- iot-wg - mailman.ripe.net

[iot-discussion] ENISA call for IoT Security Experts Group
by Marco Hogewoning 10 Mar '17

10 Mar '17

Dear colleagues, ENISA, the European Agency for Network and Information Security, is launching an IoT Security Experts Group with the objective to gather experts in the domains of the entire spectrum of Internet of Things to exchange viewpoints and ideas on cyber security threats, challenges and solutions. More information about this call for experts and the group is available via https://resilience.enisa.europa.eu/iot-security-experts-group-1 We also would welcome any thoughts or suggestions of how RIPE NCC can contribute to the field of IoT security, which remains one of the key concerns for all stakeholders involved. Groet, MarcoH RIPE NCC

1 0

[iot-discussion] European Parliament Public Consultation: "Civil Law Rules On Robotics"
by Marco Hogewoning 16 Feb '17

16 Feb '17

Dear Colleagues. The European Parliament is undertaking a public consultation that seeks views on how to best address the challenging ethical, economic, legal and social issues related to the developments in the area of robotics and AI for civil use. This consultation aims to seek input from both experts as well as the general public, so while maybe not very closely related to RIPE’s activities, we would encourage you to consider contributing to this debate. The consultation runs until April 2017 and the results are expected to be published in the autumn and will contribute to further European Parliament initiatives. The consultation as well as some further information can be accessed via https://opinio.secure.europarl.europa.eu/opinio/s?s=secured_robotics In relation to those other initiatives, you might also want to take note of the RIPE Labs posting by Eirann Leverett, which discusses the aspects of product liability and consumer protection that has also come into scope of the European Parliament. https://labs.ripe.net/Members/eireann_leverett/time-to-decide-on-internet-o… Regards, Marco Hogewoning -- External Relations - RIPE NCC

1 0

[iot-discussion] Bruce Schneier on IoT
by Shane Kerr 16 Feb '17

16 Feb '17

All, I found the following relatively insightful: https://www.schneier.com/crypto-gram/archives/2017/0215.html#1 Cheers, -- Shane

1 0

[iot-discussion] fwiw iot slide-ware fodder
by Richard Lamb 15 Dec '16

15 Dec '16

An animated slide ive been using for iot over the past few years. https://www.co.tt/files/iotslide.pptx I am not an artist but if useful, feel free to use. -Rick

3 3

[iot-discussion] Fwd: [cooperation-wg] IGF workshop on IoT - follow live
by Chris Buckridge 06 Dec '16

06 Dec '16

Apologies for duplicates - I imagine there’s a lot of overlap between this list and the Cooperation WG, but just in case… > Begin forwarded message: > > From: Chris Buckridge <chrisb(a)ripe.net> > Subject: [cooperation-wg] IGF workshop on IoT - follow live > Date: 6 December 2016 at 08:04:32 GMT-6 > To: RIPE Cooperation Working Group <cooperation-wg(a)ripe.net> > > Dear colleagues, > > In around one hour (15:00 UTC, Tuesday 6 December), the NRO is facilitating a workshop at the Internet Governance Forum on the Internet of Things. Entitled "The Network of Networked Things: Finding the Internet in IoT”, the session will discuss the impact of the IoT on existing standardisation and administrative bodies, as well as the needs and expectations of IoT end users. You can read more about the workshop at: > https://igf2016.sched.org/event/8hsh/ws170-the-network-of-networked-things-… > > You can follow the session live, and contribute via Webex here: > https://intgovforum.webex.com/mw3100/mywebex/default.do?service=1&siteurl=i… > > Or feel free to tweet thoughts and responses to @ripe_ncc, and we’ll follow them in the room. > > Any questions, please feel free to hit me up directly via email. > > Best regards, > Chris Buckridge > RIPE NCC > >

1 0

[iot-discussion] Remote exploit on CPE (somewhat related)
by Marco Hogewoning 01 Dec '16

