Subject: Re: home network security

From: "Steven G. Ungar" <[email-masked]>
Date: Thu, 6 Apr 2000 14:52:20 -0400

Marshall:

Thanks for your response, but I think you missed my point:

I am not so worried about  buying an infected DTV from Circuit City:  I am
worried about an intruder penetrating my firewall, gaining access to my home
network, finding an unprotected processor, for instance in my nice, clean DTV,
and loading a Trojan Horse into it.  It can then do nasty things, in the
background, that I would not know about until it was way too late.

Given that clarification, how do we classify my television, benign or not?  And
if not, how can we make it real hard for the above scenario to happen, without
making it so expensive or inconvenient for the homeowner that she is inclined to
either, a) take the risk or b) do without outside access to the home network.

Thanks,

Steven U.

Thomas Marshall Eubanks <[email-masked]> on 04/06/2000 02:46:31 PM

Please respond to [email-masked]

To:   "Steven G. Ungar" <[email-masked]>
cc:   Daniel Senie <[email-masked]>, [email-masked], [email-masked] (bcc:
      Steven G. Ungar/Telcordia)
Subject:  Re: home network security

"Steven G. Ungar" wrote:

> Marshall, Daniel, Peter, Bill, et al:
>
> I have been following this discussion with great interest, and have learned a
> lot.
>
> Marshall:
>
> I fully agree with your analysis, but I would be interested in knowing how
would
> you classify, say, a digital television:  Is it benign or non-benign?  It
> contains a rather powerful processor which could be used to harbor a Trojan
> Horse that would operate throughout the home network, poking into data bases,
> collecting interesting information about the home (such as when the burglar
> alarm tends to be turned off, and where the safe is located), and sending that
> information out to the world.  Yet, you can't expect a homeowner to tolerate a
> security lock on her television; she's not going to log in every time she
wants
> to watch.  In other words, I think you are on to something with the
> classification, but I think that there will be many everyday, commonly used
> appliances, that will not be "benign."  Is it practical, for these devices, to
> distinguish between access that originates within the home, and thus can be
> considered friendly, and access that originates beyond the firewall, and must
be
> authenticated?
>
> Steven Ungar,
> Telcordia Technologies
>
> Thomas Marshall Eubanks <[email-masked]> on 04/06/2000 12:36:46 PM

Dear Steven;

    That has to be part of what the WG DOES.  My personal feeling is that
if you buy a box off the shelf, you should be able to trust it not
to contain a trojan horse. If it does, the resulting lawsuits will probably
drive the manufacturer out of business. However, your point is a good
one that zeroconfig cannot ASSUME the absence of trojan horses, even
inside the home. (Your computer will likely be on this net, and may
certainly be compromised.) Maybe a benign
device cannot transmit out at all !

   For a benign device, deciding what comes from within the home and what does
not
is not so important. Even if you spoof it, you cannot really do anything
seriously wrong.
If my radio starts spewing out garbage, I can turn it off. It cannot kill me.

I agree that there will be many everyday, commonly used
appliances, that will not be "benign." A stove may be a good example -
ever forgotten about a tea kettle ?

   I think it is reasonable to expect a learning curve here - things that
seem benign now, may not after someone figures out a way to do something
non-benign
with them.    I would again suggest that the working group, as a start,  derive
a description of a
benign device :

1.) Incapable of causing physical harm, no matter what, either by its nature, or
because of. e.g.,
physical interlocks.
2.) Cannot transmit information about the specific activities of the specific
user, except
maybe to the vendor using strong encryption.

Consider a stand-alone Internet radio. Presumably it cannot be made to blow up,
so # 1 is
a given. Number 2 could be satisfied if there was no way it could reveal its
state.
Note that it could still receive a "turn on at 6:30- AM" message, and could even
acknowledge it.
It should NOT be able to report, even within the home, if it was turned on
manually at a specific time.

Note that at some level you have to trust the vendor. If that trust is violated,
the vendor will not
stay in business.

Also note that there has to be a limit. Did you know that most devices do
particular things to
the line voltage in your house as they are turned on and off ? A trojan horse
could simply monitor
line voltage at its power input, and get a pretty good idea of activity
patterns, and maybe
even identify particular actions, such as the TV turning on.

Regards
Marshall Eubanks

T.M. Eubanks
Multicast Technologies, Inc
P.O. Box 99
Clifton, Virginia 20124
Phone : 703-803-8141
Fax     : 703-222-3250
e-mail : [email-masked]

---

From: Rajesh Krishnan <[email-masked]>
Date: Thu, 6 Apr 2000 15:31:36 -0400 (EDT)

Classifying Internet radios or controls for window blinds as "benign" 
and therefore not requiring access security is troublesome.  If they 
have open control, and if firewalling is not an adequate answer 
(wireless bridging etc.,), then such devices could be turned off/on 
by unauthorized people.

In a sense, this means any device which is network controllable
or observable (if potentially carrying sensitive information) can
not be safely classified as benign. The Internet Radio is benign 
as long as I cannot turn it on or off or change the volume or 
station over the net.  Such network control could be a useful 
feature -- auto-mute-radio when getting a telephone call.  If the 
device can be controlled over the net, then security requirements 
come right back in.

The useful question I suppose is how many networked devices in the 
home would require security and what is the "cost" of providing 
such security.  If the number is sufficiently large (which I believe
to be true), and the cost is sufficiently low (which I do not know)
then classifying some devices as benign may not be particularly helpful.

If we are going to specify security as a requirement for at least some 
inexpensive zeroconf devices, then single chip network stack solutions 
which include zeroconf and security support will likely become available 
and benign could be simply a pin tied to the ground.

-Rajesh

---

From: Thomas Marshall Eubanks <[email-masked]>
Date: Fri, 07 Apr 2000 07:35:27 -0400

Dear Steven;

You are correct, I did misunderstand you.

I would still classify this device as benign. It will not kill me, directly, If all I have are
benign devices, say a clock, a radio,  a TV, and window blinds, on my zeroconfig net, then
there is nothing that a neighboring 65 year old hacker (my son is tired of being picked on :)
can do to open my doors or burn down my house. If the radio starts spewing Nazi
propaganda at 3:00 AM, I can just turn it off. If there are non-benign devices on the zeroconfig net,
then their being attacked by my TV is no different from being attacked from the outside.

What I think it is reasonable to do here is to recognize that

  - threats exist (you cannot trust firewalls)
  - you cannot separate the threat from the application
  - really serious threats are unlikely to be consistent with zeroconfig. (As an example, my
Mother, whom I picture zeroconfig as being for, would not dream of installing her own
home security. She would hire / contract with someone to do it.)

Here is a first cut on functions and their potential threats. These can be listed  under three broad
areas :

status   - real time reporting of the current state of a zeroconfig device
     - respond to ACK type messages (i.e., "I'm up") - MAY be encrypted
     - lists of home devices (i.e., "here are the stereo systems on this net") - MUST be encrypted

history - reporting of equipment activities over a period of time
      - equipment state reports (i.e., things not under manual control, like the cycling of the
         refrigerator) MAY be encrypted
      - user state reports (i.e., when I open the refrigerator door) MUST be encrypted

control - control of equipment
      - benign equipment - MAY be encrypted
      - non-benign equipment - MUST be encrypted and MAY subject to authentication

Notice that there is no distinction between reports sent on the local net and those sent  outside.
Firewalls are useful but cannot be trusted - every real penetration of a system that I have
direct personal knowledge of occurred (or would have occurred) INSIDE the firewall.

                                                                                            Regards
                                                                                            Marshall Eubanks

T.M. Eubanks