- iot-wg - mailman.ripe.net

Fwd: interesting article?
by sandoche Balakrichenan 19 Aug '20

19 Aug '20

Dear all, Vesna (RIPE) send us this document (https://www.cigionline.org/publications/standards-cybersecure-iot-devices-w…) to check if it could be interesting for the group. After skimming through it, I felt that the document could be useful, even though the contents are not entirely new AFAIK. Sandoche.

2 2

[Defcon 2020] Paul Marrapeses' speech about IoT P2P protocol design flaws
by Peter Steinhäuser 10 Aug '20

10 Aug '20

Dear Collegues, Paul Marrapese did some excellent work on researching about protocol vulnarabilities in popular IoT devices. https://www.youtube.com/watch?v=Z_gKEF76oMM Unfortunately I did not find a transcript, yet. Nevertheless the conclusion is to keep IoT devices disabled to communicate with the internet if possible and it also shows - again - the lack of interest from the device makers to adress the security flaws. Wishing you all a productive week and stay healthy. - Peter

2 1

"Nutrition labels for IoT"
by Vesna Manojlovic 11 Jul '20

11 Jul '20

from: https://pluralistic.net/2020/06/09/war-crimes/#iot Nutrition labels for IoT A group of CMU researchers just presented "What Should Be on an IoT Privacy and Security Label?" at the IEEE Symposium on Security & Privacy. They present a model for "privacy labels" to clarify the privacy implications of IoT gadgets. https://www.computer.org/csdl/proceedings-article/sp/2020/349700a771/1j2LfT… I confess that I was skeptical of this, but the labels themselves are *really* good, clear and legible. https://www.wired.com/story/iot-security-privacy-labels/ But...The more I think about this, the more my skepticism returns. We've seen tools like Privacy Badger and Ghostery that tell you how your data is being used by the websites you visit, but these haven't shown much efficacy in changing sites' behaviors. Historically, the best counter to these "antifeatures" in technology has come from a) self-help measures and b) regulation. We didn't kill pop-up ads by notifying users of which sites had pop-up ads so they could choose to go elsewhere. We gave them pop-up blockers. Today, the best way to deal with your alarm about Privacy Badger warnings is to beef up your script-, tracker- and ad-blocking. https://www.eff.org/deeplinks/2019/07/adblocking-how-about-nah And there's a role for regulation here, too, which can take many forms. We can simply prohibit certain conduct, like collecting, retaining or selling data outside of a highly constrained set of circumstances. Or we could establish a federal privacy law with a private right of action, so users could sue companies that leaked their data and collect statutory damages - a measure that would cause every insurer to instantaneously withdraw coverage for every surveillance tech company. Don't get me wrong. I love these labels. But there is a huge danger in documenting bad conduct without providing a means to counter it - the danger that you train people to accept the bad conduct as inevitable.

2 1

Paper Invitation: [Sensors] IF 3.031—Special Issue "Monitoring of Security Properties in IoT and Emerging Technologies"
by Callie Liu 17 Jun '20

