Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC

[Mark ZZZ Smith <[e-mail]>]

----- Original Message -----
> From: "de Brün, Markus" <[e-mail]>
> To: [e-mail]; Mark ZZZ Smith <[e-mail]>
> Cc: Marc Lampo <[e-mail]>; Mikael Abrahamsson <[e-mail]>
> Sent: Monday, 18 November 2013 9:37 PM
> Subject: Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC
> 
>>  >[...], but does this mean accessible from anywhere on the Internet ?
> 
>>  Actually, I think you're probably going to want your refrigerator to be
>>  able to access the Internet, [...]
> 
> "Access to the internet" and "accessible from the internet" 
> are two seperate 
> things.Perhaps I want my fridge to access the internet but not the other way 
> around.
> 

It might depend on whether you want to find out what is in it when you're at the supermarket. It might be convenient to know if you need to buy milk when you're there.


> There was a vulnerability in some heating-systems a few month ago [1]. An 
> attacker could remotely shut down the heating. This is the kind of thing one 
> does not want to happen.
> 

True.

However, if you were the manufacturer of this heating system, how could you be sure your customers are not attaching the device directly to an unfettered Internet connection? You could try putting a warning on the box or in the manual saying "Don't plug into the Internet" or "There MUST be a firewall in front of this device." That might not confuse people like us, but I'm pretty sure it will confuse the majority of consumers.

The only way for a manufacturer to be sure of the security of the device is to assume the worst and have the device be totally self reliant for its Internet protection. If the manufacturer does that, then there are no warnings in the manual or on the box that may be ignored, or phone calls from confused customers. That was my experience with my "smart" Internet connected TV and Blu-ray player. I've 'nmap' scanned them, and they look as they they've been Internet hardened.

It is also worth keeping in mind that the CPE itself may not be perfectly secure, and may be a target itself. If it is compromised, then any protection it used to provide may now be gone. I'd forgotten about it, however the ISP I worked for in 2009 had quite a number of customers who's CPE was infected by this malware:

http://en.wikipedia.org/wiki/Psyb0t


IIRC, impacted customers numbered in the 100s, I suspect because the CPE model was quite old at that point (it was already being sold in 2005 when I started there), so many customers had replaced it. It would have remained unnoticed by both us and the customers if it hadn't caused customers' Internet connections to fail.

The Carna Botnet also leveraged insecure CPE to conduct the "Internet Census 2012", which I think is further evidence that there shouldn't be absolute faith in the security of CPE . (http://lists.ausnog.net/pipermail/ausnog/2013-September/020338.html)

So I think device manufacturers would be wise to make a device/appliance protect itself, even if they believe there commonly might be an upstream networking device perform some sort of firewalling function.


Regards,
Mark.

 

 




> Regards,
> Markus
> 
> [1] 
> http://www.heise.de/security/meldung/Vaillant-Heizungen-mit-Sicherheits-Leck-1840919.html
> 
> 
> 
> __________ ursprüngliche Nachricht __________
> 
> Von:        Mark ZZZ Smith <[e-mail]>
> Datum:    Samstag, 16. November 2013, 07:30:13
> An:        Marc Lampo <[e-mail]>, Mikael Abrahamsson 
> <[e-mail]>
> Kopie:    "[e-mail] WG" <[e-mail]>
> Betr.:    Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC
> 
>>  >________________________________
>>  > From: Marc Lampo <[e-mail]>
>>  >To: Mikael Abrahamsson <[e-mail]>
>>  >Cc: "[e-mail] WG" <[e-mail]>
>>  >Sent: Thursday, 14 November 2013 9:50 PM
>>  >Subject: Re: [v6ops] draft-ietf-v6ops-balanced-ipv6-security WGLC
>>  >
>>  >
>>  >
>>  >I realise now that "unsolicited" is a word allowing multiple
>>  > interpretations (but also used in RFC 6092).  But we seem to have got 
> it
>>  > right.
>>  >
>>  >Anyway, the fact that some service, on an internal device, is willing 
> to
>>  > accept connections on port XYZ, does not, in my opinion, imply that 
> those
>>  > connections may also come from the outside Internet. Back to the 
> example
>>  > with the refrigerator :
>>  >suppose it has a service (port XYZ) that allows it to be queried for 
> its
>>  > contents.
>>  >
>>  >Probably great when one is at home, but does this mean accessible from
>>  > anywhere on the Internet ?
>>  >
>>  >In my opinion : not before the owner has explicitly instructed his CPE 
> to
>>  > allow incoming connections (RFC 6092, REC-48).
>> 
>>  Actually, I think you're probably going to want your refrigerator to be
>>  able to access the Internet, as well as your toaster, answering machine,
>>  rice cooker, washing machine etc.
>> 
>>  I think appliances, if they aren't already, are going to become 
> computers,
>>  with as much done via software/firmware as possible, instead of hardware,
>>  because hardware is much harder and more expensive to change, both during
>>  development and after it is sold to the customer.
>> 
>>  However, software/firmware is still hard to change if the customer has to
>>  either take it back to the manufacturer, or plug a PC or USB stick into it
>>  to update the software/firmware. Having the device be able to update itself
>>  over the Internet will be both much more user/customer friendly and much
>>  cheaper for the manufacturer. 
>> 
>>  So manufacturers have an incentive to make their appliances be able to
>>  attach to the Internet, and their customers have an incentive to attach
>>  them. As with tablets and smartphones, the manufacturer won't be able 
> to
>>  vouch for the existence of any upstream network "firewalls", nor 
> will they
>>  successfully be able to ask the customer of their existence, so the
>>  manufacturer will have to assume the worst, and therefore harden the
>>  appliance against publicly addressed unfettered Internet access.
>> 
>>  Regards,
>>  Mark.
>> 
>>  _______________________________________________
>>  v6ops mailing list
> 
>>  [e-mail]
>>  https://www.ietf.org/mailman/listinfo/v6ops
>