Slashdot Mirror
Ask Slashdot: Could A 'Smart Firewall' Protect IoT Devices?
To protect our home networks from IoT cracking, Ceaus wants to see a smart firewall:
It's a small box (the size of a Raspberry Pi) with two ethernet ports you put in front of your ISP router. This firewall is capable of detecting your IoT devices and blocking their access to the internet, only and exclusively allowing traffic for the associated mobile app (if there is one). All other outgoing IoT traffic is blocked... Once you've plugged in your new IoT toaster, you press the "Scan" button on the firewall and it does the rest for you.
This would also block "snooping" from outside your home network, and of course, keep your devices off botnets. The original submission asks "Does such a firewall exist? Is this a possible Kickstarter project?" So leave your best answers in the comments. Could a smart firewall protect IoT devices?
This would also block "snooping" from outside your home network, and of course, keep your devices off botnets. The original submission asks "Does such a firewall exist? Is this a possible Kickstarter project?" So leave your best answers in the comments. Could a smart firewall protect IoT devices?
Ideally, there should be a profile/manifest IoT makers have as standard with their devices. This shows what incoming/outgoing ports and hosts the IoT device communicates with. Everything else should be blocked as default from the router. This should be in some central registry or a standardized URL system, so a home firewall could, once it recognizes a certain IoT device, grab a profile and run with it.
Of course, a lot of IoT makers would just put in that the device takes incoming/outgoing traffic from anything and everything, but hopefully there might be come makers who give a shit enough about security to put in limits of what their devices can and do not try communicating with.
This way, a firewall, once it registers a device can automatically apply a profile and call it done. Of course, there are security issues, but this is a giant step forward, compared to letting the device have unfettered access in and out.
All you really need is... some rules.
If you have an openwrt, dd-wrt or similar router, you can definitely block whatever traffic you want without new hardware.
You can whitelist devices by IP or MAC and not permit anything else to generate egress traffic, which won't prevent against devices smart enough to spoof your IP and MAC sending data but which will defeat the casual attacks.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
We have the Cujo appliance, which seems to catch bad network traffic, and Fing has a Kickstarter/Indiegogo hardware project in the works to go with the Fing software.
Greg Raven
As long as there's any left, I'll take mine first.
https://en.wikipedia.org/wiki/...
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
I'm pretty sure that this "smart firewall" is more commonly known as a "firewall". Any firewall that can't block traffic can't legitimately be called a firewall at all.
No, I think people of all ethnic persuasions could have this issue. Bravo for bringing race into it, do you have any particular list of people you want to express outrage for on their behalf? Because no, they can't speak for themselves. This white devil here forgot to check his privilege on the way in, I am so sorry about that.
Sounds like you want to spin up a managed security provider for home users, to manage their gateways. It's been tried before, but not enough people want to pay for it. Much easier and more economical to just get large ISPs to do it. All we need is the right leverage. As Bruce Schneier observed, it is in part a problem because the device manufacturers and the home users really don't have a strong motivation (yet) to do anything.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
As is so frequently the case, you're trying to solve a social problem with a purely technical solution. Would such a device work? Of course. Would many of the dozens of existing router products work, if properly configured? Yes. Does any of this matter? No. People don't care what devices on their network are doing as long as they appear to mostly be doing what they want. If they're doing other things, people are completely oblivious, and get petulant if you point out their ignorance.
The only market-driven solution is for Apple to make an IoT router and instruct all their fanboys to buy it for $400. ($600 for the gigabit capable one.)
The only real solution is the same as for every other tragedy of the commons. But that requires a competent legislature interested in doing its job, rather than a rabble of moronic sycophants of industry only competent at being elected.
not plugging your fucking toaster into the internet so it cat tweet out whenever your toast is done.
One of the things I do for a living is write firewall policy. We use Palo Alto gear, which seems to be some of the best available at automatically identifying what stuff is.
Even with a company like that behind the gear spending a lot of time and money keeping things up to date, it doesn't know about every little thing it sees.
Another challenge is that this device would need to be able to do SSL forward proxy for everything, or all it will know is there's an ssl connection to somewhere (although you can use information in the server cert to make further guesses). That means somehow getting a signing cert onto the device that all of the IoT things trust. Good luck.
Yes it's just a firewall.
The smart part would be it only acts as a firewall for IoT devices (welbcams, toasters, receivers) - basically anything with embedded networking in the user would not think to monitor. And it would know what app traffic to allow to connect to the device externally...
Someone like you or me can easily just configure a firewall to do whatever. But such a device would be great to be able to point non-technical (or even technical but uninteresting in networking) friends and family at.
I don't know how you could have anyone non-technical be able to easily add this to an existing network though...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Such a device could turn IoT device connectivity into an on-demand VPN only setup.
Of course, having to fire a VPN client before interacting with the IoT device would be a hassle, but perhaps that could be made automatic. Another problem is that some IoT devices are useless if not connected to the cloud.
Mexico's gonna pay for it
Good lord. I hope the diamonds in your ass don't hurt on the way out. http://www.hulu.com/watch/3170...
I don't have an "ISP router". I have a customer owned cable modem hooked up to a customer owned router. The desired functionality could be built into either device and both devices could be in the same device, but I find it more effective for diagnostic and replacing for them to be separate.
Absolutely correct!
There are several ways to use existing router features to do this. A few steps, a few minutes work.
Sadly, most are too ignorant to implement them.
Basically, how to get the unwashed massed to learn to implement them.
How many devices and pieces of software use multiple servers, cloud hosting (aws, etc), different ports, push json to where ever the hell. This will never work unless the firewall is built to auth to the services itself or some higher level inspection...which means a bigger cpu. Also, inspection of https or any TLS traffic is something still hard/different to do. You gonna install a root cert on your smart TV.
I'd recommend Endian Firewall. It could accomplish this quite easily, and its simple to setup.
Let's make like a bird... and get the flock outta here.
No
Or just as accurately: yes.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Something about these recent DDoS attacks originating from IoT has always bothered me. And I think it's that many of these vulnerable IoT devices are already behind firewalls from the open internet. I'd wager that most people's thermostats, smart lights, sprinkerly systems, etc are all attached to their local WiFi, not the open Internet. So the question is, how were these devices compromised? I've not read anything on the internet that explains this, other then lists of default usernames and passwords. So I'm left with the conclusion that most IoT devices are hacked probably by malware on the local LAN from existing desktop computers. And the compromise occurs over services that are purposely exposed to the LAN, like a web interface. Of course compromised IoT devices then seek out and attack other IoT devices.
But the point I'm getting at is that a firewall just isn't going to stop this from happening, since the exploited services are open to incoming connections (from the LAN) by design. Obviously a device on the open internet is stupid and needs to be firewalled. But on your LAN a custom little smart firewall is not going to do squat.
The only vendors take security seriously and stop using default passwords and actively try to stamp out security flaws in the software itself such as buffer overruns, cross-site scripting flaws, or database injection, will IoT devices cease to become vulnerable. But I have my doubts these devices will ever be secured.
I have exactly four items that connect to the internet, my laptop, roku, wii and iPhone. I'm not connecting my lightbulbs, outlets, fridge, thermostat or any other ridiculous crap.
SJWs are the new boogeyman. -Me
the manufacturers would have to provide, in some form, what their devices are supposed to be able to connect to, so that the firewall can block it from connecting to everything else.
In other words, manufacturers would have to admit how extensively their devices spy on you, and phone home with it, and open themselves up to easy consumer monitoring of what their devices send back.
I'm not holding my breath.
My IoT switches are Z-wave. My thermostat is RS485. My individual temp feedback sensors are passive 433 MHz.
It's another layer of abstraction and less holes to plug than just letting everything have unfettered access to the outside world.
If someone can access a device to which it can use port knocking, you already failed. Communication should only be done on the local network. If you wish to interface with it, set up a VPN tunnel to the local network
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
Why would we want to actually learn something about the tools that we use, instead lets put another black box IOT thing that i don't know how to administer on the network, we can trust all of our security and personal data to a 3rd party, why wouldn't we? /s
Wait a minute. You want someone to make a device that will identify random IoT devices when we can't even get current home/soho router/firewall device makers to update THEIR firmware?
-EB
Do you ever walk alone like a drifter in the dark?
Steve Gibson had suggested a configuration of three routers to isolate IoT devices. https://www.grc.com/sn/sn-545.... Again, it depends on how much you want to put "common consumers" through. I'd submit that unless it's ridiculously easy, the vast majority of consumers would simply scoff and claim it wasn't worth the trouble. (And those are the folks who probably were the main constituents of the recent botnets)
Yes. With a single acronym change.
IoT "Internet of Things" --> IoT "Intranet of Things"
Connect them to a local Intranet server, instead of trying to connect them to a server in China, or at Google, or to everyone in the world, and they are no longer a problem.
As Drinkypoo said, no need for new hardware, this is all about configuration. If you have a great many devices, configuration could be difficult, but there is a short cut. It's called "anomaly detection". The firewall learns what's normal, and when unusual traffic starts it takes one of three different actions, depending on the level of risk it estimated. Snort os open source software that can do this.
Along with anomaly detection covering 90%, you might also add some manual rules.
I think there are other exploits. Some of my cheap audio devices hit chinese IPs looking for firmware upgrades. If you could hack those IPs then you could deliver a malicious firmware while the network didn't see anything but a web request.
...There are very few IoT devices that couldn't provide near 100% of their functionality without ever having to talk outside your local network.
Develop some IoT devices that can do that and that can gracefully handle it when it loses all communication (e.g., your thermostat should still work)...
Great idea, but who's going to do it? The makers of such gear are much more interested in the big bucks they can make from data mining than they are in the chump change they make by selling you an IoT widget. The only reason big companies make IoT gear is data collection; the customers' needs are incidental to that endeavour, and the customers' connection to servers in the cloud is the whole point of the exercise.
"There are a lot of technically savvy people out there looking for smart devices that don't work worse than their existing ones". FTFY. Unfortunately, there are WAY more non-tech users, (who keep default passwords on their network gear, don't use ad blockers and NoScript, and drop their drawers to Facebook), than there are technically knowledgeable users. And the non-tech users simply don't care, so I predict that someone using your idea won't be taking any markets by storm. It might be a decent niche market though.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
This does not need a special product. Any firewall will do, even a random consumer wifi router that has customizable firewall rules.
a) assign iot devices certain ip addresses
b) block all outgoing traffic from these
I have it done in a bit of more advanced way (VLANs), but thats not strictly necessary.
>> Could A 'Smart Firewall' Protect IoT Devices?
No. A big fire would be more adequate.
IOT is BS.
aaaaaaa
You don't need to be worried about people who might think about hooking up a special router or even RPi to their network to deal with IoT devices, but rather with people that don't. And that's going to be pretty difficult to solve before all consumer routers come with decent default firewall rules or such additional functionality you're describing.
It's called a ... wait for it... a network firewall!
You would then whitelist the routes you want to allow.
And whatever you do, you would not let your IoT device update the firewall's ruleset!
Bad analogies are like waxing a monkey with a rainbow.
The problem is that most IoT devices rely on a centralised server for their operation, so your (b) will prevent them from working. Their smartphone app talks to the vendor's server and won't work without it. You need to allow it to talk to the vendor's server, but not to anything else.
That's also why the example in TFA won't work: you can't do this sort of filtering based on IP, because a lot of the vendors use multiple servers or even cloud hosting for the server component, so you'll end up having to allow access to, for example, the entire AWS address range, if you don't want the device to stop working randomly.
I am TheRaven on Soylent News
Yes, true. My iot things talk with my own OpenHAB installation and therefore I do not have that issue. But a generic out of the box behaviour on most of the iot stuff is to phone home as it simply cannot be connected by an app in your phone without forwarding ports etc (which is beyond a normal user's abilities).
TFA is a a question by a person who has no idea how ip networks and client/server/app communication works.
My only point was that we do not need a special IOT isolating appliance, this can all be done with standard firewalls built in most wifi or broadband routers.
Could A 'Smart Firewall' Protect IoT Devices? No. "Smart" firewalls are in fact the problem. Getting rid of them, and using regular non-smart firewalls that only allow incoming connections when you explicitly and manually configured them to do so can protect your IoT devices.
pfSense with Snort will block access to CnC servers. Add in a DNS blackhole and you'll be in pretty good shape, for free.
I use a Raspberry Pi as a firewall between the ISP's router and my network. And I could only allow specific access for certain devices while denying the rest of the access. The downside is that even a RPi3 has limits on bandwidth, but eh, my speeds are crap anyways. 11.8 Mbps download, and 9.8 MBps upload.
hide a potentially broken/hackable device behind another potentially broken/misconfigured device. the internet of things is bullshit, just remove these items and never talk about them again.
Isn't the problem the default usernames and passwords not being changed instead of what ports they are listening on? I know I got an infected raspberry pi because I forgot to change the root password. The pi did need outside access so blocking the ports would have made the device useless to me. Stupid mistake I know but most people don't know. Look at consumer routers and their default usernames and passwords.
Couldn't a halfway decent modern router be designed to do something like this?
Naw .. never mind .. that's just crazy talk.
Let's replace the whole clusterfuck with a... FireCloud!
Brought to you by Carl's Junior.
The problem is that most IoT devices rely on a centralised server for their operation
..and once again, 'The Cloud' is proven to be a large part of the problem. Why not a service running on a computer on the local network instead? Honestly, how many people are going to have 'IoT' devices all through their homes and not have at least one general-purpose computer around, too?
And how do you then set up the ability for that computer (and how many households have a computer that they leave on all of the time?) to be globally reachable from wherever network the users's smartphone happens to be on when they want to use the app?
I am TheRaven on Soylent News
Yes, you'd have to leave it on all the time. Which for most people is impractical.
You mean just like all the IoT things themselves, and your modem and router and dvr boxes and your roku and echo etc etc etc.
A lot of connected home thingies have (optional?) central hubs which could serve the purpose of an always on computer for whatever purposes you needed that for.
The rest of the AC's rant isn't an argument at all. No desire to have an IoT thing is not a reason why others shouldn't use it. An always on computer is already solved though.
I don't know. "In front of" is more of an hook to suggest that whatever happens on the LAN, in the end it needs to pass through the "IoT FW". I'm sure there are many ore technical challenges to overcome.
So true.
And how do you then set up the ability for that computer (and how many households have a computer that they leave on all of the time?) to be globally reachable from wherever network the users's smartphone happens to be on when they want to use the app?
My computer may not be on all the time, but my router is. Even now, even though I don't have any non-computational 'things', such as a coffee maker or internet microwave: just tablets, phones and laptops.
So if I set those devices to accept packets only from my phones/computers, I'd be set. I agree that it is tricky doing that if the things have dynamic, as opposed to static addresses, but aside from that, there is no reason for anyone else but me to have access to my stuff
Can someone please explain to me where these comments come from and what they mean? Are they simply just to piss everyone off? The overuse of the word apps, cows, and Luddites are simply obnoxious to me.
Tell us why you need an internet-connected refrigerator. Really.
How else can I can see if I need to get more milk when I'm at the store???
WTB [sig], PST!!!
Posted by bots.
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
https://www.getcujo.com/
Walmart, BestBuy, Amazon carry this home Firewall.
Too bad their website has a bad SSL cert.