Ask Slashdot: Is My IoT Device Part of a Botnet?

As our DVRs, cameras, and routers join the Internet of Things, long-time Slashdot reader galgon wonders if he's already been compromised: There has been a number of stories of IoT devices becoming part of botnets and being used in distributed denial of service attacks. If these devices are seemingly working correctly to the user, how would they ever know the device was compromised? Is there anything the average user can do to detect when they have a misbehaving device on their network?
I'm curious how many Slashdot readers are even using IoT devices -- so leave your best answers in the comments. How would you know if your IoT device is part of a botnet?

Comments

How do you know?

[Pikoro]

If it's connected to the internet directly, and it has no built in security apart from "admin" "password", it's part of a botnet or soon will be.

Re:How do you know?

[JaredOfEuropa]

Especially if that password
- Is a default password that is the same for every device sold (these days a lot of equipment ships with unique random passwords)
- Isn't changed by the user during setup
- Can't be changed by the user. (What the hell, OpenElec?)

Re:How do you know?

[Z00L00K]

If it needs to connect to a subscription service outside your home it has the potential to become part of a bot net.

Can you trust your thermostat to not browse your files?

Re:How do you know?

[jeffmeden]

Recommendations? Take the C7 and install OpenWRT on it. Super easy to use, reliable, and capable of any firewalling you can dream up (including on IPv6). Plus then you have a nice graph to tell you how much bandwidth is in use and by which device. If you have a botnet participant in your network it will be obvious.

Re:How do you know?

[Shoten]

Openelec's entire file system is read only. Given the difficulty of installing something to the image when you want to, the potential for it to be easily and automatically owned by is very low.

This is not a real thing...a device whose total storage capacity is read-only. Let's look at why.

One: if it's all read-only, it can't have a variable password...accounts and passwords need to be hardcoded, because there's no way to store new or changed account information.

Two: if it's at all configurable, you have the same problem: where do you store the configs?

Three: guess what else you can't have if your file system is read-only? Software updates.

Four: let's call a spade a spade here. A more accurate way to make the claim...regardless of how infeasible it would be for any device of significant functionality...is to say this: "Openelec's entire file system is meant to be read only." An innate characteristic of most security flaws is that they permit something that is not intended. It's important to not assume that intended functionality is inevitable and invulnerable. And in this case, that "read only" capability is nothing more than Linux permissions...it's not that the OS invariably is incapable of granting write permissions. In fact, all kinds of things are writing to the file system, I would bet...information about drive mounting, accounts, etc. The file system is not inherently read only.

Assuming that system behavior when used in its intended fashion is also what happens when someone breaks the rules is the root of most security failures.

And now, a citation, called "squashfs howto - make changes the read-only filesystem in OpenELEC"

https://sites.google.com/site/...

The "average" consumer? Of course not.

[Anonymous Coward]

The "average" user has no idea and that's why they put IOT shit on their unsecured network in the first place, duh.

Finally a counter example

[Enter the Shoggoth]

Is this the long sought after counter-example to Betteridge's Law where the response to a question mark is always "yes" ?

Limit their bandwidth?

[wildstoo]

Probably beyond the abilities of Joe Average, but you could use your router/firewall/whatever to limit the bandwidth of IoT devices on your network.

Most IoT devices seem to use very little bandwidth by design - they just send and receive simple status updates and commands - and they would be of much less value to a botnet operator if they were limited to, say, 5kbps.

Re:Am A Noob Too

[cfalcon]

> Keep routers and access points separate...
> low power atom device to run something like pfsense
> cheap managed switch
> wireless ap as a dumb bridge
> Create separate VLANs

Once you're done making this server room you describe, you'll be in the .0000001% of people qualified to run an IoT device, many of which are BORN malicious and sending pictures of your bedroom/front lawn/children to a central server in China, a decent number of which are fundamentally insecure with no possible way to change passwords or a default password they forgot (or "forgot") to strip out that you can't fix, and at least some of which will fail to work on a VLAN that can only see the outside internet (for some goddamned reason, they want to ping a router or something).

The short version is this: If you want your IoT devices to not be part of a botnet, DO NOT BUY ANY. Once you buy those components, you have to set them up. Then configure them. Then maintain them. And almost no one will jump through any of those hoops.

Re:The "average" consumer? Of course not.

[jandersen]

The "average" user has no idea and that's why they put IOT shit on their unsecured network in the first place, duh.

The average user has no idea that there is something like "IoT" and that it is in any way different from the rest of "the internet". All they know is that it is "smart" to have an app on your phone that can turn on the heating and tell you the fridge is empty, and a TV that seems to understand what you want to watch, or a smart meter that tells you (and the utility company) how much gas and electricity you use up to the last minute. They won't know or care about the security implications until it goes badly wrong.

Re:log files

[nukenerd]

If a person is intelligent enough to perceive the need for a device, obtain the device and install the device

They will perceive the "need" when a salesman or ad persuades them that they need it. They do not even need to be aware that the device will be part of the IoT, only that they "need" a toaster or whatever.

They will obtain the device by pulling out their wallet. (Soon it will become impossible to obtain anything else.)

They will install it by plugging it in (have you never installed a toaster before?).

I don't know where you think intelligence comes into it.

Re:Am A Noob Too

[MMC Monster]

Dude, I'm not a network technician but I've been putting computers together since the late 80s and have been running Linux OSs as my desktop OS for over a decade now...

And I couldn't set up the network you described without some serious googling.

How are we supposed to expect normal people to do it? Do routers come with VLAN set up out of the box, jailed so that it doesn't send data out of your network? Somehow I doubt it.

Normal people are screwed, until routers are set up to manage IoT networks by default.

And let's be real: Normal people aren't going to buy a separate access point if their router has Wifi built in.

Re:Am A Noob Too

[vtcodger]

"Think a non-network engineer can do or wants to do any of that stuff?"

Hell, I don't think most folks who could do that stuff have any desire to actually do it for their household gear ... and then deal with the inevitable breakdowns ... especially if some clownshow in Redmond or Shanghai is perpetually sending out broken automatic "firmware" updates to enhance security or "user experience".