iot-discussion] European Parliament Public Consultation: "Civil Law Rules On Robotics"
by Marco Hogewoning 16 Feb '17

16 Feb '17

Dear Colleagues. The European Parliament is undertaking a public consultation that seeks views on how to best address the challenging ethical, economic, legal and social issues related to the developments in the area of robotics and AI for civil use. This consultation aims to seek input from both experts as well as the general public, so while maybe not very closely related to RIPE’s activities, we would encourage you to consider contributing to this debate. The consultation runs until April 2017 and the results are expected to be published in the autumn and will contribute to further European Parliament initiatives. The consultation as well as some further information can be accessed via https://opinio.secure.europarl.europa.eu/opinio/s?s=secured_robotics In relation to those other initiatives, you might also want to take note of the RIPE Labs posting by Eirann Leverett, which discusses the aspects of product liability and consumer protection that has also come into scope of the European Parliament. https://labs.ripe.net/Members/eireann_leverett/time-to-decide-on-internet-o… Regards, Marco Hogewoning -- External Relations - RIPE NCC

1 0

[iot-discussion] Bruce Schneier on IoT
by Shane Kerr 16 Feb '17

16 Feb '17

All, I found the following relatively insightful: https://www.schneier.com/crypto-gram/archives/2017/0215.html#1 Cheers, -- Shane

1 0

[iot-discussion] fwiw iot slide-ware fodder
by Richard Lamb 15 Dec '16

15 Dec '16

An animated slide ive been using for iot over the past few years. https://www.co.tt/files/iotslide.pptx I am not an artist but if useful, feel free to use. -Rick

3 3

[iot-discussion] Fwd: [cooperation-wg] IGF workshop on IoT - follow live
by Chris Buckridge 06 Dec '16

06 Dec '16

Apologies for duplicates - I imagine there’s a lot of overlap between this list and the Cooperation WG, but just in case… > Begin forwarded message: > > From: Chris Buckridge <chrisb(a)ripe.net> > Subject: [cooperation-wg] IGF workshop on IoT - follow live > Date: 6 December 2016 at 08:04:32 GMT-6 > To: RIPE Cooperation Working Group <cooperation-wg(a)ripe.net> > > Dear colleagues, > > In around one hour (15:00 UTC, Tuesday 6 December), the NRO is facilitating a workshop at the Internet Governance Forum on the Internet of Things. Entitled "The Network of Networked Things: Finding the Internet in IoT”, the session will discuss the impact of the IoT on existing standardisation and administrative bodies, as well as the needs and expectations of IoT end users. You can read more about the workshop at: > https://igf2016.sched.org/event/8hsh/ws170-the-network-of-networked-things-… > > You can follow the session live, and contribute via Webex here: > https://intgovforum.webex.com/mw3100/mywebex/default.do?service=1&siteurl=i… > > Or feel free to tweet thoughts and responses to @ripe_ncc, and we’ll follow them in the room. > > Any questions, please feel free to hit me up directly via email. > > Best regards, > Chris Buckridge > RIPE NCC > >

1 0

[iot-discussion] Remote exploit on CPE (somewhat related)
by Marco Hogewoning 01 Dec '16