01 Dec '16

Dear colleagues, First of all, I hope the relevant staff in operators is aware. I am pretty sure the bigger ones are, but if you have any (DSL) CPE in your network, please be aware of any unauthorised traffic or scanning towards TCP/7547 and consider dropping it. For information please refer to https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Atta… Of course this it not directly related to the Internet of Things, although of course these are things and they are connected to the Internet. And more importantly, again an example of device security not being 100%, which no doubt we will see amplified in the press and possibly the political space in calls for more security and regulation. What is even more interesting here is that the attack vector essentially is on the interface which allows for remote configuration and software management: TR-069. I can think of a million questions and countless what-if scenarios that end in a dark cold world with few blinking LEDs, but let’s try to stay on the positive side of things. Beyond warning the community and the operators about this vulnerability and urging them to patch the systems effected, what else is there for us or the RIPE community to do? We would need some help, also from people on this list, but would it be worth to see if we can write up a more constructive “lessons learned” article, one that maybe goes beyond this particular incident. If we could try and distribute this amongst IoT equipment manufacturers, maybe it does raise some attention. So far I’ve seem many articles and warnings about incidents and of course, also as recently posted to this list, there are a number of very high-level approaches on security and how to besg embed it in business process and product design. But apart from very detailed technical specs, I haven’t seen much around that sort of hovers along the middle: Here is a number of incidents that all seem to be rooted in the same mechanisms, together with some recommendations on how to fix this in a structured manners. One interesting detail on this one for instance is indeed the call to drop this traffic on borders, an approach that might work for this particular type of device and attack as TR-069 should be limited to the operator’s domain. But it also seems one that would be less effective or even impossible for an IoT device that is sold over the counter and needs the same management capabilities, only from "somewhere on the Internet” or more popular: “the Cloud”. Would there be space in RIPE to work on this and do you think there is work to be done on this and related items for our community? Regards, Marco Hogewoning -- External Relations - RIPE NCC

1 0

Re: [iot-discussion] iot-discussion Digest, Vol 1, Issue 5
by Corinne Cath 24 Nov '16

24 Nov '16

Thanks for sharing Gordon, and good question Shane.. I found the article a bit lacking in terms of a clear reason why regulation is *the* main way forward. It is not said that if you leave the regulation of IoT in the hands of several different goverments across the world that you get better security standards all-round. More likely, you will get certain jurisdictions that do a good job and others that don't. I also feel that the call for governments to take this up really opens the door to legitimizing the ongoing efforts at the ITU to make it the hub for IoT standard development. And looking at the recent discussions on Over the Top (OTT) services and DOA at the ITU-D WTSA meeting, I am not sure that is good solution. Rather, it would be great if we could find a way to look at soft law options and encourage the technical actors responsible for developing security considerations to take the importance of strong security for IoT on board, if only because if they don't people will lose trust in them and their stuff they build. And there I see a clear role for RIPE and its members. Happy to further discuss! Best, On Tue, Nov 22, 2016 at 11:00 AM, <iot-discussion-request(a)ripe.net> wrote: > Send iot-discussion mailing list submissions to > iot-discussion(a)ripe.net > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.ripe.net/mailman/listinfo/iot-discussion > or, via email, send a message with subject or body 'help' to > iot-discussion-request(a)ripe.net > > You can reach the person managing the list at > iot-discussion-owner(a)ripe.net > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of iot-discussion digest..." > > > Today's Topics: > > 1. Re: Regulating the IoT (Shane Kerr) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 22 Nov 2016 12:51:10 +0800 > From: Shane Kerr <shane(a)time-travellers.org> > To: Gordon Lennox <gordon.lennox.13(a)gmail.com> > Cc: iot-discussion(a)ripe.net > Subject: Re: [iot-discussion] Regulating the IoT > Message-ID: <20161122125110.47650945(a)pallas.home.time-travellers.org> > Content-Type: text/plain; charset="utf-8" > > Gordon, > > At 2016-11-18 14:10:52 +0100 > Gordon Lennox <gordon.lennox.13(a)gmail.com> wrote: > > > You can read Bruce Schneier?s take here: > > > > https://www.washingtonpost.com/posteverything/wp/2016/11/ > 03/your-wifi-connected-thermostat-can-take-down-the- > whole-internet-we-need-new-regulations/ > > > > And here: > > > > https://www.schneier.com/crypto-gram/archives/2016/1115.html > > He's not wrong. But is there a path to reasonable regulation? Can RIPE > help facilitate this in any way? > > Cheers, > > -- > Shane >

