Subject: RE: home network security

From: Barr John-ARES35X <[email-masked]>
Date: Mon, 3 Apr 2000 15:25:32 -0500

I agree that security in the home is extremely important with the coming
proliferation of always on connections (cable and DSL) and the use of
residential gateways, cable modems supporting multiple connections via
HomePNA, and service gateways (see http://www.osgi.org <http://www.osgi.org>
). One of the current solutions is to create an open network in the home
with an appropriate firewall similar to those found in major corporations
protecting the easy to use home environment from the open Internet. Access
from the external Internet will be necessary and must be secure.
 
Regards, John

-----Original Message-----
From: Rose, William [mailto:[email-masked]]
Sent: Monday, April 03, 2000 2:53 PM
To: [email-masked]
Subject: RE: home network security

I agree the internal threats are best left alone. However, everyone in the
home automation and home networking industry is expecting external access to
their products for monitoring, control, service information (as in the
advertisement for the refrigerator that calls for service automatically),
etc. Without a secure connection, these applications will be forced to use
their own security solutions. And if each use their own solutions, it will
be very unfriendly to the customer (multiple passwords/keys) and very
difficult to get interoperable applications such as a personal WEB page with
unified access to all enabled devices as well as push services for news,
finance, entertainment, etc. I understand (I think) that a zeroconfig
network might become configured when connected externally but an unconnected
home network is not very useful for the products being planned by the
product manufacturers. 

I think that ignoring the security issue is a mistake. Make it an option if
necessary but define a minimal solution at least by reference. Regardless of
what happens in the future (years from now), the first home products (other
than PCs and PC like products) will not be sitting directly on an IP
network. They will be on a cluster network and link to an IP network through
a proxy or other "black box" (I am trying not to use the wrong term for the
interface device). I hear that the necessary code etc. will only require a
small increase in memory and processor cycles but the fact is the cost to
connect devices is still a major issue. Even 10baseT is expensive for these
devices and it requires new wires. The reality is power line carrier or low
speed wireless (kbps)for retrofit homes and RS485 over CAT 5 for new homes.
A proxy for the cluster will connect them to the external world. It is that
connection to external world that needs some level of security defined so
every cluster network interface can depend on a consistent minimal security
approach. Producers can add more if they want. Let the system come up with
security on by default and let the customer turn it off if that is their
choice but don't "punt". 

Bill Rose 
-----Original Message----- 
From: Bernard Aboba [ mailto:[email-masked]
<mailto:[email-masked]> ] 
Sent: Monday, April 03, 2000 3:09 PM 
To: [email-masked] 
Subject: RE: home network security 

It's hard to tell if we're "punting" until the threats are 
clearly identified. Then at least we'll be able to say 
what threats we are and are not addressing. So it seems 
like a security analysis is needed here. 

I liked Jeff Schiller's take on the threats: in a home 
environment, one should assume that the threats are mostly 
"external"; we do not necessarily need to go to a great deal 
of effort to protect parents against denial of service 
attacks by their children. 

However, it is not as easy to define "external" as it might 
seem. Defining this purely as someone outside the home 
makes it difficult to support scenarios such as 
connecting to the home network from the office. 
For example, is it completely unreasonable that 
someone might want to check on the status of their water heater 
while at work? 

I would also note that most of the threats are 
not specific to zeroconf. That is, they exist 
as much or more in a non-zeroconf home environment (say, running 
NAT on ADSL or cable modem) as they do in a network that is running 
on prefix 169.254/16. So we are really talking about a security 
analysis of home networking. 

Some thoughts on what kinds of threats might be worth addressing: 

a. Threats of "external" parties bridging to the home network, either 
   by design or without consent. 

b. Threats of external parties controlling internal devices or hosts. 

c. Threats of internal hosts being tricked into using bogus external 
   services. 

The above issues seem to boil down to first, putting some kind of firewall 
capability in place and then making sure that an "external" party cannot get

around it by bridging to the inside network.

---

From: "Rose, William" <[email-masked]>
Date: Tue, 4 Apr 2000 10:44:10 -0400

>I'd like to see Zeroconf make headway, and am not sure getting into
defining the trust relationships with General Electric, Whirlpool, Sears
and other such companies is a good use of that time.