01 Dec '16

Dear colleagues, First of all, I hope the relevant staff in operators is aware. I am pretty sure the bigger ones are, but if you have any (DSL) CPE in your network, please be aware of any unauthorised traffic or scanning towards TCP/7547 and consider dropping it. For information please refer to https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Atta… Of course this it not directly related to the Internet of Things, although of course these are things and they are connected to the Internet. And more importantly, again an example of device security not being 100%, which no doubt we will see amplified in the press and possibly the political space in calls for more security and regulation. What is even more interesting here is that the attack vector essentially is on the interface which allows for remote configuration and software management: TR-069. I can think of a million questions and countless what-if scenarios that end in a dark cold world with few blinking LEDs, but let’s try to stay on the positive side of things. Beyond warning the community and the operators about this vulnerability and urging them to patch the systems effected, what else is there for us or the RIPE community to do? We would need some help, also from people on this list, but would it be worth to see if we can write up a more constructive “lessons learned” article, one that maybe goes beyond this particular incident. If we could try and distribute this amongst IoT equipment manufacturers, maybe it does raise some attention. So far I’ve seem many articles and warnings about incidents and of course, also as recently posted to this list, there are a number of very high-level approaches on security and how to besg embed it in business process and product design. But apart from very detailed technical specs, I haven’t seen much around that sort of hovers along the middle: Here is a number of incidents that all seem to be rooted in the same mechanisms, together with some recommendations on how to fix this in a structured manners. One interesting detail on this one for instance is indeed the call to drop this traffic on borders, an approach that might work for this particular type of device and attack as TR-069 should be limited to the operator’s domain. But it also seems one that would be less effective or even impossible for an IoT device that is sold over the counter and needs the same management capabilities, only from "somewhere on the Internet” or more popular: “the Cloud”. Would there be space in RIPE to work on this and do you think there is work to be done on this and related items for our community? Regards, Marco Hogewoning -- External Relations - RIPE NCC

1 0

Re: [iot-discussion] iot-discussion Digest, Vol 1, Issue 5
by Corinne Cath 24 Nov '16

24 Nov '16

Thanks for sharing Gordon, and good question Shane.. I found the article a bit lacking in terms of a clear reason why regulation is *the* main way forward. It is not said that if you leave the regulation of IoT in the hands of several different goverments across the world that you get better security standards all-round. More likely, you will get certain jurisdictions that do a good job and others that don't. I also feel that the call for governments to take this up really opens the door to legitimizing the ongoing efforts at the ITU to make it the hub for IoT standard development. And looking at the recent discussions on Over the Top (OTT) services and DOA at the ITU-D WTSA meeting, I am not sure that is good solution. Rather, it would be great if we could find a way to look at soft law options and encourage the technical actors responsible for developing security considerations to take the importance of strong security for IoT on board, if only because if they don't people will lose trust in them and their stuff they build. And there I see a clear role for RIPE and its members. Happy to further discuss! Best, On Tue, Nov 22, 2016 at 11:00 AM, <iot-discussion-request(a)ripe.net> wrote: > Send iot-discussion mailing list submissions to > iot-discussion(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/iot-discussion > or, via email, send a message with subject or body 'help' to > iot-discussion-request(a)ripe.net > > You can reach the person managing the list at > iot-discussion-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of iot-discussion digest..." > > > Today's Topics: > > 1. Re: Regulating the IoT (Shane Kerr) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 22 Nov 2016 12:51:10 +0800 > From: Shane Kerr <shane(a)time-travellers.org> > To: Gordon Lennox <gordon.lennox.13(a)gmail.com> > Cc: iot-discussion(a)ripe.net > Subject: Re: [iot-discussion] Regulating the IoT > Message-ID: <20161122125110.47650945(a)pallas.home.time-travellers.org> > Content-Type: text/plain; charset="utf-8" > > Gordon, > > At 2016-11-18 14:10:52 +0100 > Gordon Lennox <gordon.lennox.13(a)gmail.com> wrote: > > > You can read Bruce Schneier?s take here: > > > > https://www.washingtonpost.com/posteverything/wp/2016/11/ > 03/your-wifi-connected-thermostat-can-take-down-the- > whole-internet-we-need-new-regulations/ > > > > And here: > > > > https://www.schneier.com/crypto-gram/archives/2016/1115.html > > He's not wrong. But is there a path to reasonable regulation? Can RIPE > help facilitate this in any way? > > Cheers, > > -- > Shane >

4 4

[iot-discussion] Regulating the IoT
by Gordon Lennox 24 Nov '16

24 Nov '16

You can read Bruce Schneier’s take here: https://www.washingtonpost.com/posteverything/wp/2016/11/03/your-wifi-conne… And here: https://www.schneier.com/crypto-gram/archives/2016/1115.html

3 3