Subject: Re: home network security

From: "Steven G. Ungar" <[email-masked]>
Date: Thu, 6 Apr 2000 13:58:45 -0400

Marshall, Daniel, Peter, Bill, et al:

I have been following this discussion with great interest, and have learned a
lot.

Marshall:

I fully agree with your analysis, but I would be interested in knowing how would
you classify, say, a digital television:  Is it benign or non-benign?  It
contains a rather powerful processor which could be used to harbor a Trojan
Horse that would operate throughout the home network, poking into data bases,
collecting interesting information about the home (such as when the burglar
alarm tends to be turned off, and where the safe is located), and sending that
information out to the world.  Yet, you can't expect a homeowner to tolerate a
security lock on her television; she's not going to log in every time she wants
to watch.  In other words, I think you are on to something with the
classification, but I think that there will be many everyday, commonly used
appliances, that will not be "benign."  Is it practical, for these devices, to
distinguish between access that originates within the home, and thus can be
considered friendly, and access that originates beyond the firewall, and must be
authenticated?

Steven Ungar,
Telcordia Technologies

Thomas Marshall Eubanks <[email-masked]> on 04/06/2000 12:36:46 PM

Please respond to [email-masked]

To:   Daniel Senie <[email-masked]>
cc:   [email-masked], [email-masked] (bcc: Steven G. Ungar/Telcordia)
Subject:  Re: home network security

Daniel Senie wrote:

> [email-masked] wrote:
> >
> > In a message dated 00-04-05 20:34:51 EDT, [email-masked]
writes:
> >
> > <<Given that we can't rely on layer two protection being there, I think I
> > would like to see some kind of requirement statement to the effect that
> > zeroconf protocols must be securable, but that security does not need to be
> > turned on by default.>>
> >
> > I've entered this discussion with the assumption that "zero configuration"
> > implies that we are working in an environment with *very* naive users, that
> > we can expect little or no responsibility on their part to administer the
> > network.
> >
> > Based on my observations, many (if not most) of these naive users have
little
> > or NO concept of security, not even the concept that they need security.
> > Based on recent experience with a DSL installation, ISPs are doing little or
> > nothin to educate customers with respect to security. My cynical belief
> > (which could well be erroneous) is that their legal counsel has advised them
> > that they will be less liable if they say absolutely nothing about the
topic.
> >
> > My own conclusion is that it would be unconscionable to offer "zero
> > configuration" products that do not have security enabled by DEFAULT. I
think
> > this is important enough that the eventual RFC state "security MUST be
> > enabled by default."
>
> So, your argument is: Because wireless layer 2 media has security issues
> that require configuration, we should abandon zeroconf in its entirely?
>
> Security for layer 2 wireless devices may well require configuration of
> devices at layer 2. In this case, such devices are not "zeroconf"
> devices. Please explain how you propose to reconcile zero configuration
> with security. We've gone around on this several times.
>
> Perhaps we should abandon much of zeroconf. We could REQUIRE a central
> "house controller" which allows the homeowner to type in the serial
> number (really the MAC address) of each device, including appliances,
> computers, and the blender, and then provide configuration and security
> via DHCP, as well as defining the trust relationship for outside access.
> The DHCP server obviously becomes a single point of failure, and a
> single point of security attack, but it does provide a place to deal
> with all of this various issues of security.

Hello;

   I think that a reasonable goal for zeroconfig should be : to provide Internet
connected devices that even your <insert name of favorite older relative>
COULD and WOULD use.

Pigs will fly before my Mother starts typing in all of of these serial numbers.
You could probably get her to enter her phone number and / or her address.
If you ask her for a password, she will probably use her phone number and / or
her address.
If she ever hears of someone's home being broken into because someone
(say) hacked in and figured that no-one was at home because the refrigerator
hadn't
been opened for 4 days, she will NEVER buy the system.