Agreed, trust in companies is not a productive discussion. Trust in a 
secure connection for access and control for a homeowner is. Discussions in
HN meetings 
include levels of access. A service/repair person might have access to a
refrigerator's 
health but not the ability to turn it off. Manufacturers can provide
application 
level security that block access to potentially harmful functions 
unless the homeowner grants it. I don't think zeroconfig needs to define
that type 
of security. The issue is providing a level of security that will give the
homeowner 
access to all functions he/she wants without anyone else having that access
unless 
given it. The question is how to standardize the security so manufacturers
can add 
it to their products without having to support multiple approaches or the
homeowner 
having different configurations for different products. Security can be an
option 
that a homeowner can choose to use or not but if the option is chosen, then
we need 
it to be standardized. Perhaps zeroconfig is the wrong venue for this
discussion. 
If so, does anyone know the right one? 

Bill Rose

---

From: [email-masked]
Date: Tue, 4 Apr 2000 13:36:51 EDT

In a message dated 00-04-04 06:25:22 EDT, [email-masked] writes:

<<... I want to be VERY clear, that the homeowner or building owner MUST have 
the ability to regulate this. There will be those who do NOT wish this type 
of access to their homes or other structures.>>

I would take it a step further. Given what is at stake in access to your own 
home, I think the default policy should be to disallow access. No home or 
building owners should be faced with a situation where they purchase new 
hardware and are uncertain whether or not a new point of ingress to the home 
has been created.

Regards,

Peter Johansson

Congruent Software, Inc.
98 Colorado Avenue
Berkeley, CA  94707

(510) 527-3926
(510) 527-3856 FAX

[email-masked]

---

From: "McDonald, Ira" <[email-masked]>
Date: Tue, 4 Apr 2000 11:14:40 -0700

Hi Peter and Daniel,

I agree with your points entirely.

Any eventual language in ZC-based protocol specs about
security needs to very tight and unambiguous, such as:

"Conforming implmentations MUST disable all external
access.  External access MUST only be permitted after
explicit configuration by the owner of the equipment."

Automatically punching holes in a homeowner's or small
business person's network will be the kiss of death
for the products.

Cheers,
- Ira McDonald, consulting architect at Xerox and Sharp
  High North Inc

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Tuesday, April 04, 2000 10:37 AM
To: [email-masked]
Subject: Re: home network security

<<... I want to be VERY clear, that the homeowner or building owner MUST
have 
the ability to regulate this. There will be those who do NOT wish this type 
of access to their homes or other structures.>>

has been created.

Regards,

Peter Johansson

Congruent Software, Inc.
98 Colorado Avenue
Berkeley, CA  94707

(510) 527-3926
(510) 527-3856 FAX

[email-masked]

---

From: "Rose, William" <[email-masked]>
Date: Wed, 5 Apr 2000 12:30:22 -0400

> 
 > <<... Manufacturers can provide application level security that block
access 
 > to potentially harmful functions unless the homeowner grants it.>>
 > 
 > I'd have to disagree that "trust" is not an issue. Manufacturers are
fallible 
 > and I may well prefer to grant NO access and have this readily under my 
 > control---as a distinctly different option from enabling potentially
harmful 
 > functions.

>I have to complete agree.  I have no problem with making the default
>to grant such access as long the customer *can* *easily* configure
>security in a way that such access is *not* granted (and as long
>configuring things in this way retains all functionality of the
>customer's devices in the same way as they would function had such
>access been granted; i.e., don't cripple my equipment just because the 
>manufacturer can't access it).  Furthermore, access should be
>grantable on a per-device basis.

I agree also. My point was that manufacturers can provide limits on access
to certain functions e.g. for repairs. Repairman can only access trouble log
unless granted access to control functions by customer. That is what I meant
by application level security. However, there is still a need for end-to-end
security that gives the customer control over who if anyone gets any access
at all to the device.

Bill Rose
Leviton

---

From: [email-masked]
Date: Wed, 5 Apr 2000 17:58:53 EDT

In a message dated 00-04-05 12:34:42 EDT, [email-masked] writes:

<<However, there is still a need for end-to-end security that gives the 
customer control over who if anyone gets any access at all to the device.>>

Yes---it was to clarify whether or not this was a point of agreement.

Peter Johansson

---

From: Austin Bill-P23393 <[email-masked]>
Date: Thu, 6 Apr 2000 13:22:59 -0700

This discussion topic has been pursued in our company for quite a while.  I
will clean up some of the more valuable points of our discussion and post
them without attribution to the several authors.

