Dear all, Thanks for reviewing the minutes below and providing your feedback, if any. It will be soon published in the website. Thanks to Marco for drafting the minutes. ---- **** ------- Minutes of the RIPE 79 IoT Working Group Date: 17 October 2019 Chairs: Sandoche Balakrichenan and Jim Reid Scribe: Marco Hogewoning (RIPE NCC) 1. Administrivia The chairs opened the session and introduced the agenda, then continued to introduce the first speaker. 2. The Security Lifecycle of an IoT Device Michael Richardson (Sandelman Software Works) Presentation available at:https://ripe79.ripe.net/archives/video/252 Michael, together with Eliot Lear (Cisco) presented on the different standards and mechanisms that exist to manage the security of IoT devices throughout their lifetime. Eliot also engaged in a short demo regarding a connected printer. Jelte Jansen (SIDN) asked whether there was room for third parties to warn the system about vulnerabilities in a particular device, such as the proposed DOTS “call home†signal. Michael answered that such an approach would involve some challenges regarding who to trust, taking into account deliberate actions to disconnect a competitor or other forms of “digital vandalism.†Alain Durand (ICANN) commented on the complexity of the system, pointing out the many moving parts, and noted that the home environment is a difficult place to protect. Eliot engaged in a small poll with the audience, asking them who believed that there is a role for the ISP to play in protecting the consumer. Whilst Malcom Hutty (LINX) commented the question was too binary, a quick show of hands revealed that although many supported the statement, there wasn’t a clear majority. Eliot further shared his vision of this process being step-by-step, with a gradual implementation to provide agents with the necessary details and asking informative questions to the consumer such as: “should I notify the manufacturer about this problem.†Michael shared an anecdote about insurance and the use of online “smart†locks. Malcolm Hutty in his role as consumer stated that the proposed model centered around the fact that the service provider knows best. Although this might work for the majority of consumers, it doesn’t for him as he doesn’t necessarily trust his provider and likes to tinker with the settings himself. Michael in response laid out a system where various MUD configuration files could work in unison and part of the information could even be crowdsourced. Benedikt Stockebrand (Stepladder IT) sought some clarifications on the type of device that could implement the proposed model. Michael clarified this was meant to run on the CPE and provided some details on the inner workings of the protocols. Peter Steinhäuser (embeDD Gmbh) asked how much adoption there was, suggesting that more clarity regarding the liability for vulnerabilities could act as a driver for adoption. Eliot responded that a number of their enterprise systems had support for MUD and he knew several other companies were testing with it, confirming one of them even discovered a bug in the implementation. But he agreed that this still needed a push in the consumer market and adoption there might take a while. Eric van Uden asked if the proposed model was planning to make use of TR69 to control the CPE. Eliot confirmed that one of the parties testing had been CableLabs and they intent to use TR69 or equivalent models to provision the system. After Eliot’s demonstration, Kai Storbeck (XS4ALL) asked if the system had any assurances with regards to compatibility or conformity, to which Eliot responded that people can always lie but it would be discovered. 3. Information Exposure from Consumer IoT Devices: A Multidimensional Network-Informed Approach Anna Maria Mandalari, Imperial College London Presentation available at:https://ripe79.ripe.net/archives/video/257/ Anna Maria presented on her study with a laboratory setup to discover IoT device behavior in regular domestic use. Marco Hogewoning (RIPE NCC) asked for clarification regarding the use of MAC addresses and Anna Maria confirmed that they are regularly seen in unencrypted payload as a form of device identification. Jim Reid (RTFM llp) asked if there was any intention to publish a “name and shame list†and whether any of the devices was observed using DNS-over-HTTPs (DoH). Anna Maria responded it was a good idea and they were considering publishing some sort of classifier or ranking system to indicate a device’s performance. She said that DoH was not seen in the test network. Jan Zorz (ISOC) offered to run the code in his own home environment to learn more. 4. Update on the IoT Hackathon Rotterdam 2019 Constanze Dietrich, LEXTA Consultants Group Presentation available at:https://ripe79.ripe.net/archives/video/259/ Constanze presented about the experiences and outcomes of the RIPE NCC IoT Hackathon that she helped to organise in the weekend ahead of the RIPE meeting. Jim Reid thanked the organising team, complementing them on the results. 5. Best Current Operational Practice (BCOP) Document in RIPE Scope for Proactively Mitigating IoT Attacks Jim Reid, RTFM llp Presentation available at:https://ripe79.ripe.net/archives/video/261/ Jim, making reference to earlier discussions in the community about creating a document, polled the room if there was still interest. When asked, several people in the room indicated they would be available to help out as volunteers. Sandoche thanked all the participants and closed the meeting.