- iot-wg - mailman.ripe.net

Bad actors
by Wolfgang Tremmel 10 Oct '18

10 Oct '18

Hi, Interesting read about bad actors of IoT vendors (well, one vendor): https://krebsonsecurity.com/2018/10/naming-shaming-web-polluters-xiongmai/ best regards Wolfgang -- Wolfgang Tremmel Phone +49 69 1730902 26 | Fax +49 69 4056 2716 | Mobile +49 171 8600 816 | wolfgang.tremmel(a)de-cix.net Geschaeftsfuehrer Harald A. Summa | Registergericht AG Köln HRB 51135 DE-CIX Management GmbH | Lindleystrasse 12 | 60314 Frankfurt am Main | Germany | www.de-cix.net

7 15

draft agenda for RIPE77
by Jim Reid 21 Sep '18

21 Sep '18

Here’s the draft agenda for the WG meeting next month. Other than tweaks to the running order, there shouldn’t be any significant changes. See you all in Amsterdam! # # $Id: agenda,v 1.4 2018/09/21 08:40:30 jim Exp $ # 1. Administrivia 2. NCC Update Marco Hoegwoning - RIPE NCC 3. The Internet of Threats: fighting FUD with MUD Michael Richardson - Sandelman Software Works For many internet organizations, the #1 risk on their risk register is a large scale (Dyn like) DDoS attack. One of the mitigation mechanisms for this risk is to prevent weaponization of consumer grade connected devices --- to keep Things from becoming Threats. What we need are security controls that will protect IoT devices from the internet, and to protect the internet from IoT devices. CIRALabs's Secure Home Gateway project is developing a comprehensive extension to the common OpenWRT code base to include processing of IETF standard Manufacturer Usage Description (MUD) files. 4. Police perspective on IoT, challenges & strategy Jaap van Oss, Manon den Dunnen - Politie The accelerated deployment of IoT is reshaping society and offers new opportunities and threats in the area of safety. Privacy, security and collaboration are fundamental in addressing the challenges. In this presentation we'll share how we look at the IoT domain, what steps we take and the struggles we face. 5. Security Problems in IoT Thomas Stols - Computest Computest has a lot of experience (security) testing various IoT devices. During this talk we’ll give the viewer some insight in common security problems we see during our daily work. 6. The Internet-of-Insecure-Things: Causes, Trends and Responses Arman Noroozian - TU Delft We know poorly secured IoT devices are flooding our markets. And we know they get compromised at scale. Why is this so hard to stop? We look at the underlying causes for why this problem persists. Next, we explore data on where compromised IoT is located, what kind of devices are affected and which networks have the higher concentrations. We end by exploring different responses to help mitigate these threats, with a special focus on the role of network operators. 7. AOB

1 0

agenda items for RIPE77
by Jim Reid 05 Sep '18

05 Sep '18

Colleagues, if you have suggestions for agenda topics or presentations for the WG session next month, please send them to iot-wg-chairs(a)ripe.net. There are fabulous cash prizes on offer. Well OK, maybe not. :-)

1 0

RIOT Summit: Registration open
by Matthias Waehlisch 13 Aug '18

13 Aug '18

Dear RIPE IoT WG, the third RIOT Summit (http://summit.riot-os.org/) will take place in Amsterdam, Netherlands at the Science Park Congress Center on September 13-14, 2018. The first day is dedicated to single-track presentations. The second day allows for break-out sessions and coding. If you want to attend, please register as soon as possible: https://riot-summit18.eventbrite.com/. This is a great opportunity to meet the community behind RIOT, the friendly open source operating system for the Internet of Things. **Talks** Keynote by Jaime Jiménez (Co-chair of IETF CoRE Working Group and Master Researcher @ Ericsson) More speakers: http://summit.riot-os.org/2018/#speakers **Social* After the talks of the first day, we have organized a casual BBQ at the Rolling Rock Kitchen (http://rollingrockkitchen.com). Food is sponsored. **Hotels** Please note that Amsterdam is pretty crowded during the week of the RIOT Summit. Book soon! You should also consider options such as hotwire.com, airbnb, or accommodations in Utrecht (~40 minutes by public transport). **Registration** Participation at the RIOT Summit is free of charge. However, registration is required: https://riot-summit18.eventbrite.com/ *Supporters** We gratefully thank the following companies for their generous support: Cisco, RIPE NCC, SIDN Labs, STMicroelectronics, wolfSSL, Zühlke. We also thank Freie Universitaet Berlin, HAW Hamburg, and INRIA. Looking forward to meet you in Amsterdam! Cheers matthias -- Matthias Waehlisch . Freie Universitaet Berlin, Computer Science .. http://www.cs.fu-berlin.de/~waehl

1 0

2nd EUROPOL-ENISA IoT Security Conference 2018
by Marco Hogewoning 10 Aug '18

10 Aug '18

Dear Colleagues, For the second year in a row, Europol and ENISA are co-organising a conference to raise awareness on the security implications of the Internet of Things (IoT). The conference aims to enable a broad discussion by bringing together experts from cybercrime units, CSIRTs, international organisations, private industry, regulatory agencies, and academia, with particular focus on hands-on and demo sessions. This conference will be on 24 and 25 October 2018 at the Europol headquarters in The Hague. The three main sessions of the two-day conference will focus on: • Industry 4.0 (confirmed speakers: KPN, SAP Labs, Barbaraiot, Bosch) • IoT Application Domains and Case Studies (confirmed speakers: BMW, Airbus, Continental, Vtolabs, GSMA) • Emerging IoT trends (confirmed speakers: IBM, RiskIQ, Shadowserver, CSA, Pentest Partners ) This conference is by invitation only, but Europol has informed us that they are happy to accommodate for a few interested participants from this Working Group and extend an invitation to them. If you are keen in attending this conference, please send me an email including a short bio and contact details and we will pass this on to our colleagues at Europol and coordinate with them concerning the invitations. Please note that places are limited and we cannot guarantee that you will receive an invite. Also importantly, this only concerns the invitation, this event is not funded and participants are required to make and fund their own travel arrangements and accommodation. Regards, Marco Hogewoning -- Senior External Relations Officer RIPE NCC http://www.ripe.net

1 0

co-chair selection procedure
by Jim Reid 19 Jul '18

19 Jul '18

We still have to sort out an appointment procedure and that's my fault. Sorry. It was too easy to procrastinate when $dayjob got in the way. Anyways, we need to get something sorted soon. Ideally, I'd like to get WG agreement by mid-September (allowing for the summer holidays). That would allow us to run the appointment process and have a stuckee in place before RIPE77 (Oct 15-20th). If you have concerns that more time is needed for either agreeing a procedure or then using it, please speak up. I would also ask the WG to avoid the temptation to rat-hole or over-think the selection procedure, for instance by proposing elaborate steps to apply in corner cases that in all probability will never arise. We're just appointing a WG co-chair, not the Internet's Supreme-Leader-for-Life. We can always change the suggested process later if practical experience proves it is broken or needs improvement. I hope we can just put something quick and simple in place that solves the immediate need. Note too that there is no mention of elections or votes. This is deliberate. Can we live with the following? (1) The IoT WG will have 2 co-chairs who serve staggered 2-year terms. (2) A co-chair cannot serve more than 3 consecutive terms. (3) Each year, the longest serving co-chair will stand down and subject to (2) may make themselves available for re-appointment. (4) The incoming co-chair will be chosen by the WG using consensus and the remaining co-chair will make the consensus determination. (5) Any circumstances not covered by the above will be resolved by the RIPE Chair whose decision will be final.

