- iot-wg - mailman.ripe.net

Interest for a virtual RIPE 80 meeting
by sandoche Balakrichenan 18 Mar '20

18 Mar '20

Dear all, As you all know RIPE 80 will happen between 11-15 May 2020 in Berlin. With the Covid-19 situation, there is a query from the RIPE meeting Organisers to the chairs on whether there will be interests from the WG to continue with sessions and presentation in case of a remote meeting? In the event, there is a remote meeting, it will be shortened (may be it will happen in a single day) overall RIPE meeting. The chairs would like to know from the WG: A. Would you like to continue with sessions and presentations in the case of a remote meeting? B. If yes to A, do you think we could limit to one or two remote presentations (Overall max. time allocated to IoT WG could be 30 to 40 minutes)? We have already three interesting presentations planned for RIPE 80 or do you think we should allocate the time for presenting any other topic that needs to be discussed urgently. C. Would you envision anything beyond having speaker and slides available with chat and stenography? Thanks for your feedback. RIPE IoT WG Co-chairs, Sandoche and Jim.

6 6

EduRoam for IoT
by sandoche Balakrichenan 10 Dec '19

10 Dec '19

Dear all, I am sure that you might have all heard about EduRoam (https://www.eduroam.org/how/) We are in discussion with some academic partners to develop a platform similar to EduRoam for IoT, initially for Research purposes. The idea initially is to have IoT devices (e.g. LoRa devices) authenticated in visited networks based on its identifier. For example, a LoRa end-device which has established authentication in its home network (e.g. in University A) should be able to connect to a gateway and Network Server in a visited network (e.g. In University B) with the same security credentials. This is not a new idea. We can see that there have been related works at the IETF, WBA alliance etc. The purpose of this mail is to know if any of you are aware of similar work and will this topic be of interest for the RIPE community? Thanks for your suggestions, contacts, feedback. Sandoche.

3 4

New on RIPE Labs: How Consumer IoT Devices Expose Information
by Mirjam Kuehne 13 Nov '19

13 Nov '19

Dear colleagues, For those who missed Anna Maria Mandalari's presentation at RIPE 79, you can now read the summary of her interesting (and scary) research on RIPE Labs: How Consumer IoT Devices Expose Information https://labs.ripe.net/Members/anna_maria_mandalari_2/how-consumer-iot-devic… Kind regards, Mirjam Kühne RIPE NCC

1 0

New on RIPE Labs: Results of the IoT Hackathon
by Mirjam Kuehne 12 Nov '19

12 Nov '19

Dear colleagues, The tenth RIPE NCC hackathon took place just before RIPE 79. Four teams of community members worked on a number interesting projects related to the Internet of Things (IoT) and came up with some great results. Check out the findings on RIPE Labs: https://labs.ripe.net/Members/becha/results-of-the-first-iot-hackathon Kind regards, Mirjam Kühne RIPE NCC

