In recent news, IoT devices are a target of hackers -- specifically botnet herders. The first step to securing your organization and its users is to detect all IoT devices that are functional on your IP address range. If every client in your domain is allocated a public IP address, their device becomes immediately accessible over the Internet. How do you discover all IoT devices operational in your domain?

My first thought was to scan known IoT device port ranges over all IPs in your IP range. But is there any tool out there that already does this? Is there another way of enumerating as many IoT devices as possible in a given IP range?

  • 6
    Any company with a sane security policy does not let arbitrary devices into the network, which means that the administrators should already know which device is behind which IP address. If the company instead allows arbitrary devices uncontrolled in the network and even gives them a public IP address it probably has a much bigger problem than detecting the IoT devices. – Steffen Ullrich Mar 10 '17 at 19:54
  • Assume "company" is an educational institution. It is common in educational institutions to allocate public IPs. – whoami Mar 10 '17 at 19:57
  • 2
    Scan your network and listen for anything that has TCP 23 open (half sarcasm, half not sarcasm)... – DKNUCKLES Mar 10 '17 at 19:57
  • Hate to break it to you, but everything on the internet, as of now (until they perfect the internet of souls) is already a thing. Looking specifically for "things" on your network won't get you very far in terms of risk mitigation. You're going to need a much better premise if you hope to even know what your weaknesses are, much less mitigate them. – Jeff Meden Mar 10 '17 at 19:59
  • 2
    @learnerX: I don't think that IoT is more a problem in educational institutions than infected student laptops. Thus I would not focus specifically on detecting IoT but detecting any kind of device on the network, finding out what kind of device this is and how much risk it means. Port scanning as proposed combined with OS detection might be a good start and there are existing tools like nmap for this. – Steffen Ullrich Mar 10 '17 at 20:00

During procurement, have Finance and/or Internal Audit create and maintain a formal asset-registration process. All people managers must receive all procured devices/software and each approved vendor must provide a list of inventory services. Gaps in the inventory services automatically provided from the VARs must be filled in by the people managers using a checklist.

Business Process Example

People manager decides to procure an iPhone and an Android-powered thermostat for a remote worker who is a thermostat tester. The VAR who works with Apple provides the serial numbers, SIM card identifiers, telecommunication-provider IMEI, and MAC address for the WiFi component of the iPhone. The people manager turns on the iPhone to collect the Bluetooth BDADDR and submits it to the internal procurement asset-registration portal using a Standard-Operating Procedure (SOP) document. The manager then opens the box containing the thermostat, turns it on, and collects its WiFi and Bluetooth MACs using a separate SOP document in order to submit these to the procurement asset-registration portal.

At this time, I do recommend tracking at least SIM serial, IMEI/MEID, as well as Ethernet and Bluetooth MAC addresses. You may also want to track ZigBee, Z-Wave, RFID, and NFC identifiers.

Technology Platform Examples

SAP or Oracle Hyperion typically have ways of documenting procurements to asset codes to plant codes. For example, you can have SAP ECC document what was purchased when and where it went, perhaps down to the PDU level, e.g., a cage in a data center or a cube on a floor of a particular building.

Then the procurement system can have hooks to the IT/Ops CMDB or configuration-management database. Some of these include: Axios Assyst, BMC Atrium, CA Service Desk Manager, Cherwell Software, Freshservice, FrontRange, Hornbill, HP Universal UCMDB, IBM SmartCloud Control Desk (SCCD), iET Solutions, InvGate Assets, LANDESK Service Desk Suite, ManageEngine IT360 / ManageEngine AssetExplorer, Scalable Software, ServiceNow, SolarWinds Web Help Desk, and SysAid. If you want free, open-source projects to track inventory and configuration management, check out clusto.org, https://github.com/mozilla/inventory , or http://fusioninventory.org/overview/ -- (with -- https://www.fusiondirectory.org -- and perhaps - https://github.com/Normation/ldap-inventory).

Additionally, you can even link applications to an app inventory (or app portfolio, part of Enterprise Architecture Management aka EAM) with device inventory. Microsoft SCCM can do this with software tagging (either ISO/IEC 19770-2 and/or SWID tagging), but there are other solutions that do full EAM such as Software AG Alfabet.

IoT devices, in particular, leverage either on-device REST APIs or reach out to cloud-based REST APIs. These can be discovered, tracked, and managed using Application Discovery and Dependency Mapping (ADDM) solutions such as AccelOps, Cisco AppDynamics, AppEnsure, VNT IllumIT, and -- my favorite for its ability to integrate back to the CMDB -- ServiceNow ServiceWatch.


This is something I'm currently working on.

In fact I drafted a project from scratch, because the organizations are very immature facing iOT threats. Besides, the iOT threat is very recent with high impact on the business and safety of the organization.

The processes I drafted was something like this:

enter image description here

start small and effective, then develop the process as you need in the future :)

  • 3
    One of my IoTs (a Rpi) has port 443 open. Another one - port 9999. All the ones which control my shades - 8181. You assume that an IoT is defined by its open ports - which is not true. An IoT is is just a buzzword for "something with an IP which we decide not to call a computer" – WoJ Mar 11 '17 at 14:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.