[Mud] DNS filtering and IoT device security

Michael Richardson <mcr+ietf@sandelman.ca> Sun, 01 December 2019 20:16 UTC

From: Michael Richardson <mcr+ietf@sandelman.ca>
To: Ted Lemon <mellon@fugue.com>, ADD Mailing list <add@ietf.org>
CC: mud@ietf.org
In-Reply-To: <44754CB6-1CED-4ADF-9521-1361DF4F75A6@fugue.com>
References: <99B3F484-0C0B-40F0-9E97-E7807AC61FA5@fl1ger.de> <44754CB6-1CED-4ADF-9521-1361DF4F75A6@fugue.com>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha256"; protocol="application/pgp-signature"
Date: Sun, 01 Dec 2019 15:16:14 -0500
Message-ID: <892.1575231374@localhost>
Archived-At: <https://mailarchive.ietf.org/arch/msg/mud/yu9J395cgI5Nd8GOiSkyCxR6vMM>
Subject: [Mud] DNS filtering and IoT device security
Precedence: list

Ralf Weber <dns@fl1ger.de> wrote:
    >> While this is possible for well behaved clients, it’s hardly possible
    >> for devices that attack my network, like hacked IoT devices. We have
    >> to give the network some means to defend against this. To achieve this
    >> the proper behaviour of well defined client must be predictable and
    >> follow what the network offers. If attack and regular traffic look the
    >> same defending against attack traffic gets much harder.

Ted Lemon <mellon@fugue.com> wrote:
    > Your IoT devices should not be able to communicate freely with all
    > other devices on your network (or off).  They should be firewalled
    > automatically using MUD.  This is a much more effective strategy than
    > filtering their DNS queries, because it is a list of permitted
    > connections rather than a list of excluded connections. The permission
    > list permits only those destinations the IoT device should be talking
    > to.  An exclusion list allows the IoT device to talk to all unknown
    > adversaries, and only blocks communication with known adversaries.  So
    > it’s perhaps marginally better than nothing, but still mostly useless.

I agree completely with Ted: DNS is a really poor way to keep your devices
safe.  It's unfortunately, often the only controls we have to date, and when
the only tool you have is a hammer...

I posted draft-richardson-opsawg-mud-iot-dns-considerations-01 just before
the deadline.   Contributions and thoughts welcome.

Fundamentally, the MUD controller needs to be able to get the same DNS
answers as the IoT devices.  To the extent that off-site Do53/DoH/DoT screws
up geo-DNS and other load balancing mechanisms they are a problem.

That's not a mark against DoX, but against *off-site*.
That's also not a statement against browsers doing X or Y, but rather that
controllers needs to know where devices are asking questions to.
Local makes it easier to manage, but that's not the only answer.

--
Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
 -= IPv6 IoT consulting =-

Attachment: signature.asc

[Mud] DNS filtering and IoT device security Michael Richardson

[Mud] DNS filtering and IoT device security

Attachment: signature.asc