2 1

RIPE 79 IoT WG Minutes
by sandoche Balakrichenan 01 Nov '19

01 Nov '19

Dear all, Thanks for reviewing the minutes below and providing your feedback, if any. It will be soon published in the website. Thanks to Marco for drafting the minutes. ---- **** ------- Minutes of the RIPE 79 IoT Working Group Date: 17 October 2019 Chairs: Sandoche Balakrichenan and Jim Reid Scribe: Marco Hogewoning (RIPE NCC) 1. Administrivia The chairs opened the session and introduced the agenda, then continued to introduce the first speaker. 2. The Security Lifecycle of an IoT Device Michael Richardson (Sandelman Software Works) Presentation available at:https://ripe79.ripe.net/archives/video/252 Michael, together with Eliot Lear (Cisco) presented on the different standards and mechanisms that exist to manage the security of IoT devices throughout their lifetime. Eliot also engaged in a short demo regarding a connected printer. Jelte Jansen (SIDN) asked whether there was room for third parties to warn the system about vulnerabilities in a particular device, such as the proposed DOTS â€œcall homeâ€ signal. Michael answered that such an approach would involve some challenges regarding who to trust, taking into account deliberate actions to disconnect a competitor or other forms of â€œdigital vandalism.â€ Alain Durand (ICANN) commented on the complexity of the system, pointing out the many moving parts, and noted that the home environment is a difficult place to protect. Eliot engaged in a small poll with the audience, asking them who believed that there is a role for the ISP to play in protecting the consumer. Whilst Malcom Hutty (LINX) commented the question was too binary, a quick show of hands revealed that although many supported the statement, there wasnâ€™t a clear majority. Eliot further shared his vision of this process being step-by-step, with a gradual implementation to provide agents with the necessary details and asking informative questions to the consumer such as: â€œshould I notify the manufacturer about this problem.â€ Michael shared an anecdote about insurance and the use of online â€œsmartâ€ locks. Malcolm Hutty in his role as consumer stated that the proposed model centered around the fact that the service provider knows best. Although this might work for the majority of consumers, it doesnâ€™t for him as he doesnâ€™t necessarily trust his provider and likes to tinker with the settings himself. Michael in response laid out a system where various MUD configuration files could work in unison and part of the information could even be crowdsourced. Benedikt Stockebrand (Stepladder IT) sought some clarifications on the type of device that could implement the proposed model. Michael clarified this was meant to run on the CPE and provided some details on the inner workings of the protocols. Peter SteinhÃ¤user (embeDD Gmbh) asked how much adoption there was, suggesting that more clarity regarding the liability for vulnerabilities could act as a driver for adoption. Eliot responded that a number of their enterprise systems had support for MUD and he knew several other companies were testing with it, confirming one of them even discovered a bug in the implementation. But he agreed that this still needed a push in the consumer market and adoption there might take a while. Eric van Uden asked if the proposed model was planning to make use of TR69 to control the CPE. Eliot confirmed that one of the parties testing had been CableLabs and they intent to use TR69 or equivalent models to provision the system. After Eliotâ€™s demonstration, Kai Storbeck (XS4ALL) asked if the system had any assurances with regards to compatibility or conformity, to which Eliot responded that people can always lie but it would be discovered. 3. Information Exposure from Consumer IoT Devices: A Multidimensional Network-Informed Approach Anna Maria Mandalari, Imperial College London Presentation available at:https://ripe79.ripe.net/archives/video/257/ Anna Maria presented on her study with a laboratory setup to discover IoT device behavior in regular domestic use. Marco Hogewoning (RIPE NCC) asked for clarification regarding the use of MAC addresses and Anna Maria confirmed that they are regularly seen in unencrypted payload as a form of device identification. Jim Reid (RTFM llp) asked if there was any intention to publish a â€œname and shame listâ€ and whether any of the devices was observed using DNS-over-HTTPs (DoH). Anna Maria responded it was a good idea and they were considering publishing some sort of classifier or ranking system to indicate a deviceâ€™s performance. She said that DoH was not seen in the test network. Jan Zorz (ISOC) offered to run the code in his own home environment to learn more. 4. Update on the IoT Hackathon Rotterdam 2019 Constanze Dietrich, LEXTA Consultants Group Presentation available at:https://ripe79.ripe.net/archives/video/259/ Constanze presented about the experiences and outcomes of the RIPE NCC IoT Hackathon that she helped to organise in the weekend ahead of the RIPE meeting. Jim Reid thanked the organising team, complementing them on the results. 5. Best Current Operational Practice (BCOP) Document in RIPE Scope for Proactively Mitigating IoT Attacks Jim Reid, RTFM llp Presentation available at:https://ripe79.ripe.net/archives/video/261/ Jim, making reference to earlier discussions in the community about creating a document, polled the room if there was still interest. When asked, several people in the room indicated they would be available to help out as volunteers. Sandoche thanked all the participants and closed the meeting.

1 0

clarification on BEREC consultation
by Jim Reid 17 Oct '19

17 Oct '19

Peter kindly pointed out that my earlier mail today on this topic mistakenly quoted an ETSI thing, not the BEREC consultation. Apologies for any confusion. The morning coffee hadn't kicked in when I sent the email. Well that's my excuse and I'm sticking to it. The important thing is unchanged though. The Connnect WG is leading the effort on a community response to the BEREC consultation on identification of the network termination point. If members of the IoT WG have input to that community response, please raise them in the Connnect WG. We can of course discuss BEREC's ideas here. However that is unlikely to influence whatever community response emerges from the Connect WG.

3 4

For information: ETSI releases IoT security standard
by Marco Hogewoning 17 Oct '19

17 Oct '19

Dear colleagues, The European Telecommunications Standardisation Institute (ETSI), earlier this week released their initial standard for securing IoT devices. The document is titled ‘Technical specification - Cyber Security for Consumer Internet of Things’ (ETSI TS 103 645), and states that its objective is, “...to support all parties involved in the development and manufacturing of consumer IoT with guidance on securing their products.” While it remains a very high-level document, containing many recommendations our community probably takes for granted, it could be helpful in guiding newcomers towards a more secure implementation of their IoT services and devices. The recommendations include items like, for instance, using non-default passwords. Although this is not yet a European Standard (EN) level specification, it is likely that any European standard specification in this area would be developed based on guidance from this document. In this context, a specification like this might also be reflected in product conformity guidelines such as the Radio Equipment Directive, that I posted about last week. The specification is available at https://www.etsi.org/deliver/etsi_ts/103600_103699/103645/01.01.01_60/ts_10… Regards, Marco Hogewoning RIPE NCC

