1

I have a IOT device in my home that controls my security system and let me enable/disable it.

It can be accessed via web interface and a mobile app. It's unknown to me what OS or other ports that may be open or other aspects. I only interface with it that way.

The device has a built-in DDNS-like service that lets me redirect to the device without knowing my IP.

I have the following settings I can enable or disable: 

ENABLE HTTPS ON CUSTOM PORT
SET DEFAULT HTTP PORT
SET "SOFTWARE" PORT

I enabled HTTPS on a high port and set the http port to 0. However if I do that with the software port the mobile app wont work. I don't know if this port is working with https or http, or even if my mobile app connection to it is encrypted. The software port is not accessible on the browser. The HTTPS port is not accessible outside LAN by router rules.

What is the risk posed by this device if I expose it to the internet with a possibly plain HTTP port? Is there anything I can do to mitigate this risk?

My goal here is to have the device accessible externally, and communicate with it securely with the mobile app, and limit risk of it infecting other devices in my network if compromised.

Improve this question
2
  • First, try google your IoT brand and version for known vulnerabilities. Second, I don't understand the reason of setting https to port 0, which in fact will block by most router default firewall inbound rules. I really don't see why you want to expose the device using HTTP port.
    – mootmoot
    Aug 6, 2018 at 15:57
  • if you have to open a port on the router, i'm not sure where https comes into play. opening a port allows you to reach into your network from outside. https allows the device to reach into the cloud securely. your device's interface won't host incoming via https; it has no domain for a cert. the details are a bit sketchy.
    – dandavis
    Aug 6, 2018 at 20:13

1 Answer 1

Reset to default
1

The risk is the same as with any other exposed service. Misconfigurations or vulnerabilities may end up providing an entry point to your LAN.

However, why expose it at all? Why don't you setup a VPN, connect your mobile to the VPN and then access the device internally in the LAN? That would be a better approach than just expose this service, as usually these kind of devices use software that tend to be somewhat weak in terms of security.

Improve this answer
2
  • I don't do that mostly because I don't know how to setup that VPN, and having family members get used to that will be hard. I really need that accessible over the mobile apps.
    – Freedo
    Aug 6, 2018 at 9:01
  • @Freedo it's accessible over the mobile app. You just run the VPN app first, connect, and then use your IOT Device app. About how to setup the VPN, you have plenty of tutorials for OpenVPN out there.
    – user15194
    Aug 6, 2018 at 9:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .