News for hackers. Stuff that matters.

A comment on Say Cheese: a snapshot of the massive DDoS attacks coming from IoT cameras. Parent comment

Re:Say Cheese: a snapshot of the massive DDoS attacks coming... by TeMPOraL on Tuesday October 11, 2016 @05:29PM (#12688672)
IoT should be Intranet of Things, not Internet of Things. I'd say it's simple as that. But the commercial interests are so opposed to engineering sanity that I have no idea how to tackle it.

Maybe someone should start enforcing mandatory VPNs for households? I.e. I get you want to control your LED bulbs from your phone, but that doesn't imply they should be accessible from public Internet.

Also I wonder if the whole thing isn't just a symptom of a problem that we can no longer expand connected technologies while expecting zero knowledge from end users. Maybe it's about time to require some minimum amount of computer knowledge from citizens of a technological civilization?

[ Parent | on HN ]
Re:Say Cheese: a snapshot of the massive DDoS attacks coming... by codedokode on Wednesday October 12, 2016 @10:00AM (#12692856)
I think so too. Public networks are networks full of hackers and NSA agents. The VPN-like protocol should be built into device so it doesn't accepts any packets not coming from its home network. And VPN (unlike SSL) allows encrypting traffic for external obverver while keeping it plaintext for owner.
[ Parent | on HN ]
Re:Say Cheese: a snapshot of the massive DDoS attacks coming... by icebraining on Tuesday October 11, 2016 @06:19PM (#12688995)
Maybe someone should start enforcing mandatory VPNs for households? I.e. I get you want to control your LED bulbs from your phone, but that doesn't imply they should be accessible from public Internet.

You don't even need a VPN, just have the device only accept connections from local IPs (and use TCP to avoid spoofed IPs).

[ Parent | on HN ]
Re:Say Cheese: a snapshot of the massive DDoS attacks coming... by pdkl95 on Tuesday October 11, 2016 @08:02PM (#12689480)
That allows attacks comes from another compromised device or TCP SYN packet that uses unusual routing. We've already seen Javascript based attacks that use the browser as a gateway to the LAN.

You need strong authentication and secure (proven input recognizer[1]) code in anything that connects to any network, even a guaranteed LAN. Border security is only one layer of protection, and LANs are rarely an isolated network.

[1] https://media.ccc.de/v/28c3-4763-en-the_science_of_insecurit...

[ Parent | on HN ]
Re:Say Cheese: a snapshot of the massive DDoS attacks coming... by codedokode on Wednesday October 12, 2016 @10:02AM (#12692875)
That doesn't work universally, for example when your device is at home and your smartphone is in another country. Using VPN allows to build a secure network over public infrastructure.
[ Parent | on HN ]
Re:Say Cheese: a snapshot of the massive DDoS attacks coming... by riskable on Wednesday October 12, 2016 @09:13AM (#12692460)
If something has a connection to the Internet--even if only through a proxy--we must treat it and all devices on the same network as if they are connected to the Internet. Because they are!

If Internet connections worked like radio broadcasts (one-way) then we'd be fine but they are inherently two-way connections. That means that for every outbound request a hole is opened up for return traffic. Even if you think, "that doesn't count" one must still account for the fact that PCs get compromised via side channels all the time and are subsequently used as pivot points for further attacks on any attached networks.

We need to stop treating intranets like they're somehow "safe" or special places apart from the Internet. They're not.

Always treat every device on any network as if it is being placed directly on the Internet because most of the time it really is. NATs and proxies aren't security tools even if they pretend to be.

[ Parent | on HN ]