Slashdot Mirror
Ask Slashdot: Could A 'Smart Firewall' Protect IoT Devices?
To protect our home networks from IoT cracking, Ceaus wants to see a smart firewall:
It's a small box (the size of a Raspberry Pi) with two ethernet ports you put in front of your ISP router. This firewall is capable of detecting your IoT devices and blocking their access to the internet, only and exclusively allowing traffic for the associated mobile app (if there is one). All other outgoing IoT traffic is blocked... Once you've plugged in your new IoT toaster, you press the "Scan" button on the firewall and it does the rest for you.
This would also block "snooping" from outside your home network, and of course, keep your devices off botnets. The original submission asks "Does such a firewall exist? Is this a possible Kickstarter project?" So leave your best answers in the comments. Could a smart firewall protect IoT devices?
This would also block "snooping" from outside your home network, and of course, keep your devices off botnets. The original submission asks "Does such a firewall exist? Is this a possible Kickstarter project?" So leave your best answers in the comments. Could a smart firewall protect IoT devices?
Ideally, there should be a profile/manifest IoT makers have as standard with their devices. This shows what incoming/outgoing ports and hosts the IoT device communicates with. Everything else should be blocked as default from the router. This should be in some central registry or a standardized URL system, so a home firewall could, once it recognizes a certain IoT device, grab a profile and run with it.
Of course, a lot of IoT makers would just put in that the device takes incoming/outgoing traffic from anything and everything, but hopefully there might be come makers who give a shit enough about security to put in limits of what their devices can and do not try communicating with.
This way, a firewall, once it registers a device can automatically apply a profile and call it done. Of course, there are security issues, but this is a giant step forward, compared to letting the device have unfettered access in and out.
All you really need is... some rules.
If you have an openwrt, dd-wrt or similar router, you can definitely block whatever traffic you want without new hardware.
You can whitelist devices by IP or MAC and not permit anything else to generate egress traffic, which won't prevent against devices smart enough to spoof your IP and MAC sending data but which will defeat the casual attacks.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I'm pretty sure that this "smart firewall" is more commonly known as a "firewall". Any firewall that can't block traffic can't legitimately be called a firewall at all.
Sounds like you want to spin up a managed security provider for home users, to manage their gateways. It's been tried before, but not enough people want to pay for it. Much easier and more economical to just get large ISPs to do it. All we need is the right leverage. As Bruce Schneier observed, it is in part a problem because the device manufacturers and the home users really don't have a strong motivation (yet) to do anything.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
not plugging your fucking toaster into the internet so it cat tweet out whenever your toast is done.
Something about these recent DDoS attacks originating from IoT has always bothered me. And I think it's that many of these vulnerable IoT devices are already behind firewalls from the open internet. I'd wager that most people's thermostats, smart lights, sprinkerly systems, etc are all attached to their local WiFi, not the open Internet. So the question is, how were these devices compromised? I've not read anything on the internet that explains this, other then lists of default usernames and passwords. So I'm left with the conclusion that most IoT devices are hacked probably by malware on the local LAN from existing desktop computers. And the compromise occurs over services that are purposely exposed to the LAN, like a web interface. Of course compromised IoT devices then seek out and attack other IoT devices.
But the point I'm getting at is that a firewall just isn't going to stop this from happening, since the exploited services are open to incoming connections (from the LAN) by design. Obviously a device on the open internet is stupid and needs to be firewalled. But on your LAN a custom little smart firewall is not going to do squat.
The only vendors take security seriously and stop using default passwords and actively try to stamp out security flaws in the software itself such as buffer overruns, cross-site scripting flaws, or database injection, will IoT devices cease to become vulnerable. But I have my doubts these devices will ever be secured.
Wait a minute. You want someone to make a device that will identify random IoT devices when we can't even get current home/soho router/firewall device makers to update THEIR firmware?
-EB
Do you ever walk alone like a drifter in the dark?
Steve Gibson had suggested a configuration of three routers to isolate IoT devices. https://www.grc.com/sn/sn-545.... Again, it depends on how much you want to put "common consumers" through. I'd submit that unless it's ridiculously easy, the vast majority of consumers would simply scoff and claim it wasn't worth the trouble. (And those are the folks who probably were the main constituents of the recent botnets)
Yes. With a single acronym change.
IoT "Internet of Things" --> IoT "Intranet of Things"
Connect them to a local Intranet server, instead of trying to connect them to a server in China, or at Google, or to everyone in the world, and they are no longer a problem.
In the minds of the vendors, it is "necessary" because a) their software only barely works at ship-time and is still under active development for the first few years of product support, so the more of it that is server side, the better and b) their business model involves selling the below actual cost and making up the difference by selling to big-data consumers.
Someone had to do it.
The problem is that most IoT devices rely on a centralised server for their operation, so your (b) will prevent them from working. Their smartphone app talks to the vendor's server and won't work without it. You need to allow it to talk to the vendor's server, but not to anything else.
That's also why the example in TFA won't work: you can't do this sort of filtering based on IP, because a lot of the vendors use multiple servers or even cloud hosting for the server component, so you'll end up having to allow access to, for example, the entire AWS address range, if you don't want the device to stop working randomly.
I am TheRaven on Soylent News