The post below tries to place "real-world" perspectives on the security
implications of a variety of rapidly approaching networking technologies.
The authors were very unhappy with the lack of a front-end, top-down,
systems approach to security in the zero-conf environment.

If you are new to the list, please read "nits" as "Zero-Conf"

For what it's worth:

"  It appears the "nits" group (and likely soon [?] Bluetooth/other Personal
Networks groups) may be focusing exclusively on performance without concern
for security implications.   The adverse potential business impact of that
position should be obvious to anyone.  "

"  If you and I pass anonymously, but I am able to capture your "address",
whether IP or not, not only for your personal device, but also for your home
freezer or alarm system or automobile, it is a relatively small step to
attack you and/or your e-property.  "

"   Ignoring for a moment the "classic military electronic warfare tools"
which are now available in COTS devices, the ability for a Service Discovery
Protocol, or equivalent, to walk my personal directory tree has terrible
implications for information attack.  Unfortunately, if we are not entirely
successful in impacting internal company developments with "silly" top-down
considerations such as security systems engineering, how will we be able to
fixes/overlays/retrofits for already fielded systems?  The fact that it is
physically difficult to go somewhere and then break into a house is a fairly
effective deterrent to burglars who would otherwise attack one's house door,
etc., (whether with a master key, a prybar, sledgehammer or a heavy boot).
However, the ability to look inside one's house and into the owner's private
inventory files from any remote location --thereby determining the value and
salability of one's property prior to a burglary -- would be a big help to
the burglar.  That possibility lies at the "Application" layer today.
However, the ability to peruse someone else's e-property lies much lower in
the stack. It appears that nits (etc.??) are trying to build that very
capability into system MAC, Networking and/or Transport layers. 

Of course, whether or not I or a burglar would then try or even succeed with
information attacks on YOUR e-property is then removed from your control,
just as is your ability to stop me from trying to break into your house,
whether I succeed or not, is outside your control.  However, e-attack is
less physically demanding.  And vastly more profitable, as it would increase
attacker opportunity, motive, and cycle time -- yielding an increased
probability of success as a function of time and effort.  "

"   The first gas crisis in the early 1970's spurred the ubiquity of gas
tank locks, springs in the fill pipe and other countermeasures.  Likewise,
poorly designed and weakly implemented Service Discovery Protocols could
spur vast new empires of e-protection -- all unnecessary with appropriate
forethought.  By ignoring the well known vulnerabilities designed into these
systems we risk knowingly subjecting our customers to a wide variety of
preventable criminal actions.  

So might we foresee multiple diverse after-market e-security overlays onto
each e-nabled personal e-device?  Might these effectively e-parallel the
multiple overlays of physical security some paranoid (NO, that's "Rational")
automobile owners now employ (e.g., OEM door/trunk locks, OEM/optional
built-in alarm system, aftermarket CLUB, aftermarket add-on alarm system,
aftermarket LoJack, etc.)??   "

"   After outfitting e-security overlays into my PDA or other personal
device, the prospect of any "passing stranger" becoming acquainted with my
entire e-directory (don't forget the need to also protect all shared ones
such as for other family members) could even make me want to buy hardened
cable and lockboxes for my freezer and dishwasher just for consistency.
Where should we draw the line? A hardened cable for the e-pencil sharpener?
An internal home atrium (screened overhead and alarmed of course) for my UPS
battery bank and emergency generator?   "

"   A bit of responsible top-down systems engineering from the Standards and
Specification groups seems in order.  Otherwise, after-the-fact, criticism
and litigation will be much more expensive.  Pinto gas tanks, Corvair road
handling, and Space Shuttle O-rings come to mind.   "

--
Bill Austin  http://home.att.net/~wbaustin/       
Motorola Bluetooth  http://www.mot.com/bluetooth/
The Digital Experience  http://experience.motorola.com/
AzTeC Free-Net  http://aztec.asu.edu/