4 4

[iot-discussion] Regulating the IoT
by Gordon Lennox 24 Nov '16

24 Nov '16

You can read Bruce Schneier’s take here: https://www.washingtonpost.com/posteverything/wp/2016/11/03/your-wifi-conne… And here: https://www.schneier.com/crypto-gram/archives/2016/1115.html

3 3

[iot-discussion] Seeking Input: IGF workshop "Finding the Internet in IoT"
by Marco Hogewoning 23 Nov '16

23 Nov '16

[apologies for duplicates] Dear colleagues, As mentioned during our BoF, RIPE NCC is, together with some colleagues from other RIRs, organising an IoT workshop during the upcoming Internet Governance Forum in Guadalajara. The full title of this workshop is: "The Network of Networked Things: Finding the Internet in IoT”. With a broad panel of experts from several SDOs (IETF, IEEE), industry (GSMA) and Internet Governance area, we aim to address the following questions: - What are the needs of IoT vendors and operators in Internet governance and administration? - Can the existing structures of Internet governance, both technical and administrative, adapt to meet the needs of the IoT? - To what extent are openness and transparency important as Internet governance evolves to accommodate IoT? - Recognising that not all IoT applications rely on common open Internet standards, what are the benefits of an open model over the choice for proprietary technology, also in terms of security, interoperability and continuity of service? - What are the implications of widespread deployment of IoT for “the Internet as we know it”? We are happy to take your input on board for this workshop, both in additional questions or answers to the items above. We further would encourage people to attend this workshop, either in in person in Mexico or via the remote participations options that will be provided. The workshop is currently scheduled for “Day 1”, Tuesday December 6 from 09:00 - 10:30 local time, which would be 15:00 UTC. Regards, Marco Hogewoning -- External Relations - RIPE NCC

1 0

[iot-discussion] Pending report from Madrid
by Marco Hogewoning 22 Nov '16

22 Nov '16

Dear colleagues, As some of you have asked, we do still owe you a report of our session in Madrid. Apologies for the delay in that, as it turns out some of our records are still hiding in one of the flight cases. We’ll try and provide a more detailed record of the proceedings as soon as those files become available to us. Meanwhile, recapping the discussion the discussion at a very high level, one of the things flagged was the need for more information exchange and discussion. We hope that with the creation of this list, we have catered for this need. Another main item was the security threat and more important vendor behaviour towards providing adequate security on the individual devices and gadgets that make up the IoT. As several articles and documents posted to this list show, we seem not alone and those concerns play a role with many stakeholders. Now I don’t think or even expect we would have an immediate solution to this. Mentioned during the session was the need for more transparency or education of the end users. Again it seems we are not alone in this thinking and the idea of some “IoT trust label” have also been floated in other forums such as the AIOTI alliance. Finally I recall some comments being made towards the actual impact on “the Internet as we know it” and the infrastructure we collectively operate. Something that I also felt a bit coming back at some of the discussion at IETF last week and to which there does not seem a single overall view. Most seem to agree that the fundamental design of the Internet will not change dramatically, but as soon as it comes down to details it appears there could be changes on the horizon because of different demand for resources, concerns around scalability and of course security of both participating devices as well as the network itself. Regards, Marco Hogewoning -- External Relations - RIPE NCC

1 0