Intrusion detection in a small home network

Question

The number of devices in my home network keeps growing: Apart from my gaming PC and our home office notebooks, we have the kids' tablets, all our smart phones, a smart TV stick, some WLAN peripherals, etc. The more devices we get, the more I start to worry about one of them being compromised. An adversary could use some "unimportant" device (e.g. an old tablet or printer) for lateral movement across the (W)LAN to attack "important" devices (e.g. one of the PCs).

Thus, I'd like to somehow get informed when a device tries to do something fishy. At work, I use a dedicated hardware firewall for this purpose: Its intrusion detection system will inform me as soon as any device tries to, for example, contact a well-known Command and Control server.

Yet somehow I'm hesitant to purchase/set up a business-grade firewall/IDS system for a private home network---it feels like an over-reaction. Is there some simpler solution that will give me some kind of intrusion detection? One option that comes to my mind would be a software running on one of the PCs that watches for incoming port scans, but I'm open to any other kind of suggestion as well. My main goal would be to identify compromised devices inside the home network so that I can remove them from the network.

Answer 1

Setting up an intrusion detection system (IDS) for a home network is the next logical step to an increasingly networked world (especially after IoT becomes commonplace around the world).

It all comes down to what are you trying to protect and by whom. By my standards, protecting your privacy against a random script kiddie is a good enough reason to take the extra step.

Whether a business-grade IDS for a home network is "over-reaction" is subject to debate. Personally, I always take into account the skills required and the amount of money and time I should spend in order to setup a solution, before I consider giving it a try. Most commercial solutions provide better user experience (i.e. are easier to setup) but are more expensive.

On your question, depending on your computer skills, you may want to try setting up a cost-effective IDS (i.e. open source, e.g. snort, suricata, openwips-ng etc) on a computer, let it sit on your network and see how that'll work for you. If that fits the purpose, you can stick with it. If you think that you'll need something more advanced, then you may want to consider buying a business-grade IDS. However, beware that not every commercial solution can outperform its open source alternatives.

Another thing to consider is defence in depth. Do you want an IDS sitting around your network, just monitoring (network IDS, NIDS) or monitoring and reacting to anomalies (intrusion prevention system, IPS), or do you also want to explicitly protect your most important assets in your network (e.g. your computer)? If the latter is the case, then adding host IDSs (HIDS), integrity checkers, firewalls and antiviruses to your assets may be a good step towards what you're looking for.

Finally, if you have valid reasons to worry that you are a target, then on top of whatever you may do to protect your network you may want to consider explicitly protecting your data. Maybe it worths the trouble setting up a data backup solution so that if something bad happens (e.g. ransomware), you'll at least be able to recover your data.

Answer 2

Coming back to my statement, I think you need to ask yourself what are you trying to protect yourself from? What are your risks? In my experience; my father got attacked by ransom ware, another time he was targeted by a scammer and got his account information, I've seen networks been "controlled" to where random links go to ad pages, and I've seen root kits hide themselves in systems.

I believe most home networks biggest risk is having your personal (accounts and personal media) and financial (credit cards, ssn, and bank account credentials) data lost, destroyed, or leaked.

Next we need to think about how this can be done; external network vulnerabilities, internal network vulnerabilities, and insider threats.

External Network Vulnerabilities

Your router takes care of most of your external network vulnerabilities, you have a network firewall there. It doesn't report attacks, and if you saw how many times "attacks" were "attempted", you'd start ignoring it prety quickly.

However there are low cost or open source firewall (firewalla, and bitdefender are two google results I've heard of before) or network security solutions you can definitely add to your network that do similar functions as your work's enterprise solution. But you're right it might be overkill, there's other steps you can take to protect your systems, as intrusion detection can't really stop a device you've already let in to your network. And most of those solutions just stops you from getting ads and "naughty" sites.

Internal Network Vulnerabilities

First and foremost though is to protect your data. Turn off file sharing (windows file sharing, or FTP) where you don't need it. Turn on or enforce authentication for file sharing where you do need to share files.

Second is to configure and enable host based firewalls, windows defender firewall or linux has "fw" firewall software. That will protect your computers from being attacked from the local network.

It's unlikely that you're going to be the target of an attack where an unimportant device is used for lateral movement, but turning on host based firewalls and forcing authentication for all other connectivity will close those gaps to the "important" devices and data. However you can go further; check all the devices on the network make sure they're still getting updates, and supported security patches, if not wipe it and throw it out. (If you dont want to throw a device out, remove the wifi passwords if it no longer needs regular network access.)

Old printers are harder to say, take them off the network and hook them up locally (USB) and share them from a host computer, but I believe old printers being a target is unlikely, but check for firmware updates too.

This is one of the more important to prevent lateral access on your local network. Devices that just need internet access but not local network access (home automation devices, light switches, etc.), put them on a separate wifi AP that does host based isolation (only lets them access the internet.) You may need a better wireless AP to do this, but this prevents compromised phones and tablets, and guests from spreading to your home network and "important" systems.

"Insider Threat"

Call it what you want, but you are more likely to be the victim of insider threat or social engineering, being someone (even you!) on the network does something stupid; ie. downloads and runs malicious software, so making sure your antivirus is up to date should be checked regularly.

Don't let remote access software run all the time if you don't need it, force authentication if you do need it. When my father was a victim of ransomware it was because we had logmein installed and always enabled. He must have had it where it didn't need authentication to access, and an attacker was able to get in and ran the ransom encryption software.

The last bit of advice I have is prevent users from having administrtative rights on their computers, even yourself. Log in as an administrator ONLY when you need to do something that requires admin rights, don't do daily tasks as an administrative user. It puts you in the mindset "should I really install this?" when you have to take the additional steps to do it. Kids on gaming PCs don't need to be admins either, if they need a port opened in the firewall or a new game to be installed, they can request the admin (you) to do it. Virus scan unknown sourced software before being installed and ran.

That's your 99% for a home network. We can't stop everything, but that is a significant amount of protection.