4

I'm wondering what, if anything, can be done to thwart the sort of attack described below. First, you can assume the following:

(1) There are several devices in your home which you have deliberately connected to the Internet, for example your phone or your laptop. These devices are all running operating systems guarded by strong passwords. In other words, in the spectrum of information systems security, they constitute a low risk.

(2) All these devices connect to a router. The router is also secured by a strong password and is free of any known vulns.

Then, let's say you buy a new device. This device is not provided with your router password, any may not even advertise any networking capability, for example, a mouse.

However, security is only as strong as its weakest link.

With that in mind, you live in an urban area populated by wifi connections. Most of them were installed for people with no clue about security and by companies who want to exploit their ignorance. It's a good assumption, then, that a significant number of those SSIDs are associated with weak passwords, for example, the 7-digit phone number linked to the DSL line.

Imagine, now, that this new device you bought wants to upload your life somewhere, in whatever form of data might be useful to an attacker. All it has to do is crack one of those neighboring wifi connections, which is easily done because, hey, that TV is going to be sitting in your living room for years, with nothing better to do while in a low-power state than comb through a cracking dictionary and hack into any wifi it can see. It could round-robin through SSIDs, trying password after password. It might well succeed within a month, in a typical urban setting, based on what we know about the rapidity with which weak passwords can be cracked, even in the absenece of a GPU array with suspiciously high power consumption. (I'm thinking of a commodity microprocessor quietly churning away for months or years on end.)

This is an even more serious problem if one considers open wifi. While there might not be any in your vicinity, at some point, that new TV or whatever is going to be moved across town. Enroute, it could find an open wifi connection and talk to it just long enough to upload the highest-value cargo stored within its flash. A cheap supercapacitor could suffice for the energy to do so.

If you bought that TV with any credit card, or probably even with Bitcoin, your ID is all over it. Not that we need that, of course. There will be plenty of photos of your private documents from months of photography, audio recording, key logging, or whatever.

You get the idea.

As you have probably gathered, my question has nothing to do with how to secure one's router. Rather, I want to know how I can detect, let alone prevent, evil IoT devices, or even rogue pencil sharpeners, for that matter, from connecting to the least secure locally visible wifi, especially when they might connect only rarely.

I guess you need some sort of wifi sniffer that dumps the air to an SSD or USB stick 24/7, so you can periodically dump it for analysis. It would be nice to know an easy way to do that, ideally buy kit X from company Y. (Yeah the sniffer itself is untrusted, but at least you could isolate it in foam packing or something.)

Improve this question
2
  • /me imagines a pencil sharpener gone rogue. Shudders. Seriously, that's why nation states have dedicated resources to look for sidechannels in the crap that gets bought after fiscal year begins (and they fail...)
    – Deer Hunter
    Feb 12, 2016 at 23:20
  • Why spend money on a microprocessor powerful enough to do password cracking when a cheap 2G module can cost as low as $10?
    – Lie Ryan
    Dec 21, 2016 at 12:43

3 Answers 3

Reset to default
4

It's worth noting that most IoT won't have much to phone home about. You mentioned a few devices: TV, pencil sharpener, and mouse. Unless these devices were specifically created with extra mics, cameras, etc as intentional spy devices, the information they would hold about you would be negligible. A mouse records movements on a table, and clicks. It has no context of where you are moving it, and what it is clicking on. A pencil sharpener would know nothing except that it was being used as a sharpener. The TV would possibly have more information, but still limited, unless it takes voice commands or something, and has a mic. If you have top secret things to be concerned about, then create a safe room for those things. Life is too short to be afraid of pencil sharpeners. If you have doubts about what's in a device, take it apart to look.

Improve this answer
1
  • loved the way you said Life is too short to be afraid of pencil sharpeners..
    – GhostSpeaks101
    Jul 25, 2016 at 16:35
3

If you are that paranoid there is not much you could do about, because there is always a way to exfiltrate information. You don't need the neighbors open WLAN for it because the device might phone home via the mobile network. You might try to buy from a well known company which has a reputation too loose if such a behavior is detected. Although if you look at all the backdoors found in routers you might think that loss of reputation does not count that much today.

I would not even say that you paranoia is unjustified. There is report from 2014 where a handheld inventory scanner was used to actively search for useful information in the local network and to report them home. Also known for years is the risk of rented copiers where the copied documents could be extracted from the internal hard disks by the manufacture.

On the other hand your scenario of a network where neither the router nor any of the attached devices has any security risks is highly unlikely :(

Improve this answer
5
  • I think that's a sane reply. Although I do think that focussing on the biggest holes first makes sense. I'm less concerned about a device connecting to the mobile network via 3G or whatever because that doesn't scale particularly well for, say, a mouse manufacturer in China. It's much easier and more scalable to crack wifi than to procure unpaid connectivity over all mobile networks generically.
    – Bob Meyers
    Feb 14, 2016 at 4:08
  • The inventory scanner report is much more realistic, if not downright hilarious. Good find. But that only underscores how little sophistication this attack would require. We're probably talking about a handful of engineers with basic experience in wifi connectivity and password cracking using a cheap embedded SoC.
    – Bob Meyers
    Feb 14, 2016 at 4:08
  • You're correct: nothing is secure, but there is a spectrum, and routers with hard passwords are not the weakest link in the chain. For that matter, I don't worry too much about routers at all; each device needs to be responsible for its own security and assume that the router is compromised.
    – Bob Meyers
    Feb 14, 2016 at 4:08
  • It's plainly clear that this threat cannot be preempted, other than by living under the ocean. But all hope is not lost, because an economical wifi traffic capture device would be a useful defense. By shaming vendors of infected devices, we might force malware creators to further reduce their thermal and wifi traffic footprints, which will make it more difficult to abscond with large amounts of data before being discovered.
    – Bob Meyers
    Feb 14, 2016 at 4:09
  • My goal here is to identify the most practical such scanner. The most useful function would be to produce an alert when it detected repeated attempts to connect to the router using different passwords. But maybe I'm naively assuming its existence.
    – Bob Meyers
    Feb 14, 2016 at 4:09
3

Use a Honeypot-Router.

Set up a strictly monitored router connected to the internet which (intentionaly) lacks all sorts of protection (e.g. no password, or WEP.. ).

The malware running on your IoT-Device will likely connect to it, since this is indeed a bonanza for zombie IoTs.

your honeypot logs everything verbosely and thus you should be able to catch your IoT-Zombie.

Check out this tutorial: http://www.linuxjournal.com/content/wi-fi-mini-honeypot

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .