Subject: [Iotops] (Home) user question: securing web access to insecure IOT web interfaces

From: Toerless Eckert <[email-masked]>
Date: Mon, 14 Feb 2022 17:47:45 +0100

Sorry if these are not the right list to ask this (pointers to better lists welcome),
but i stumbled across i think a common problem that i am now getting curious about:

- Many IOT devices / systems (controllers) have terrible security profiles.
  Many have just a port 80 web service without authentication. At least thats
  the case my question here is about as a starter.

- The typical answer from "the industry" is to provide remote access to them is "Use a VPN",
  So just for the sake of picking an example, lets assume its IKEv2/IPsec with
  a server side WebPKI certificate, client side user/password and filtering of all traffic
  except for said web server port 80.

- But of course, being able to simply use a browser is a lot more convenient,
  and arguably less user/client error-prone - because it does not require VPN client
  installation. Which then gets to the question:

- Are there any useful analysis defining what exactly would constitute the most
  simple (combination of) application layer security mechanisms that could be
  considered equal or better in terms of security against attacks than 
  such an IKEv2/IPsec VPN headend ?

  I assume it starts with something like reverse proxy with HTTPs+HTTP-auth, but
  IKEv2 also seems to have some simple DoS attack prevention that needs to be
  replicated, and then i guess the HTTPs connection also has some higher attack
  surface with all the messages one could try before successful authentication,
  HTTP message headers for example could provide information about the server side
  helping the attacker, etc. pp.

Thanks!
    Toerless

---

From: Paul Wouters <[email-masked]>
Date: Mon, 14 Feb 2022 16:20:59 -0500 (EST)

>  such an IKEv2/IPsec VPN headend ?

(m)TLS ?

>  helping the attacker, etc. pp.

The message parsing is generally not the problem. It is doing things
like DiffieHellman and Signature creation/validation that takes the
most CPU.

A reverse proxy of TLS endpoint should have enough resources to fend of
an attack similar to IKEv2.

Paul

---

From: Toerless Eckert <[email-masked]>
Date: Tue, 15 Feb 2022 00:22:17 +0100

> >  such an IKEv2/IPsec VPN headend ?

?

> The message parsing is generally not the problem.

I would assume every web server software whether open source or proprietary
has been analysef well enough to find any buffer overflow or similar
attack vectors. And given the flexibility of HTTP compared to the
much more constrained binary messages of IKEv2, i can imagine that there
is  much higher likelyhood of security relevant bugs. But i don't know
whether people have tried to quantify and compare.

>  It is doing things

Yes, i am not concerned abour resources, just about defining required
DoS protection mechanisms. 

Cheers
    Toerless

-- 
---
[email-masked]