Hacker News Reader

Comment by indigochill | Hacker News Reader

Can someone educate me on one IoT point: devices presumably send and receive traffic over a router. That router presumably has security measures such as a firewall in place to reject malicious traffic. So, assuming a competent user, shouldn't security be primarily handled at the router level rather than the IoT device level? Of course IoT devices should also be secured, but my thinking is insecurity and lack of political motivation to regulate could probably be largely mitigated this way?

That said, I've more or less completely ignored IoT so far aside from passing interest in how easy Mirai was and I've only briefly dabbled in firewall configuration, so many of my assumptions could be wrong.

View on HN

"Assuming a competent user" is absolutely not what IoT is about, it shouldn't be what most of our decisions as engineers should be about. I don't want to have to be a "competent user" for my fridge, lightbulbs, sex toys - i.e. everything is potentially going IoT.

Separately, no - attacks like CSRF will quite happily be routed and compromise an incompetently designed IoT device.

I was thinking about blocking all traffic routed for the IoT device which comes from any address outside a set of explicitly trusted sources (such as the vendor's service and the user's smartphone or something). Then attacks like CSRF and default admin credentials become a moot point unless those trusted sources become compromised.

That's how CSRF works - I get you to communicate to the device from your "trusted" smartphone or other device. There is nothing you can do at the routing level to protect against it. It is entirely up to the endpoint receiving the request to have implemented proper CSRF protection against attacks.

CSRF has been around since 2001 and is in the OWASP top 10. It would be absolutely valid for regulators to require reasonable steps to be taken to prevent its abuse, along with similar attacks.

Home router security is pretty much a joke as well, often they're themselves the vectors of attacks. But even if not, it's hard (I'd say impossible) for a generic firewall to distinguish most malicious traffic that exploits application-level protocol bugs. Plus many of these devices rely on Cloud services that themselves can be hacked and used to exploit the device.

I assume there's an important distinction between general purpose PC traffic and IoT traffic, which is that IoT devices should usually communicate with a small set of external entities (let's say a vendor service and a user's smartphone). So we can ignore the content of the traffic and instead consider everything malicious by default if it doesn't come from a small set of explicitly trusted addresses.

This of course doesn't do anything to secure attacks via one of those trusted addresses, but does prevent someone just happening across an open device.

There's also the problem of coping with dynamic addresses, but that can probably be handled separately.

Not just dynamic addresses; mobile Internet carriers used NAT layers covering many devices, so a single address is used by many people at once: https://en.wikipedia.org/wiki/Carrier-grade_NAT

Routers do have a solution: some support setting up a VPN, to which the phone could securely authenticate against. But good luck getting users to configure that.

IOT devices tend to talk to a backend which is controlled by the vendor rather than the user.

Or they can be attacked over the LAN before the router gets a look at the traffic.

Reply on news.ycombinator.com