Slashdot Mirror
Ask Slashdot: Is My IoT Device Part of a Botnet?
As our DVRs, cameras, and routers join the Internet of Things, long-time Slashdot reader galgon wonders if he's already been compromised:
There has been a number of stories of IoT devices becoming part of botnets and being used in distributed denial of service attacks. If these devices are seemingly working correctly to the user, how would they ever know the device was compromised? Is there anything the average user can do to detect when they have a misbehaving device on their network?
I'm curious how many Slashdot readers are even using IoT devices -- so leave your best answers in the comments. How would you know if your IoT device is part of a botnet?
I'm curious how many Slashdot readers are even using IoT devices -- so leave your best answers in the comments. How would you know if your IoT device is part of a botnet?
If it's connected to the internet directly, and it has no built in security apart from "admin" "password", it's part of a botnet or soon will be.
"Freedom in the USA is not the ability to do what you want. It is the ability to stop others from doing what THEY want"
The "average" user has no idea and that's why they put IOT shit on their unsecured network in the first place, duh.
There are free tools you can use to monitor a network, but they might not be so easy for the average user. Just googling around, I found this solution that's designed to answer such questions, but note it costs money. I've never seen it in action. One would hope that you get something user-friendly at such a price.
The other guy who said that if you can log in with "admin" as the userid and "password" as the password, or some other default login, that's spot-on. Botnet creators will probe for that, so at the very lease change the userid and password before actually going live... or just do what I do and not have any IoT stuff.
Though it doesn't seem to apply to home networks, how can you be an IT professional of any kind and NOT know what's coming into or going out of your network?
If nothing else, precisely because of things like this where your CCTV NVR or your thermostat could be hacked and doing whatever it likes. In fact, DDoS of someone else is the LEAST of your worries if someone is able to coax your devices into running arbitrary code on your local network.
Sorry, but this kind of thing needs management and there isn't a home router on this planet that does things like send you an email when a "new" device connects, or alerts you to unusual activity from your local network devices.
Keep routers and access points separate, there's no need for them to be the same device...
Get a low power atom device to run something like pfsense, a cheap managed switch (the hp 1800 series are good and quiet), use any wireless ap as a dumb bridge so it doesnt need any routing capabilities.
Create separate VLANs for guests and other untrusted devices, you can connect to devices here via the firewall but don't allow any outbound connections from the network containing these devices.
Buy new wifi as/when (eg 802.11ac), add multiple access points to cover different areas if necessary (even in a small house, wifi doesn't travel well through floors) and link them together via ethernet. Use ethernet whenever possible, wifi is only for portable devices.
You can also setup a VPN so you can connect to your stuff from outside, having authenticated using both a certificate and a user/pass. Far less chance of compromise than some unknown black box device from china.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Is this the long sought after counter-example to Betteridge's Law where the response to a question mark is always "yes" ?
Andy Warhol got it right / Everybody gets the limelight
Andy Warhol got it wrong / Fifteen minutes is too long.
Probably beyond the abilities of Joe Average, but you could use your router/firewall/whatever to limit the bandwidth of IoT devices on your network.
Most IoT devices seem to use very little bandwidth by design - they just send and receive simple status updates and commands - and they would be of much less value to a botnet operator if they were limited to, say, 5kbps.
I don't use IoT, and I will never will. No need to share with external world room temperatures, door status or garden humidity. Electromechanical devices are enough for this, they are much cheaper, and are free from the risk of being tampered from an indian hacker.
I still have to understand why people need to control everything from their smartphone, when there are simpler solutions that require much less of your precious free time to be implemented and used.
Thanks for the info. I've printed it out for my grandmother...
----------------------------------- My Other Sig Is Hilarious -----------------------------------
> Keep routers and access points separate...
> low power atom device to run something like pfsense
> cheap managed switch
> wireless ap as a dumb bridge
> Create separate VLANs
Once you're done making this server room you describe, you'll be in the .0000001% of people qualified to run an IoT device, many of which are BORN malicious and sending pictures of your bedroom/front lawn/children to a central server in China, a decent number of which are fundamentally insecure with no possible way to change passwords or a default password they forgot (or "forgot") to strip out that you can't fix, and at least some of which will fail to work on a VLAN that can only see the outside internet (for some goddamned reason, they want to ping a router or something).
The short version is this: If you want your IoT devices to not be part of a botnet, DO NOT BUY ANY. Once you buy those components, you have to set them up. Then configure them. Then maintain them. And almost no one will jump through any of those hoops.
The "average" user has no idea and that's why they put IOT shit on their unsecured network in the first place, duh.
