Subject: [Dtls-iot] "Apple Stores Will Sell a Smart Lock for Your Front Door"

From: "Rahman, Akbar" <[email-masked]>
Date: Tue, 14 Oct 2014 16:12:34 +0000

Hi Carsten/Michael,

(And changing the Email subject)

I found this article also very interesting (and it contained some relevant references to the smart lights and electronic keys use cases that had been previously discussed on these lists).

http://www.businessweek.com/articles/2014-10-14/apple-stores-will-sell-yves-behars-smart-lock-for-homekit#r=read  

Best Regards,

Akbar

-----Original Message-----
From: Ace [mailto:[email-masked]] On Behalf Of Carsten Bormann
Sent: Sunday, October 12, 2014 2:53 AM
To: StJohns, Michael
Cc: [email-masked]; [email-masked]
Subject: Re: [Ace] [Dtls-iot] Interesting article on IOT security from real world liability perspective

On 12 Oct 2014, at 07:11, StJohns, Michael <[email-masked]> wrote:

> http://money.cnn.com/2014/10/08/technology/security/internet-of-things-security/index.html?iid=HP_LN&hpt=hp_bn5

If you take the effort to look at the vulnerabilities reported, it is interesting to see that they are all exploiting the lame security model for today's home networks: A single shared-key WiFi password that grants access to everything.

The LiFX vulnerability was caused by the light bulbs needing to tell each other that shared-key WiFi password over the (unsecured) 802.15.4 network.  (Well, it was dumb enough to communicate that key in an unsecured fashion, but the damage that LiFX could cause was much worse due to the sensitivity of the WiFi key.)

The Belkin camera vulnerability was caused by handing out the permanent keys for cloud access to the camera to anyone that had access to the WiFi network, even temporarily.  (That was probably considered OK because the shared-key protected home network is "secure", no?)

Instead of having this simple-minded perimeter security, we need to move to real, authenticated authorization.  That's what ACE is about.

Of course, as long as the IoT devices need the WiFi password to access the network, and other devices in the home rely on lame WiFi perimeter security, those other devices will remain vulnerable to any bugs in the IoT devices.  If you want to keep those lame other devices, the only solution here is to firewall them off.  (Using IPv6 for the IoT devices helps quite a way here.)

The next time you read one of those dime-a-dozen articles about "IoT security", read closer and find out they are really a lament about today's lame home network security model.

Grüße, Carsten

_______________________________________________
Ace mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ace