4 3

Draft minutes from RIPE76
by Jim Reid 19 Jul '18

19 Jul '18

Colleagues, here are the draft minutes from the WG meeting in Marseille. My thanks to Amanda for taking such excellent notes. Please let me know if there are any corrections or ommissions. IoT Working Group Minutes - RIPE 76 17 May 2018, 14:00 - 15:30 WG Chair: Jim Reid Scribe: Mirjam Kühne Status: draft The presentation is available at: https://ripe76.ripe.net/archives/video/124 1. Administrivia Jim Reid opened the meeting and explained that the WG chair selection process is still ongoing. He will pick this up on the mailing list again. It is expected to conclude this within the next few months so that the WG will have selected chairs at the next RIPE meeting. 2. Report on RIPE NCC IoT Activities Marco Hogewoning, RIPE NCC The presentation is available at: https://ripe76.ripe.net/archives/video/125 Jim expressed his personal thanks to Marco for helping to get the IoT WG off the ground. There were no further questions. 3. Privacy Implications of Sewage Testing for Illicit Drugs Elif Sert, Istanbul Bilgi University The presentation is available at: https://ripe76.ripe.net/archives/video/127 Jim asked if there are any indications that this data might be cross-referenced with other types of data to get closer granularity (i.e. the bus network)? Elif responded that this sounds indeed very possible. This particular research data was for instance merged with geographical and mobile phone data, but it was not clear what the results were. The goal was definitely to get more accurate results (on groups and individuals). Hugo Vincent, ARM Research, reported that they have seen quite a lot of progress in the last couple of years in regulating privacy for individuals. He wondered if there were any groups or organisations that were making progress around trying to define how to regulate group privacy? Elif said that there is some research on this and that some books have been published on this topic. She added that at the moment they have a very individual way to look at privacy, and that they might have to lift it up to the group level in order to better protect people. 3. RIOT: Networking from the Friendly OS Perspective Matthias Waehlisch, FU Berlin The presentation is available at: https://ripe76.ripe.net/archives/video/128 Jim asked what the next big thing would be for RIOT. Matthias explained that one thing there were working on were automatic updates for the devices, preferably over the air and secure. Another thing was an easy system to share applications, working on an app store. 4. SPIN: Security and Privacy for In-Home Networks Jelte Jansen, SIDN The presentation is available at: https://ripe76.ripe.net/archives/video/130 Matthias Waehlisch asked if Jelte was aware of the people from Princeton (referring to the IoT inspector). Jelte said that he was aware of them, but that he had no contact yet. Jim said he was fascinated to hear that Jelte’s TV was actually talking to Facebook and wondered if it wouldn’t be a useful service for end users to have some kind of a Little Snitch sitting on the home router reporting what weird things a TV, fridge, kettle etc., werere doing in the background. He asked Jelte if he has considered such a service. Jelte answered that he would like to actually visualise that. However, this could only be done in real time. Looking into the actual data would cause a whole new set of privacy problems. He clarified that one of the reasons this was a research project is that they wanted to look into how they could efficiently report what kind of things people's devices were doing. Niels Bakker asked on the chat channel what Jelte’s ISP was that kept disconnecting him. Jelte didn’t want to mention the name, but said it was a helpdesk service by Ziggo that was responsible for the building he lives in and he didn’t have a choice. Someone else mentioned on the chat channel that there were products on the market that do per-device 'parental controls', like FRITZ!Box, that any end user can use to easily isolate their IoT devices, wired or wireless. Jelte said that he was aware of this, but they were usually restricted to things like parental control. 5. Securing IoT Devices - Closing the Gaps Hugo Vincent, ARM Security The presentation is available at: https://ripe76.ripe.net/archives/video/132 Alain Durand, ICANN, asked what would happen if these devices were to live for 25 years. How does one manage trust anchors if devices are powered down for many years? Hugo said that this was obviously a big challenge. One needs to have strong hardware identity to be able to make sure that this is still the same device later on. Alain added that he thinks authentication has to go both ways. Hugo agreed. Vesna Manojlovic, RIPE NCC, suggested that since Hugo was considering very long terms, to also look at sustainability. Where will the material come from and what about recycling and waste? Hugo said that this was a fantastic question and that he was definitely interested in overall global efficiency. He said ARM wanted to make the device as sustainable as possible and that they were looking at extremely low power usage. They’re doing work with plastic semi-conductors for example to reduce the energy input into the device compared to silicon. He agreed that this was a very important question. Vesna asked if Hugo would be willing to present about this topic at the next RIPE Meeting. Hugo answered that one of his colleagues could definitely do that. Petr Špaček, CZ.NIC, asked to let him know when they found a way to solve the trust anchor issue, because the domain name community has been struggling with that problem for years already. Jim commented that ARM was in a very interesting position in this particular marketplace and that there was a lot of good things they could do to encourage their partners to have a security framework for the live updates of IoT devices. He also suggested to consider open sourcing some of that work. Hugo responded that a lot of their IoT stack was already open source. He agreed that they don’t only have the opportunity but the responsibility to improve security of IoT devices. 6. Role for the Name and Numbering Community in the IoT Domain Sandoche Balakrichenan, AFNIC The presentation is available at: https://ripe76.ripe.net/archives/video/134 Marco Hogewoning clarified that from the RIPE NCC’s perspective, IPv6 addresses are not good for identification. A lot of people want both: a fixed identifier and at the same time an identifier to deliver traffic to the device where ever it is. This can be solved. But as the RIPE NCC we would like some guidance from the community how to handle this. Jim added that it would be good if the speaker could help to do some outreach into these other communities in the area of IoT. He recommended to find out what the problem statements and approaches are and to encourage them to come to the meetings and participate. Victoria Risk, ISC, asked if the speaker had considered using MAC addresses as identifiers. Sandoche responded that in LowRa they are using UI64 (which is a bit like a MAC address). He said that for locating communication in a computers, one could use a MAC type UI64 address and for the communication between the protocols on the Internet, one could use IPv6. But they will still have to see if this would work. 7. AOB Jim Reid closed the meeting and encouraged everyone to participate in the IoT/IPv6 discussion taking place in the IPv6 WG later that afternoon.

1 0

AFNIC and the IoT
by Gordon Lennox 09 Jul '18

09 Jul '18

Afnic have published an issues paper on the IoT. You can find the English language version here: https://www.afnic.fr/en/about-afnic/news/general-news/11093/show/issue-pape… Gordon

1 0

Fwd: CRYPTO-GRAM, May 15, 2018
by Jim Reid 15 May '18

15 May '18

In case some of you don't read Cryptogram (why not?)... > Begin forwarded message: > > From: Bruce Schneier <schneier(a)schneier.com> > Subject: CRYPTO-GRAM, May 15, 2018 > Date: 15 May 2018 at 06:07:08 BST > To: jim(a)rfc1035.com > Cc: Crypto-Gram Mailing List <crypto-gram(a)lists.schneier.com> > > Researchers at Princeton University have released IoT Inspector, a tool that analyzes the security and privacy of IoT devices by examining the data they send across the Internet. They've already used the tool to study a bunch of different IoT devices. Their first two findings are "Many IoT devices lack basic encryption and authentication" and "User behavior can be inferred from encrypted IoT device traffic." No surprises there. > https://freedom-to-tinker.com/2018/04/23/announcing-iot-inspector-a-tool-to… <https://freedom-to-tinker.com/2018/04/23/announcing-iot-inspector-a-tool-to…> > https://iot-inspector.princeton.edu/ <https://iot-inspector.princeton.edu/> > https://boingboing.net/2018/04/23/promiscuous-mode.html <https://boingboing.net/2018/04/23/promiscuous-mode.html>

1 0

updated WG agenda for RIPE76
by Jim Reid 08 May '18

08 May '18

Colleagues, here's an updated agenda for next week. This should be the final version -- famous last words! -- but the running order may change, # # $Id: agenda,v 1.3 2018/05/08 08:56:19 jim Exp $ # 1) Administrivia 2) Report on NCC IoT Activities Marco Hogewoning, RIPE NCC 3) Privacy implications of sewage testing for illicit drugs Elif Sert, Istanbul Bilgi University In smart cities of the future, many IoT devices will be deployed to monitor community behaviour while being designed not to collect personal data in order to preserve individual privacy. This presentation will question this view by examining the phenomenon of sewage testing to monitor community use of illicit drugs in communities 4) RIOT: Networking from the friendly OS perspective Matthias Waehlisch, Freie Universitaet Berlin RIOT is the friendly operating system for the Internet of Things, targeting low-power IoT devices. In this presentation, we will report about the networking stack and deployment scenarios of this open source project. 5) SPIN - Security and Privacy for In-home networks Jelte Jansen, SIDN The SPIN project at SIDN Labs aims to explore - and prototype - methods so improve the security and privacy of home networks with regards to the IoT. Within SPIN, we research several topics, such as device traffic visualisation, automated recognition of (bad) patterns, device descriptions, and abuse handling. 6) Securing Internet of Things Devices: Closing the Gaps Hugo Vincent, ARM A lot has been published about the (in)security of Internet of Things (IoT) devices during the past few years. There is also no shortage of good ideas on how to secure IoT devices and the infrastructure. This presentation gives a brief overview of the comprehensive security approach developed by ARM to secure IoT devices and provides links to relevant software and hardware. 7) Role for the numbering and naming community in the IoT domain Sandoche Balakrichenan - AFNIC Both the numbering (RIRs such as RIPE) and naming communities (domain name registries such as Afnic) play an vital role in the current Internet infrastructure. This talk will focus on how the earlier mentioned communities will play the same vital role in the IoT domain. 8) AOB

1 0