Subject: RE: home network security

From: "Rose, William" <[email-masked]>
Date: Fri, 7 Apr 2000 09:44:15 -0400

Marshall Eubanks Wrote:

>I would still classify this device as benign. It will not kill me,
directly, If all I have are
>benign devices, say a clock, a radio,  a TV, and window blinds, on my
zeroconfig net, then
>there is nothing that a neighboring 65 year old hacker (my son is tired of
being picked on :)
>can do to open my doors or burn down my house. If the radio starts spewing
Nazi
>propaganda at 3:00 AM, I can just turn it off. If there are non-benign
devices on the zeroconfig >net,
>then their being attacked by my TV is no different from being attacked from
the outside.
>
>What I think it is reasonable to do here is to recognize that
>
>  - threats exist (you cannot trust firewalls)
>  - you cannot separate the threat from the application
>  - really serious threats are unlikely to be consistent with zeroconfig.
(As an example, my
>Mother, whom I picture zeroconfig as being for, would not dream of
installing her own
>home security. She would hire / contract with someone to do it.)
>
>Here is a first cut on functions and their potential threats. These can be
listed  under three >broad
>areas :

>status   - real time reporting of the current state of a zeroconfig device
>     - respond to ACK type messages (i.e., "I'm up") - MAY be encrypted
>     - lists of home devices (i.e., "here are the stereo systems on this
net") - MUST be encrypted
>
>history - reporting of equipment activities over a period of time
>      - equipment state reports (i.e., things not under manual control,
like the cycling of the
>         refrigerator) MAY be encrypted
>      - user state reports (i.e., when I open the refrigerator door) MUST
be encrypted

>control - control of equipment
>      - benign equipment - MAY be encrypted
>      - non-benign equipment - MUST be encrypted and MAY subject to
authentication
>
>Notice that there is no distinction between reports sent on the local net
and those sent  outside.
>Firewalls are useful but cannot be trusted - every real penetration of a
system that I have
>direct personal knowledge of occurred (or would have occurred) INSIDE the
firewall.

Some comments and observations for what their worth:

Benign is in the eye of the beholder. Flashing lights, radios and TVs
turning on and off with or without objectionable material, shades going up
and down would be seen by many as very threatening. A system wide
transmission of something like Orson Well's "War of the Worlds" masquerading
as a news program might also be non-benign. To a customer and therefore a
manufacturer receiving the complaint, a device that doesn't do what the
customer expects due to a hack is a failed device and a serious expense.
That said, I don't think zeroconfig is the right place to fix all of the
problems. But at least it should be recognized that there is a lot of gray
areas between not burning down the home and truly benign. Door and window
locks may not stop a determined thief but they do keep out the riff-raff.
Likewise, having no security on a device or network is an invitation for all
to come in. 

Door and window locks, window openers, garage door openers, security
systems, HVAC systems, and the like will have heavier security added by the
manufacturer since they will be legally liable if they do not. Those that
don't do it right will be out of business quickly. Look at garage door
openers-they used to transmit in the clear but now all major manufacturers
use encrypted transmitters. If I have a home server with my personal files,
complete list of devices, control over my home systems, etc. on it,
certainly I would want some fairly strong security on it but I am not
certain that is zeroconfig's job.

I agree with Marshall's approach. I suggest that what manufacturers need is
guidance and the tools to do it right. Provide the ability to encrypt and
authenticate either directly or by reference to other standards. Give some
guidance as to what is a "shall" and "may" situation and then let the
individual manufacturer and customer decide from there. But make certain the
tools are available and standardized so that the system at a minimum can
keep out the riff-raff if not the determined thief. 

Bill Rose
Leviton

---

From: Thomas Marshall Eubanks <[email-masked]>
Date: Fri, 07 Apr 2000 10:20:24 -0400

Dear Bill;

"Rose, William" wrote:

> Benign is in the eye of the beholder. Flashing lights, radios and TVs turning on and off with or without objectionable material, shades going up and down would be seen by many as
> very threatening. A system wide transmission of something like Orson Well's "War of the Worlds" masquerading as a news program might also be non-benign. To a customer and
> therefore a manufacturer receiving the complaint, a device that doesn't do what the customer expects due to a hack is a failed device and a serious expense. That said, I don't
> think zeroconfig is the right place to fix all of the problems. But at least it should be recognized that there is a lot of gray areas between not burning down the home and truly
> benign. Door and window locks may not stop a determined thief but they do keep out the riff-raff. Likewise, having no security on a device or network is an invitation for all to
> come in.
>

I agree completely. The telephone can be very non-benign if you start to get threatening phone calls.
Thus  there  developed  a market for *69 and caller ID. Zeroconfig will develop likewise - the job here is
to set things in motion with reasonable guidelines.

>
> Door and window locks, window openers, garage door openers, security systems, HVAC systems, and the like will have heavier security added by the manufacturer since they will be
> legally liable if they do not. Those that don't do it right will be out of business quickly. Look at garage door openers-they used to transmit in the clear but now all major
> manufacturers use encrypted transmitters. If I have a home server with my personal files, complete list of devices, control over my home systems, etc. on it, certainly I would
> want some fairly strong security on it but I am not certain that is zeroconfig's job.
>
> I agree with Marshall's approach. I suggest that what manufacturers need is guidance and the tools to do it right. Provide the ability to encrypt and authenticate either directly
> or by reference to other standards. Give some guidance as to what is a "shall" and "may" situation and then let the individual manufacturer and customer decide from there. But
> make certain the tools are available and standardized so that the system at a minimum can keep out the riff-raff if not the determined thief.
>
> Bill Rose
> Leviton

                                                                                            Regards
                                                                                            Marshall

T.M. Eubanks
Multicast Technologies, Inc
P.O. Box 99
Clifton, Virginia 20124
Phone : 703-803-8141
Fax     : 703-222-3250
e-mail : [email-masked]