The Internet of Scary Things – tips to deploy and manage IoT safely Christopher Biggs
- What you need to know about the Toaster Apocalypse
- Late 2016 brought to prominence when major sites hit by DDOS from compromised devices
- Risks present of grabbing images
- Targeted intrusion
- Indiscriminate harvesting of images
- Drive-by pervs
- State actors
- Unorthorized control
- Hit traffic lights, doorbells
- Takeover of entire devices
- Used for DDOS
- Demanding payment for the owner to get control of them back.
- “The firewall doesn’t divide the scary Internet from the safe LAN, the monsters are in the room”
- Poor Security
- Mostly just lazyness and bad practices
- Hard for end-users to configure (especially non-techies)
- Similar to how servers and Internet software, PCs were 20 years ago
- Low Interop
- Everyone uses own cloud services
- Only just started getting common protocols and stds
- Limited Maint
- No support, no updates, no patches
- Security is Hard
- Laziness
- Threat service is too large
- Telnet is too easy for devs
- Most things don’t need full Linux installs
- No incentives
- Owner might not even notice if compromised
- No incentive for vendors to make them better
- Examples
- Cameras with telenet open, default passwords (that can not be changed)
- exe to access
- Send UDP to enable a telnet port
- Bad Mobile apps
- Selecting a device
- Accept you will get bad ones, will have to return
- Scan your own network, you might not know something is even wifi enabled
- Port scan devices
- Stick with the “Big 3” ramework ( Apple, Google, Amazon )
- Make sure it supports open protocols (indicates serious vendor)
- Check if open source firmward or clients exists
- Check for reviews (especially nagative) or teardowns
- Defensive arch
- Put on it’s own network
- Turn off or block uPNP opening firewall holes
- Plan for breaches
- Firewall rules, rate limited, recheck now and then
- BYO cloud (dont use the vendor cloud)
- HomeBridge
- Node-RED (Alexa)
- Zoneminder, Motion for cameras
- Advice for devs
- Apple HomeKit (or at least support for Homebridge for less commercial)
- Amazon Alexa and AWS IoT
- Protocols open but look nice
- UCF uPnP and SNP profiles
- Device discovery and self discovery
- Ref implimentations availabel
- NoApp setup as an alternative
- Have an API
- Support MQTT
- Long Term support
- Put copy of docs in device
- Decide up from what and how long you will support and be up front
- Limit what you put on the device
- Don’t just ship a Unix PC
- Take out debug stuff when you ship
- Trends
- Standards
- BITAG
- Open Connectivity founddation
- Regulation?
- Google Internet of things
- Apple HomeHit
- Amazon Alexa
- Worry about privacy
- Open Connectivity Foundation – IoTivity
- Resin.io
- Open source etc
- Linux and Docket based
- Consumer IDS – FingBox
- Standards
- Missing
- Network access policy framework shipped
- Initial network authentication
- Vulnerbility alerting
- Patch distribution
Rage Against the Ghost in the Machine – Lilly Ryan
- What is a Ghost?
- The split between the mind and the body (dualism)
- The thing that makes you you, seperate to the meat of your body
- Privacy
- Privacy for information not physcial
- The mind has been a private place
- eg “you might have thought about robbing a bank”
- The thoughts we express are what what is public.
- Always been private since we never had technology to get in there
- Companies and governments can look into your mind via things like your google queries
- We can emulate the inner person not just the outer expression
- How to Summon a Ghost
- Digital re-creation of a person by a bot or another machine
- Take information that post online
- Likes on facebook, length of time between clicks
- Ecto-meta-data
- Take meta data and create something like you that interacts
- The Smartphone
- Collects meta-data that doesn’t get posted publicly
- deleted documents
- editing of stuff
- search history
- patten of jumping between apps
- The Public meta-data that you don’t explicitly publish
- Future could emulate you sum of oyu public bahavour
- What do we do with a ghost?
- Create chatbots or online profiles that emulate a person
- Talk to a Ghost of yourself
- Put a Ghost to work. They 3rd party owns the data
- Customer service bot, PA
- Chris Helmsworth could be your PA
- Money will go to facebook or Google
- Less legal stuff
- Information can leak from big companies
- How to Banish a Ghost
- Option to donating to the future
- currently no regulation or code of conduct
- Restrict data you send out
- Don’t use the Internet
- Be anonymous
- Hard to do when cookies match you across many sites
- You can install cookie blocker
- Which networks you connect to
- eg list of Wifi networks match you with places and people
- Mobile network streams location data
- location data reveals not just where you go but what stores, houses or people you are near
- Turn off wifi, bluetooth or data when you are not using. Use VPNs
- Law
- Lobby and push politicians
- Push back on comapnies
- For technologiest
- Collect the minimum, not the maximum
FreeIPA project update (turbo talk) – Fraser Tweedale
- Central Identity manager
- Ldap + Kerberos, CA, DNS, admin tools, client. Hooks into AD
- NAnage via web or client
- Client SSSD. Used by various distros
- What is in the next release
- Sub-CAs
- Can require 2FA for important serices
- KDC Proxy
- Network bound encryption. ie Needs to talk to local server to unencrypt a disk
- User Session recording
Politely socially engineering IRL using sneaky magician techniques – Alexander Hogue
- Puttign things up your sleeve is actually hard
- Minimum viable magic
- Miss-direct the eyes
- Eyes only move in a straight line
- Exploit pattern recognition
- Exploit the spot light
- Your attention is a resource