17 Jun '20

Dear Colleagues, The journal Sensors (ISSN 1424-8220, IF 3.031) is currently running a Special Issue entitled "Monitoring of Security Properties in IoT and Emerging Technologies". Dr. Antonio Muñoz (Universidad de Málaga, Spain), Prof. Dr. Eduardo B. Fernandez (Florida Atlantic University, USA) and Prof. Dr. Haris Mouratidis (University of Brighton, UK) are serving as Guest Editors for this issue. We think you could make an excellent contribution based on your expertise. The recent advances in technologies such as cloud computing, IoT, edge computing, and fog computing are transforming the way in which large-scale computations are performed. This has introduced improvements in terms of scalability for clouds, and in terms of permanent connection and user-centric computation for IoT, edge, and pervasive computing. However, the incursion of these technologies entails the introduction of new challenges regarding security and privacy. Monitoring of security properties in each of these technologies implies tailoring solutions according to particular features of baseline technology. [...] For further reading, please follow the link to the Special Issue Website at: https://www.mdpi.com/si/sensors/MSP_IoTET The submission deadline is 31 August 2020. You may send your manuscript now or up until the deadline. Submitted papers should not be under consideration for publication elsewhere. We also encourage authors to send a short abstract or tentative title to the Editorial Office in advance (callie.liu(a)mdpi.com or sensors(a)mdpi.com). Sensors is covered by leading indexing services, including the Science Citation Index Expanded (Web of Science), PubMed/MEDLINE, Scopus, Chemical Abstracts, INSPEC, and CAB Abstracts. The latest Impact Factor for the year 2018 is 3.031, and the five-year Impact Factor is 3.302. Sensors is fully open access. Open access (unlimited and free access by readers) increases publicity and promotes more frequent citations, as indicated by several studies. Open access is supported by the authors and their institutes. An Article Processing Charge (APC) of CHF 1800 currently applies to all accepted papers (APC: CHF 2000 from 1 January 2020 onwards). You may be entitled to a discount if you have previously received a discount code or if your institute is participating in the MDPI Institutional Open Access Program (IOAP), for more information see: http://www.mdpi.com/about/ioap. For further details on the submission process, please see the instructions for authors at the journal website (http://www.mdpi.com/journal/sensors/instructions). We look forward to hearing from you. Kind regards, Ms. Callie Liu Assistant Editor Sensors (ISSN 1424-8220; http://www.mdpi.com/journal/sensors) is a journal published by MDPI, Basel, Switzerland. Sensors maintains rigorous peer-review and a rapid publication process. All articles are published with a CC BY 4.0 license. For more information on the CC BY license, please see: http://creativecommons.org To submit to the journal click here: http://susy.mdpi.com/user/manuscripts/upload?journal=sensors. Unsubscribe: http://www.mdpi.com/unsub/managesubscriptions/mail/ZnJhbmNlc2NvLm1vc2NhdG9A…. Manage your subscriptions: https://susy.mdpi.com/user/subscriptions. MDPI http://www.mdpi.com/ St. Alban-Anlage 66 4052 Basel Switzerland Tel. +41 61 683 77 34 Fax +41 61 302 89 18 Disclaimer: MDPI recognizes the importance of data privacy and protection. We treat personal data in line with the General Data Protection Regulation (GDPR) and with what the community expects of us. The information contained in this message is confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this message in error, please notify me and delete this message from your system. You may not copy this message in its entirety or in part, or disclose its contents to anyone.

1 0

Paper Invitation: [Sensors] IF 3.031— Special Issue "Smart, Autonomous and Evolved Technologies in Internet of Things"
by Callie Liu 17 Jun '20

17 Jun '20

Dear Colleagues, The open access journal Sensors (ISSN 1424-8220, IF 3.031) is pleased to announce a new Special Issue entitled "Smart, Autonomous and Evolved Technologies in Internet of Things". Dr. Tuan Nguyen Gia is serving as Guest Editors for this issue. The submission deadline is 31 October 2020 and papers may be submitted immediately or at any point until 31 October 2020, as papers will be published on an ongoing basis. For more information on this Special Issue and submission guidelines, please visit the following page: https://www.mdpi.com/journal/sensors/special_issues/SAET_IoT. Kind regards, Callie Liu Assistant Editor Sensors is fully open access. Manuscripts are peer-reviewed and a first decision provided to authors approximately 17.85 days after submission. An Article Processing Charge (APC) of CHF 2000 currently applies to all accepted papers. To submit to the journal click here: http://susy.mdpi.com/user/manuscripts/upload?journal=sensors. Unsubscribe: http://www.mdpi.com/unsub/managesubscriptions/mail/Y2FsbGllLmxpdUBtZHBpLmNv…. Manage your subscriptions: https://susy.mdpi.com/user/subscriptions. MDPI http://www.mdpi.com/ St. Alban-Anlage 66 4052 Basel Switzerland Tel. +41 61 683 77 34 Fax +41 61 302 89 18 Disclaimer: MDPI recognizes the importance of data privacy and protection. We treat personal data in line with the General Data Protection Regulation (GDPR) and with what the community expects of us. The information contained in this message is confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this message in error, please notify me and delete this message from your system. You may not copy this message in its entirety or in part, or disclose its contents to anyone.

