Re: [homenet] standard way of configuring homenets

["STARK, BARBARA H" <[e-mail]>]

> From: Ted Lemon 
> Hm, possibly there's been some miscommunication here: we aren't talking about using tools developed for managed networks for amateurishly-managed networks.   We are talking about the problem of making it possible to do some degree of management of homenets.   I don't think anybody is assuming that we will just forklift in SNMP or Netconf/Yang; indeed, at least one suggestion was to just use HNCP.   HNCP actually possesses exactly the attack surface you are talking about if we don't have some kind of enrollment protocol.

I don't see HNCP as being usable in DDoS attacks or as being useful in compromising a device. It can give a device bad config info, which could prevent the home network from working as desired. But it can't be used for a Mirai-like DDoS attack. And it doesn't have the ability (yet) to configure login credentials for more in-depth device management. It doesn't supply a management interface so much as send around best effort config info.

I agree with the need for some kind of enrollment to protect components of the homenet solution. I'd rather not rely on this enrollment to guarantee that components of the homenet solution cannot be used for DDoS attacks. I would prefer for homenet solutions to be natively incapable of being used in DDoS attacks.
Barbara

On Wed, Jul 25, 2018 at 12:40 PM, STARK, BARBARA H <mailto:[e-mail]> wrote:
> > <individual hat> Since homenet is supposed to be about an unmanaged
> > network, and configuration via a management protocol requires somebody
> > who knows what they’re doing,
> 
> Traditionally, yes, but we do actually want to get away from that.
> (It's our explicit goal to do that in ANIMA, for which homenets are out of
> scope, but we assume that the starting point is a NOC staffed by people who
> know what they are doing.)
> 
> The idea of capturing a homenet config and saving it for future use doesn't
> seem outlandish to me, and using tools developed for managed networks,
> but operated robotically instead of manually, doesn't seem crazy either. But
> it might be a big effort and a distraction.

<as individual contributor>
Using tools developed for managed networks in amateurishly-managed (or unmanaged) home network environments has historically turned out very badly.
Poorly implemented management protocols and "backdoors" are a leading cause of security vulnerabilities. These poor implementations are common and prevalent. 
Improperly secured, but (otherwise) well-implemented management protocols are another leading cause of security vulnerabilities. This is also common and prevalent.
And I'm not just talking about the device's or home network's security. I'm talking about Internet security -- this is how DDoS attacks are enabled.
As a data point: providers like Comcast actively block SNMP ports because SNMP is so easy to use in DDoS attacks. (https://urldefense.proofpoint.com/v2/url?u=https-3A__www.xfinity.com_support_articles_list-2Dof-2Dblocked-2Dports&d=DwMFaQ&c=LFYZ-o9_HUMeMTSQicvjIg&r=LoGzhC-8sc8SY8Tq4vrfog&m=s27KbgGycHKQ4PdDhbU8u3hn_hJ6V8VXhZLiP1YXI-M&s=73RoZA55LrnReb6kBTz2o8DIdaoGN0pHtadgVDGVrL8&e=)
I realize netconf and restconf aren't SNMP. But please don't think that if these protocols were to be deployed in millions of consumer devices and placed under the control of end users we would discover them to be magically immune to poor implementations and being improperly secured. I have yet to see a management protocol that is immune to either of these issues.

Which isn't to say it couldn't be done or there might not be a good use case for it. I'm saying that it is a huge effort that would need to be done with extreme foresight and care. We would need to understand extremely well exactly what we do and don't want from such a management solution -- exactly what problems we are trying to solve and what our requirements are. Does it need to be a single management protocol to solve everything, or do we separate reporting of statistics from configuration backup from UI for user configuration? We would have to be rock-solid on requirements for securing any such management interface, understand what our strategy is for minimizing occurrence of poor implementations, and understand what our strategy is for minimizing occurrence of improperly-secured implementations.

On the plus side -- maybe if we were able to do this, it would keep developers from creating their own custom vulnerabilities (aka management interfaces) by giving them a viable properly secured solution.
Barbara