> From: Rajesh Krishnan [mailto:[email-masked]]
> Sent: Thursday, April 06, 2000 12:32 PM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]; [email-masked]
> Classifying Internet radios or controls for window blinds as "benign" 
> and therefore not requiring access security is troublesome.  If they 
> have open control, and if firewalling is not an adequate answer 
> (wireless bridging etc.,), then such devices could be turned off/on 
> by unauthorized people.
> 
> In a sense, this means any device which is network controllable
> or observable (if potentially carrying sensitive information) can
> not be safely classified as benign. The Internet Radio is benign 
> as long as I cannot turn it on or off or change the volume or 
> station over the net.  Such network control could be a useful 
> feature -- auto-mute-radio when getting a telephone call.  If the 
> device can be controlled over the net, then security requirements 
> come right back in.
> 
> The useful question I suppose is how many networked devices in the 
> home would require security and what is the "cost" of providing 
> such security.  If the number is sufficiently large (which I believe
> to be true), and the cost is sufficiently low (which I do not know)
> then classifying some devices as benign may not be 
> particularly helpful.
> 
> If we are going to specify security as a requirement for at 
> least some 
> inexpensive zeroconf devices, then single chip network stack 
> solutions 
> which include zeroconf and security support will likely 
> become available 
> and benign could be simply a pin tied to the ground.
> 
> -Rajesh
> 
> > Marshall:
> > 
> > Thanks for your response, but I think you missed my point:
> > 
> > I am not so worried about  buying an infected DTV from 
> Circuit City:  I am
> > worried about an intruder penetrating my firewall, gaining 
> access to my home
> > network, finding an unprotected processor, for instance in 
> my nice, clean DTV,
> > and loading a Trojan Horse into it.  It can then do nasty 
> things, in the
> > background, that I would not know about until it was way too late.
> > 
> > Given that clarification, how do we classify my television, 
> benign or not?  And
> > if not, how can we make it real hard for the above scenario 
> to happen, without
> > making it so expensive or inconvenient for the homeowner 
> that she is inclined to
> > either, a) take the risk or b) do without outside access to 
> the home network.
> > 
> > Thanks,
> > 
> > Steven U.
> > 
> > 
> > 
> > 
> > 
> > 
> > Thomas Marshall Eubanks <[email-masked]> on 
> 04/06/2000 02:46:31 PM
> > 
> > Please respond to [email-masked]
> > 
> > To:   "Steven G. Ungar" <[email-masked]>
> > cc:   Daniel Senie <[email-masked]>, [email-masked], 
> [email-masked] (bcc:
> >       Steven G. Ungar/Telcordia)
> > "Steven G. Ungar" wrote:
> > > Marshall, Daniel, Peter, Bill, et al:
> > >
> > > I have been following this discussion with great 
> interest, and have learned a
> > > lot.
> > >
> > > Marshall:
> > >
> > > I fully agree with your analysis, but I would be 
> interested in knowing how
> > would
> > > you classify, say, a digital television:  Is it benign or 
> non-benign?  It
> > > contains a rather powerful processor which could be used 
> to harbor a Trojan
> > > Horse that would operate throughout the home network, 
> poking into data bases,
> > > collecting interesting information about the home (such 
> as when the burglar
> > > alarm tends to be turned off, and where the safe is 
> located), and sending that
> > > information out to the world.  Yet, you can't expect a 
> homeowner to tolerate a
> > > security lock on her television; she's not going to log 
> in every time she
> > wants
> > > to watch.  In other words, I think you are on to 
> something with the
> > > classification, but I think that there will be many 
> everyday, commonly used
> > > appliances, that will not be "benign."  Is it practical, 
> for these devices, to
> > > distinguish between access that originates within the 
> home, and thus can be
> > > considered friendly, and access that originates beyond 
> the firewall, and must
> > be
> > > authenticated?
> > >
> > > Steven Ungar,
> > > Telcordia Technologies
> > >
> > > Thomas Marshall Eubanks <[email-masked]> on 
> 04/06/2000 12:36:46 PM
> > 
> > Dear Steven;
> > 
> >     That has to be part of what the WG DOES.  My personal 
> feeling is that
> > if you buy a box off the shelf, you should be able to trust it not
> > to contain a trojan horse. If it does, the resulting 
> lawsuits will probably
> > drive the manufacturer out of business. However, your point 
> is a good
> > one that zeroconfig cannot ASSUME the absence of trojan horses, even
> > inside the home. (Your computer will likely be on this net, and may
> > certainly be compromised.) Maybe a benign
> > device cannot transmit out at all !
> > 
> >    For a benign device, deciding what comes from within the 
> home and what does
> > not
> > is not so important. Even if you spoof it, you cannot 
> really do anything
> > seriously wrong.
> > If my radio starts spewing out garbage, I can turn it off. 
> It cannot kill me.
> > 
> > I agree that there will be many everyday, commonly used
> > appliances, that will not be "benign." A stove may be a 
> good example -
> > ever forgotten about a tea kettle ?
> > 
> >    I think it is reasonable to expect a learning curve here 
> - things that
> > seem benign now, may not after someone figures out a way to 
> do something
> > non-benign
> > with them.    I would again suggest that the working group, 
> as a start,  derive
> > a description of a
> > benign device :
> > 
> > 1.) Incapable of causing physical harm, no matter what, 
> either by its nature, or
> > because of. e.g.,
> > physical interlocks.
> > 2.) Cannot transmit information about the specific 
> activities of the specific
> > user, except
> > maybe to the vendor using strong encryption.
> > 
> > Consider a stand-alone Internet radio. Presumably it cannot 
> be made to blow up,
> > so # 1 is
> > a given. Number 2 could be satisfied if there was no way it 
> could reveal its
> > state.
> > Note that it could still receive a "turn on at 6:30- AM" 
> message, and could even
> > acknowledge it.
> > It should NOT be able to report, even within the home, if 
> it was turned on
> > manually at a specific time.
> > 
> > Note that at some level you have to trust the vendor. If 
> that trust is violated,
> > the vendor will not
> > stay in business.
> > 
> > Also note that there has to be a limit. Did you know that 
> most devices do
> > particular things to
> > the line voltage in your house as they are turned on and 
> off ? A trojan horse
> > could simply monitor
> > line voltage at its power input, and get a pretty good idea 
> of activity
> > patterns, and maybe
> > even identify particular actions, such as the TV turning on.
> > 
> > Regards
> > Marshall Eubanks
> > 
> > 
> > T.M. Eubanks
> > Multicast Technologies, Inc
> > P.O. Box 99
> > Clifton, Virginia 20124
> > Phone : 703-803-8141
> > Fax     : 703-222-3250
> > e-mail : [email-masked]
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> 
>