1 0

Draft RIPE 80 IoT WG Minutes
by sandoche Balakrichenan 04 Jun '20

04 Jun '20

Dear all, Below is the DRAFT minutes received from RIPE. Thanks for providing us the comments on the draft before 14/06/2020. The plan is to publish the minutes on the website in two weeks period. ---- **** ------- ** *1) Administrivia * This presentation is available here: https://ripe80.ripe.net/presentations/34-RIPE-80-IoT-WG.pdf There were no changes to the agenda. The minutes from RIPE 79 were approved. It was noted that at RIPE 79, a group of volunteers had formed to develop on an outline document ona RIPE scope for proactively mitigating IoT attacks. They werecurrently working on a draft and would share this on the mailing list. *2) WG co-chair appointment* Jim Reid The presentation is available here: https://ripe80.ripe.net/archives/video/367/ Jim said his term as WG co-chair was ending and there were twoexcellent candidatesto replace him.However, as they had both received equal support, there was no clear consensus on who should be chosen. According to the WG’s selection process, if consensus was not able to be reached, the RIPE Chair would make this decision. Hans Petter Holen, RIPE Chair, said he would review the mailing list and announce his decision in the closing plenary. Jim thanked both candidates for standing and said he was sure either of them would do a great job. Benedikt Stockebrand, Stepladder IT, suggested theyconsiderhavingthree chairs. Jim said the view of both Sandoche and himself was that the workload was not enough to justify this. However, if the WG wanted to have three chairs, it could update the selection process to allow for a third chair. *3) RIPE NCC IoT Update * Marco Hogewoning, RIPE NCC This presentation is available here: https://ripe80.ripe.net/presentations/23-RIPE80-IoT-WG_comms.pdf Luna, no affiliation, asked if one’s voice used for Google Assistant, Siri and Alexa was searchable and whetherthis would be considered Personal Identifying Information (PII) in the future. Marco saidthis was still uncertain. Jim added that “PII”was an American legal term; the official term used in the European region was“Personal Data”. Jim asked whathad been happening at the ITU regarding IoT. Marco Hogewoning said there were several topics under discussion:the NewIP proposal(which might have its own component in IoT), some attempts at standardising incident and accident reporting, and some developments in authorisation and authentication methodology based on blockchain. *4) Preparing SMEs for IoT Security Standards and Regulation* Stacie Hoffman, Oxford Information Labs This presentation is available here: https://ripe80.ripe.net/presentations/44-RIPE80_Hoffmann.pdf Paul Rendek, DSTREAM GROUP, asked how theywere planning to reach out to small and medium enterprises. Stacie said they would carry out a marketing campaignand they were working with a company to build a strategy for this. Theywerealso using their own network of contacts in the IoT Security Foundation and innovation centers. Stacie said if anyone in the audience knewof networks that would like to contribute, they would be open to this. Blake Willis, iBrowse, asked if they were planning to use conformity logos and stamps. Stacie replied that they were not working on this specifically, but there was another workstream thatwas developing an IoT security compliance framework. Paul asked if links to this material could be sent tothe IoT Working Group when it was available. Paul Steinhäuser, embeDD GmbH, asked how the vulnerability informationwould be used. Stacie said the platform was meant to be a way to report vulnerabilities to a company and for the company to communicate with the reporterto solve it. For now, there were no plans to use this information beyond the platform. *5) AOB * There were no AOBs. End of session.

1 0

government grants for consumer IoT device assurance
by Jim Reid 01 Jun '20

01 Jun '20

The UK government has just launched a grant programme to support the development of industry-led assurance schemes for consumer IoT security. Further details and the application paperwork can be found here: https://www.gov.uk/government/publications/grant-programme-for-consumer-iot… Grants of up to GBP170k (EUR200k) are on offer. The closing date for applications is June 30th and any grant funding needs to be spent by the end of March next year. Applicants will be informed whether or not they have been successful by the end of July 2020. Individual grant agreements are expected to be finalised by August 2020. AFAICT, anyone is welcome to apply for a grant provided they can deliver the intended grant objectives in the UK, the majority of products assessed by the assurance scheme are intended for the UK market and the IOT device assurance scheme is based on the UK Code of Practice for Consumer IoT Security and/or Final Draft EN 303 645 v2.1.0. If anyone wants further information please contact DCMS, the relevant government department. And FWIW I've no available bandwidth this month to participate in a bid and probably won’t have the time to take part in a proposal that did get funding.

1 0

Co-chair
by Phil Stanhope 14 May '20

14 May '20

I would like to support Peter for co-chair. Phil Stanhope -- -phil (@phone)

1 0

[Info] RIPE 80 IoT WG Virtual meeting tomorrow
by sandoche Balakrichenan 13 May '20

13 May '20

Dear Colleagues, The IoT remote session will take place tomorrow, 14 May, 14:00-14:30. The agenda : https://ripe80.ripe.net/programme/meeting-plan/iot-wg/ More information on how to participate -https://ripe80.ripe.net/attend/how-to-participate/ <https://ripe80.ripe.net/attend/how-to-participate/> ------------------------- During the session ------------------------- - Questions: Always write NAME and AFFILIATION and keep the question short. -- Zoom: Questions for the presenters should be made only in the Q&A window -- If you don't like Zoom you can use the IRC channel on the live streaming page on RIPE 80 : https://ripe80.ripe.net/live/main -- Zoom chat window is only for discussion -- In Zoom Chat: always select ‘PANELISTS AND ATTENDEES’ otherwise only panelists will see the message - The sessions are recorded and will be published on the RIPE 80 website archives - If you need Live transcription, https://ripe80.ripe.net/live/steno Jim and Sandoche.

1 0

Support Constanze Dietrich for co-chair
by Nigel Titley 13 May '20

13 May '20

I would like to support Constanze for co-chair Nigel Titley

2 1