[192434] in North American Network Operators' Group
RE: Spitballing IoT Security
daemon@ATHENA.MIT.EDU (Keith Medcalf)
Fri Oct 28 09:13:31 2016
X-Original-To: nanog@nanog.org
Date: Fri, 28 Oct 2016 07:13:26 -0600
In-Reply-To: <68ea3900-1d2f-507c-1192-6c43fe1a5f1f@ofcourseimright.com>
From: "Keith Medcalf" <kmedcalf@dessus.com>
To: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces@nanog.org
On Thursday, 27 October, 2016 22:09, Eliot Lear <lear@ofcourseimright.com> =
said:
> On 10/28/16 1:55 AM, Keith Medcalf wrote:
> >>> The problem is in allowing inbound connections and going as far as
> doing
> >>> UPnP to tell the CPE router to open a inbound door to let hackers
> loging
> >>> to that IoT pet feeder to turn it into an agressive DNS destroyer.
> >> Well yes. uPnP is a problem precisely because it is some random devic=
e
> >> asserting on its own that it can be trusted to do what it wants. Had
> >> that assertion come from the manufacturer, at least you would know tha=
t
> >> the device was designed to require that sort of access.**
> > And why would anyone in their right mind trust the manufacturer to make
> > this decision? <Shudder>
> Because the manufacturer designed the device and knows best as to what
> sort of access it will require.
Manufacturers of devices and Operating Systems (particularly Microsoft WInd=
ows) have proven over and over and over again that they cannot be trusted t=
o make that decision. One of the worst offenders, any versions of Windows =
subsequent to Windows XP, insists in dropping its knickers (opening the fir=
ewall) so that anything that wants to can fuck about with (connect to unres=
tricted from the internet) all the myriad of ever growing piles of shit inc=
luded by Microsoft. Even if you close the firewall, the Manufacturer belie=
ves it knows better and changes your settings, without your permission. If=
you are stupid enough to run UPNP on your network, then all the drivel fla=
rn filth is directly accessible from the internet (and beyond) without rest=
riction.
Preventing the manufacturer from doing that takes a *LOT* of *DEEP* surgery=
.
I wish that Ballmer fellow would just up and die, and that damn indian too,=
even more so. If they got some help along those lines the world would be =
a lot better place. They are both total asshats and enemies of security an=
d functionality everywhere.
However, it is not just a microsoft thing -- ALL of them think they know be=
tter and they should all fuck off and die.
> Consider that today most devices have
> unfettered outbound access, and many can arrange for unfettered inbound
> access. That's Not Good=C2=AE.
Yes, because that is what the device manufacturers have programmed the devi=
ce to do and to have, and to go to inordinate lengths to ignore any directi=
ons from the OWNER to the contrary. They should all be strung up by their =
balls and dropped with dull rusty pinking shears!
> That doesn't mean that network
> administrators shouldn't be the kings and queens of their castles, but
> as I'm sure you well know, home users don't really know how to rule, and
> so they need some good defaults.
What is wrong with OFF? That is a good default.
> Put it another way: you bring home a NEST and the first thing you the
> expert might do is read the net to figure out which ports to open. Are
> you really going to not open those ports?
First of all, I would NEVER bring home a NEST, nor would I ever allow a NES=
T or anything like it to be connected to my network. It is an evil device =
that does nothing of any use to me whatsoever. It is also dangerous and ma=
licious and will not permit me to control the damn thing, nor to retrieve d=
ata from it. It is a hunk of useless shit.
And no. Under no circumstances whatsoever do I open ports unless I know wh=
at they are for. And inbound port openings require proof of paid up indemn=
ity insurance in the millions per incident (trillion in total). Therefore,=
no inbound ports get opened since no one has ever been able to satisfy thi=
s requirement.
End of Line.