---

From: Austin Bill-P23393 <[email-masked]>
Date: Thu, 6 Apr 2000 14:41:59 -0700

> From: Austin Bill-P23393 [mailto:[email-masked]]
> Sent: Thursday, April 06, 2000 1:23 PM
 
> If you are new to the list, please read "nits" as "Zero-Conf"

And for yet another perspective:

"

It's more fun than that : you look at the malicious-for-profit, what about
the teen out for fun (or revenge)? 
 
Scenario :

I'm a techno-teen (or have connections to one); we set a remote around your
house (why waste my time there, and a remote is less visible). You come home
and unlock your e-house with your wireless e-key. You again make the mistake
of sneering at me for the third (and final straw) time as you go oh so
smugly into your e-castle.

Little do you suspect that at 02:03 your e-alarm systems panic button will
signal your security company to respond to a silent alarm - won't you be
surprised when they e-unlock your front door and wake you to inquire what
the silent emergency response is.   Then there's tomorrow morning, just
after you left for work, when I reprogram your oven (it lists that it is
holding a dinner to start cooking at 16:00) - now your oven just went into
continuous clean mode - will there even be a cinder of the pan left (let
alone that dinner)?

By the way, your refrigerator temperature will be freezing by noon, and your
freezer is defrosting, your lights are all on (as are all major appliances),
and I'm resetting all clocks in your house to random (each one different)
times. Your VCR is recording over whatever tape your kid left in the VCR,
and you don't want to know what I'm doing to your home computer through it's
link. And thanks to this blue-tooth technology, I didn't even have to enter
your house - It's questionable
if I've violated any laws at all (technically). My broadcast was within FCC
limitations (short ranged, etc), I just had to pass close to your house - or
is that illegal now.

My thanks to all those bluetooth convenience makers who greatly simplified
my righteous vengeance (you sneered at me).  By the way, I also gave an
inventory of your household contents (including your safe combination that I
hacked) to some "associates" I know. I don't know when they'll visit, but
that's ok, I gave them your e-home door, security combination, and the
vacation itinerary you left on your computer, so they can let themselves in
- they'll be the ones driving the moving van.

"

--
Bill Austin  http://home.att.net/~wbaustin/       
AzTeC Free-Net  http://aztec.asu.edu/
Motorola Bluetooth  http://www.mot.com/bluetooth/
Bluetooth Mailing List  http://bluetooth.listbot.com/