Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: How Do You Control the Internet of Things Inside Your Network? SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
How Do You Control the Internet of Things Inside Your Network?

Klaus Vesthammer recently tweeted that "The Internet of Things is just like the regular Internet, just without software patches". We have a flood of announcements about vulnerable devices, and little in terms of patches. At the same time, expect more and more of these devices to be connected to your network, if you want it or not. "Bring your own Devices" should be addressed more inclusive then just covering smart phones and tablets.

If you do have a working inventory system that recognizes and blocks unauthorized devices in real time, then stop reading and count yourself lucky. But for most of us, network maps are filed under "fiction" and network access control was this great solution we tried and failed as it hit real network life. So what else is there to do?

One of the critical aspects is to figure out which devices are not just on your network, but also do they talk to systems outside of your network. Active scanning will only get you that far. Many devices, to save power, will not connect to the network unless they have something to say. Some also use bluetooth to connect to smartphones and use them as a gateway. The device will not show up as an entity on your network in this case.

Here are a couple of indicators to look for:

- NTP queries: Some devices do have hard coded NTP servers, that do not match your standard network configuration
- DNS queries: DNS knows everything
- HTTP User-Agent and Server headers

Someone I am sure will provide pointers to do this in Bro. For everybody else, some simple log parsing scripts can help. Any other methods your use to find new and dangerous devices on your network?

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

I will be teaching next: Defending Web Applications Security Essentials - SANS San Francisco Spring 2020

Johannes

3693 Posts
ISC Handler
What was in Vegas, stayed there!

The flexibility of Sonic Wall allows "root" to create everything from Alpha to Omega, bridling the user.

As said above, oddly enough I just returned from Las Vegas and while there sat down to use the hotels community PC (yikes) to look up a restaurant.

To my surprise, they had a Sonic Wall. Defaults to secure sign in via Sonic Wall interface, up comes desktop ( tiered as you wish), bridles the web browser pushing them to either duckduck or IXQuick and everything is filtered and monitored (CFS. It all works in tandem with Windows OS, this one being Vista, but I have 7. (access rights to PC programs) Disable all backdoor, USB, CD/DVD BIOS override along with NIC.

Now this was a "Red Roof Inn" and while @ Planet Hollywood and their open wireless I was able to really have some fun, even plugging in the CATV from the TV @ the room of a friend who was staying there, bang, was on their video network, some time there with my USB NIC card to obfuscate the MAC address and see what goodies I could have hit, but only played a few minutes.

In this case, the small network was tighter than the "big boys".


ICI2I
Anonymous

Sign Up for Free or Log In to start participating in the conversation!