4 4

[Reminder] Call for applications for the IoT hackathon, 12-13 October, Rotterdam
by sandoche Balakrichenan 06 Oct '19

06 Oct '19

Dear colleagues, As you are aware, RIPE is organising its first IoT hackathon on 12-13 October in Rotterdam, the weekend before RIPE 79. We still have some places and we would be happy if you would like to participate/contribute. There are lots of interesting projects : https://pad.riseup.net/p/IoT-hackathon-keep planned during the Hackathon If you would like to take part in any of the projects mentioned in the etherpad above or propose a new one, please apply before 10/10: https://www.ripe.net/participate/forms/apply/iot-hackathon-rotterdam-2019/ So that the organisers can confirm your participation before the event. You can find more information about the event on RIPE Labs: https://labs.ripe.net/Members/becha/iot-hackathon-at-ripe-79-in-rotterdam Thanks, Sandoche.

1 0

An IoT global warming hackathon in the SEE region, desc0n
by Desiree 25 Sep '19

25 Sep '19

Dear all I’d like to invite anyone interested to attend the 5th annual IoT hackathon, taking place on Oct 5,6 in Belgrade, just 1 week before the RIPE IoT hackathon itself. :) Theme for this year is, if and how can technology help alleviate and address the global warming global challenge. More info about workshops, datathon and hackathon can be found here: https://descon.me Desiree — @desc0n

2 1

RIPE 79 IoT WG Agenda (with description)
by Sandoche Balakrichenan 25 Sep '19

25 Sep '19

Dear all, Here's the agenda for the IoT working group session at RIPE 79 in Rotterdam. For the last two talks, there is no description, since they are self-explanatory. We're meeting on Thursday 17th October from 11:00 to 12:30. ==== 1. Administrivia 5 minutes 2. The security lifecycle of an IoT device by Michael Richardson (Sandelman Software Works) and Eliot Lear (CISCO) 50 minutes *Description :* The RFC8520 Manufacturer Usage Description (MUD) is a tool to describe the limited access that a single function device such as an Internet of Things device might need. The automatic enforcement of access control lists is a serious boon to security of residents and enterprises alike. While enterprises that set up firewalls typically have an idea of how they would respond to an incident,the same is not true for residential situations. The impact of a "Boy who Cries Situation" where an IoT firewall sends inappropriate warnings, the end result is that the firewall is turned off, is a situation worth avoiding through further automation of the security warning process. This talk proposes to standardize a series of processes and protocols for the quarantine and re-storartion of a device. 3. Databox as a Platform for Monitoring IoT Devices at the Edge by Anna Maria Mandalari (Imperial College) 15 minutes *Description : *The Internet of Things (IoT) is now a reality and many challenging issues still need to be addressed. One of this is to guarantee trust, privacy, and security. Privacy has become particularly pertinent after the initiative of the European Commission (EC) about the General Data Protection Regulation (GDPR). Since it has been demonstrated that ensuring privacy relying on the cloud creates risks of privacy violation, we propose to work at the edge. We first build an open access and flexible hardware platform for measurements and custom experimentation on IoT environment. The platform is composed by 87 IoT devices distributed in different locations and backend servers for collecting data. The platform allows to monitor and control the measurement process, and most important ensuring repeatability on the measurements and controlling context information. Through a total of 34,586 rigorous automated and manual controlled experiments, we characterize information exposure in terms of destinations of Internet traffic, whether the contents of communication are protected by encryption, what are the IoT-device interactions that can be inferred from such content, and whether there are unexpected exposures of private and/or sensitive information (e.g., video surreptitiously transmitted by a recording device). We highlight regional differences between these results, potentially due to different privacy regulations in the US and UK. Finally, we develop a Databox app for privacy analysis, a user-side application running locally allowing to monitor the IoT devices, interact with them, understand their operation and look for anomalies. Results will help companies to not accumulate personal data except what they actually require, in order to comply with the GDPR and give control back to the user. 4. Update on the IoT Hackathon Rotterdam 2019 by Constanze Dietrich (Lexta Consultants Group) 15 minutes 5. Best Current Operational Practice (BCOP) document in RIPE scope for proactively mitigating IoT attacks by Jim Reid (RIPE IoT WG Co-chair) If time permits X. AOB ==== -- The RIPE IoT Working Group Chairs Jim and Sandoche

1 0