[Madinas] identities for legitimate devices

[Michael Richardson <[e-mail]>]

<[e-mail]> wrote:
    > The slides you are referring to are not intended to articulate the
    > overall problem space but to illustrate a use case where ** means to
    > unambiguously and persistently identify devices within the home are
    > required ** to protect the Internet but also to avoid collateral damage
    > for subscribers hosting such compromised devices. Filtering at the
    > network is suboptimal. The question then is:

Reading the slides, I understood:
        "Doctor it hurts when I put my foot in the blender"

me: "don't put your foot in the blender"

    > ** how to reliably achieve this without mandating a given network setup
    > and while minimizing subscriber involvement? **

    > Many ISPs offer apps to seek for an ACK from the subscribers whenever a
    > new device connects to the home network. The identification is usually
    > based on the MAC@. Notifications will be generated each time a new MAC@
    > is generated, which may be disturbing for the subscriber and may lead
    > to deactivate the app or accept by default all devices. These
    > considerations (and others) are not discussed in these slides because
    > this is supposed to be handed in other use cases (device
    > identification).

Yes, it's is good that you agree with me that the real problem is not
tracking malicious devices that change evade ACL by changing address, but
rather positively identifying legitimate devices so that their MAC address
changes can be transparently tracked.

    mcr> The solution is that one has to construct filters to recognize
    mcr> legitimate devices and accept their traffic.  All other traffic gets
    mcr> blocked.

    mcr> It is easy in current software and protocols to provide a per-device
    mcr> WPA-PSK (for WiFI), and this efficiently binds the device identity
    mcr> to their MAC address.

    mcr> This is unfortunately, not yet a BCP (or as our group at the RIPE81
    mcr> IoT attempted, a BCoP), because we lack the right standardized
    mcr> interfaces to be able build a UI to assign a new WPA-PSK per device.
    mcr> To do this automatically/autonomically, we need BRSKI or DPP or ???,
    mcr> but it could be done via a management "App" connected to the home
    mcr> router.
    mcr> Many ISPs that provide routers provide a management App as well.

    mcr> Todays interfaces can accept-list devices by MAC address.
    mcr> The risk is that these lists go stale if *legitimate* devices change
    mcr> their MAC address.

    mcr> The biggest risk, in my opinion, is not that malware will learn to
    mcr> randomize their MAC address.  It is that malware will learn to login
    mcr> to the CPE using the "cheestos"[1] authentication of admin/admin,
    mcr> and then just accept-list their chosen MAC address.


--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [