Subject: RE: home network security

From: "Bernard Aboba" <[email-masked]>
Date: Mon, 3 Apr 2000 12:09:09 -0700

It's hard to tell if we're "punting" until the threats are
clearly identified. Then at least we'll be able to say
what threats we are and are not addressing. So it seems
like a security analysis is needed here.

I liked Jeff Schiller's take on the threats: in a home
environment, one should assume that the threats are mostly
"external"; we do not necessarily need to go to a great deal
of effort to protect parents against denial of service
attacks by their children.

However, it is not as easy to define "external" as it might
seem. Defining this purely as someone outside the home
makes it difficult to support scenarios such as
connecting to the home network from the office.
For example, is it completely unreasonable that
someone might want to check on the status of their water heater
while at work?

I would also note that most of the threats are
not specific to zeroconf. That is, they exist
as much or more in a non-zeroconf home environment (say, running
NAT on ADSL or cable modem) as they do in a network that is running
on prefix 169.254/16. So we are really talking about a security
analysis of home networking.

Some thoughts on what kinds of threats might be worth addressing:

a. Threats of "external" parties bridging to the home network, either
   by design or without consent.

b. Threats of external parties controlling internal devices or hosts.

c. Threats of internal hosts being tricked into using bogus external
   services.

The above issues seem to boil down to first, putting some kind of firewall
capability in place and then making sure that an "external" party cannot get
around it by bridging to the inside network.

---

From: Aidan Williams <[email-masked]>
Date: Thu, 06 Apr 2000 10:34:01 +1000

> analysis of home networking.

I would have to agree with that sentiment.

However, the zeroconf requirements document would seem like
a good place to at least mention some of the risks associated
with home networking given that it is such an obvious application
domain.  Alternatively, it could be done as a seperate document
and referenced.

> around it by bridging to the inside network.

In a wireless home, keeping the "external" parties from bridging onto
your network can be hard (if you live in a block of flats for example).

It seems to me that wireless home networking results in a situation
where an attacker can be listening to your network on the "internal"
side of the firewall.  Link layer encryption is an obvious way to
prevent this from happening, but it requires configuration and is
by no means mandatory.  (I'm not at all convinced that many link
layer encryption schemes are really that strong either).

Given that we can't rely on layer two protection being there,
I think I would like to see some kind of requirement statement
to the effect that zeroconf protocols must be securable, but
that security does not need to be turned on by default.

This avoids complicating home networks over private wires,
but gives (in my opinion) an insurance policy when using IP
over wireless or powerline networks.

regards
        aidan
____
:wq!