2

Suppose I bought a domotic IOT device which connects to the internet via an ADSL modem and permits access to it via web browser or smartphone app without SSL encryption and several other weaknesses.

I need to use it because it's an essential piece of my home but need to secure it as soon as possible.

Is there any way to put a routing/firewall device in between the IOT device and the Modem such that I can securely authenticate to the routing/firewall device first and from there access the unsecured device.

What is the name of such configuration and how would it work? Notice a VPN itself is not enough because the smartphone app might not support it.

Are there canned solutions to problems like these? How can one protect essentially vulnerable internet facing devices from Shodan scans without changing the vulnerable devices but essentially wrapping them in a secure environment?

2
  • 1
    A VPN connection managed by the phone's OS should work just fine, as far as the app is concerned it will just be talking to the insecure IOT hardware as if it was on the local network, with all the encryption being handled by the phone's OS. Just put the IOT device behind a VPN gateway (PFSense or custom Linux box with an IPSec server like Strongswan) Feb 25 '16 at 15:48
  • Ok VPN gateway might be one way, I thought however there were essentially more approaches to this problem.. Feb 26 '16 at 9:02
1

As @AndreBorie says in their comment, a VPN gateway would solve this, assuming that the IoT device doesn't expose other connection methods (e.g. an insecure Bluetooth or Wifi connection of its own).

A VPN gateway works by allowing a device to connect to a network over an encrypted channel over an insecure network (such as the general internet), then decrypting the traffic and forwarding it onto a device which is on a trusted network (your home, in this case). The internal device doesn't know it's connecting to a remote address, and most modern phones support a suitable form of VPN connection, which can forward all traffic through the VPN connection.

Some applications may attempt to detect the presence of a VPN (in particular, things like Netflix which may have distribution restrictions on content), and refuse to run properly when connecting through a VPN, even where this is personally operated. There is also a speed impact from using a VPN, although this depends on the connection to the VPN server, and I have known odd situations where accessing content was quicker through a VPN due to routing misconfigurations.

You would also need to ensure that the router at your home did not open the ports for the device automatically - some uPNP supporting routers allow for devices on the "inside" to open ports without human interaction. If this happened, the VPN would be bypassed, and the device left open to Shodan or similar scans.

0

You could place a reverse proxy in front of the device and connect to it over HTTPS. You could add additional authentication on the proxy to prevent someone from probing the device without credentials. Of course, you wouldn't be able to use the app with proxy authentication, but I'd imagine the web interface would work fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.