This suggests two levels of quasi-zeroconfig devices :

Benign devices, such as a stand alone Internet radio or  a printer, which can be
truly
zeroconfig BECAUSE THERE IS NO DANGER IF THEY ARE COMPROMISED.

Non-benign devices, such as a home security system, which will require some
configuration, such as the entry of a ID such as a phone number,
It would probably be a good idea if such a non-benign device

1.) Only accepted commands from packets with TTL = 1 and confirmation of
the ID from a central device.
2.) Required a manual override to be controlled from outside the zeroconfig
network.
(I.e., "you have to push the <security disable button> to allow us to upgrade
your
fire alarm"). This manual override should be of limited duration (say, 30
minutes).

To be a benign device :

The device cannot act in such a way as to cause any physical danger based on
commands from outside,
even from the zeroconfig net,  (such as instructing a stove to turn on and stay
on over the net)

AND

The device cannot convey any information about the state of the users (such as
the last time
the refrigerator door was opened).

Zeroconfig should therefore work to provide a specification for what makes a
device benign,
and therefore subject to zeroconfig. Maybe there should be a separate WG for
security and minimum configuration for non-benign devices.

Regards
Marshall Eubanks

>
> In the end, if we want security, we have to have configuration. If we
> are going to have to have configuration, then zeroconf fails, and it's
> time to abandon this WG and start a new one on home networking.
>
> --
> -----------------------------------------------------------------
> Daniel Senie                                        [email-masked]
> Amaranth Networks Inc.                    http://www.amaranth.com

T.M. Eubanks
Multicast Technologies, Inc
P.O. Box 99
Clifton, Virginia 20124
Phone : 703-803-8141
Fax     : 703-222-3250
e-mail : [email-masked]

---

From: Thomas Marshall Eubanks <[email-masked]>
Date: Thu, 06 Apr 2000 14:46:31 -0400

> Thomas Marshall Eubanks <[email-masked]> on 04/06/2000 12:36:46 PM

Dear Steven;

    That has to be part of what the WG DOES.  My personal feeling is that
if you buy a box off the shelf, you should be able to trust it not
to contain a trojan horse. If it does, the resulting lawsuits will probably
drive the manufacturer out of business. However, your point is a good
one that zeroconfig cannot ASSUME the absence of trojan horses, even
inside the home. (Your computer will likely be on this net, and may
certainly be compromised.) Maybe a benign
device cannot transmit out at all !

   For a benign device, deciding what comes from within the home and what does not
is not so important. Even if you spoof it, you cannot really do anything seriously wrong.
If my radio starts spewing out garbage, I can turn it off. It cannot kill me.

I agree that there will be many everyday, commonly used
appliances, that will not be "benign." A stove may be a good example -
ever forgotten about a tea kettle ?

   I think it is reasonable to expect a learning curve here - things that
seem benign now, may not after someone figures out a way to do something non-benign
with them.    I would again suggest that the working group, as a start,  derive a description of a
benign device :

1.) Incapable of causing physical harm, no matter what, either by its nature, or because of. e.g.,
physical interlocks.
2.) Cannot transmit information about the specific activities of the specific user, except
maybe to the vendor using strong encryption.

Consider a stand-alone Internet radio. Presumably it cannot be made to blow up, so # 1 is
a given. Number 2 could be satisfied if there was no way it could reveal its state.
Note that it could still receive a "turn on at 6:30- AM" message, and could even acknowledge it.
It should NOT be able to report, even within the home, if it was turned on manually at a specific time.

Note that at some level you have to trust the vendor. If that trust is violated, the vendor will not
stay in business.

Also note that there has to be a limit. Did you know that most devices do particular things to
the line voltage in your house as they are turned on and off ? A trojan horse could simply monitor
line voltage at its power input, and get a pretty good idea of activity patterns, and maybe
even identify particular actions, such as the TV turning on.

                                                                                            Regards
                                                                                            Marshall Eubanks

T.M. Eubanks