The average user has no idea that there is something like "IoT" and that it is in any way different from the rest of "the internet". All they know is that it is "smart" to have an app on your phone that can turn on the heating and tell you the fridge is empty, and a TV that seems to understand what you want to watch, or a smart meter that tells you (and the utility company) how much gas and electricity you use up to the last minute. They won't know or care about the security implications until it goes badly wrong.
Do you really want to know?
Then analyse your LAN traffic. Wireshark and Co. are you friends.
You're welcome. Captain Obvious was glad to help.
We suffer more in our imagination than in reality. - Seneca
If a person is intelligent enough to perceive the need for a device, obtain the device and install the device
They will perceive the "need" when a salesman or ad persuades them that they need it. They do not even need to be aware that the device will be part of the IoT, only that they "need" a toaster or whatever.
They will obtain the device by pulling out their wallet. (Soon it will become impossible to obtain anything else.)
They will install it by plugging it in (have you never installed a toaster before?).
I don't know where you think intelligence comes into it.
Dude, I'm not a network technician but I've been putting computers together since the late 80s and have been running Linux OSs as my desktop OS for over a decade now...
And I couldn't set up the network you described without some serious googling.
How are we supposed to expect normal people to do it? Do routers come with VLAN set up out of the box, jailed so that it doesn't send data out of your network? Somehow I doubt it.
Normal people are screwed, until routers are set up to manage IoT networks by default.
And let's be real: Normal people aren't going to buy a separate access point if their router has Wifi built in.
Help! I'm a slashdot refugee.
"Think a non-network engineer can do or wants to do any of that stuff?"
Hell, I don't think most folks who could do that stuff have any desire to actually do it for their household gear ... and then deal with the inevitable breakdowns ... especially if some clownshow in Redmond or Shanghai is perpetually sending out broken automatic "firmware" updates to enhance security or "user experience".
You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
Infected devices usually try to spread the infection further and their scanning attempts on the Internet are often observed. There is for instance a dedicated website for IoT devices attacking Telnet ports or some more generic ones, such as the Internet Storm Center. If the IP address of your device is on the list, it is very likely that you have a problem.
Depends, have you plugged it in yet?
No need to turn it on, someone else will do that for you.
Regards, Phil
I have often wondered the answer to this question myself: how can I tell if a machine on my network is compromised?
So I set up a Linux box as my primary router, and monitored all the traffic going through the box, and holy crap, there is a lot of stuff.
Every time you hit a facebook web page, the javascript in there directs your browser to hit literally dozens of other web sites, and this is true of EVERY device in your house: your wife's laptop, your son's smartphone, your dog's water bowl. When you watch a video on Netflix video, the video player hits a dozen different servers at once, and those connections come and go constantly, old ones are closed, new ones opened to different servers throughout the world with all kinds of different names. And, of course a modern computer or smartphone uses all kinds of services: time services, location services, software updates, on and on and on.
It would be very difficult for a person to notice a low level bot doing something amiss. I have all the data, and I don't know how to do it.
I am more concerned about a cheap IoT device shipping with spyware from China pre-installed than I am about someone hacking into my network.
-==- Buy a Mac and leave me alone!
Well, I had good intentions. I'm a network engineer, and I planned out my multi-segmented network so that my home IT (servers/computers) stuff was separated from my home infrastructure (security devices, smoke detectors, etc) and that the latter were walled off from the Internet. And I *plan* to make it all work correctly someday. But in the meantime... All I have implemented so far is separate SSIDs for kids and adults so that the kids are blocked from 24-hour/day Internet time wasting, and some firewall block rules to keep my home security infrastructure from being able to communicate to the Internet, mostly triggered by the Nest Protect's incessant need to upload its motion detection data to the mothership.
In the meantime, I generally avoid buying things for the home network that aren't "self-contained" (i.e., I don't buy the things that need to communicate with the "cloud" in order to work. This is for practical reasons (I don't want my stuff to stop working just because a vendor goes out of business, or simply stops supporting an old product line, or my Internet connection is on the fritz) as well as privacy reasons (I don't need to have any more data on my habits and choices being uploaded to the cloud than is already there from my using Amazon, credit cards, Hulu Plus, Redox, and the library).
I *hope* more vendors get off of the "connect it to the cloud" bandwagon and that IoT devices are mostly self-contained, but don't see much chance of it happening unless either there is a huge blowup with legal liability that causes companies to go that way, or legislation requires/encourages it. Too many folks want to be able to view the inside of their home from their smartphone while on vacation, without realizing that what works for them can very well be subverted to working for others...