Threat Level: green Handler on Duty: Mark Hofman

SANS ISC Internet Storm Center

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Latest Diaries

ISC StormCast for Tuesday, March 3rd 2015

How Do You Control the Internet of Things Inside Your Network?

Published: 2015-03-02
Last Updated: 2015-03-02 17:21:57 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

Klaus Vesthammer recently tweeted that "The Internet of Things is just like the regular Internet, just without software patches". We have a flood of announcements about vulnerable devices, and little in terms of patches. At the same time, expect more and more of these devices to be connected to your network, if you want it or not. "Bring your own Devices" should be addressed more inclusive then just covering smart phones and tablets.

If you do have a working inventory system that recognizes and blocks unauthorized devices in real time, then stop reading and count yourself lucky. But for most of us, network maps are filed under "fiction" and network access control was this great solution we tried and failed as it hit real network life. So what else is there to do?

One of the critical aspects is to figure out which devices are not just on your network, but also do they talk to systems outside of your network. Active scanning will only get you that far. Many devices, to save power, will not connect to the network unless they have something to say. Some also use bluetooth to connect to smartphones and use them as a gateway. The device will not show up as an entity on your network in this case.

Here are a couple of indicators to look for:

- NTP queries: Some devices do have hard coded NTP servers, that do not match your standard network configuration
- DNS queries: DNS knows everything
- HTTP User-Agent and Server headers

Someone I am sure will provide pointers to do this in Bro. For everybody else, some simple log parsing scripts can help. Any other methods your use to find new and dangerous devices on your network?

Johannes B. Ullrich, Ph.D.

Keywords: iot
1 comment(s)
ISC StormCast for Monday, March 2nd 2015

If you have more information or corrections regarding our diary, please share.

Recent Diaries

Advisory: Seagate NAS Remote Code Execution
1 day ago by Rick (1 comment)

Let's Encrypt!
2 days ago by Rick (4 comments)

DDOS are way down? Why?
3 days ago by Rick (1 comment)

New Feature: Subnet Report
4 days ago by Dr. J. (1 comment)

Samba vulnerability - Remote Code Execution - (CVE-2015-0240)
5 days ago by Chris (0 comments) Used to Distribute Crypto Ransomware
6 days ago by Dr. J. (3 comments)

11 Ways To Track Your Moves When Using a Web Browser
6 days ago by Dr. J. (3 comments)

View All Diaries →

Latest Discussions

Google's security-focused Android and Chrome for Work
created 4 days ago by Anonymous (0 replies)

How do I fix website security certificate errors?
created 1 week ago by Alvirajohn (0 replies)

Please help with securing my website
created 3 weeks ago by Anonymous (0 replies)

Please help with securing my website
created 3 weeks ago by Anonymous (2 replies)

your EMET 5.1 experience?
created 1 month ago by Mallory Bobalice (4 replies)

View All Forums →

Latest News

View All News →