Subject: [Lwip] Internet Census 2012 -- Insecure embedded devices

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 20 Mar 2013 21:08:04 +0200

Hi all, 

today I found this article and I thought I should share it with you given all the security discussions in the group: 
http://internetcensus2012.bitbucket.org/paper.html

It is rather depressing. 

Ciao
Hannes

---

From: Johannes Gilger <[email-masked]>
Date: Wed, 20 Mar 2013 20:26:24 +0100

Hi Hannes,

I disagree a bit. From the security standpoint it's a clear appeal to
make security more accessible and provide safe and sane defaults, even
for "unconfigured" devices. The million-lightbulb-scenario with
factory-configured settings that Eric brought up certainly comes to
mind. But I still believe things can be improved.

What is most depressing to me (as a European) is the scale of
under-utilization of the IPv4 address space. Simply have a look at the
Hilbert map and check out all the black blocks (either ARIN or US corps)
and the most colorful blocks (either APNIC or RIPE).

http://internetcensus2012.bitbucket.org/images/hilbert_icmp_map.png

As someone who followed the exhaustion-topic only marginally, this puts
things in perspective for me. Please correct me if I'm drawing the wrong
conclusions.

Regards,
Jojo

-- 
Dipl.-Inform. Johannes Gilger
Research Group IT-Security
RWTH Aachen University
Mies-van-der-Rohe-Straße 15
52074 Aachen

Office: 211
Phone: +49 241 80 20781

http://itsec.rwth-aachen.de

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 20 Mar 2013 21:52:50 +0100

On Mar 20, 2013, at 20:26, Johannes Gilger <[email-masked]> wrote:

> under-utilization of the IPv4 address space

Water under the bridge.
IPv4 has had no future left for a long time already.

But back to Hannes' point:

For the "Smart Objects Networks" ("Internet of Things") crowd, I think this 
just reinforces the lesson that we simply can't tolerate the admin/admin folk among us.
If somebody is botching security as badly, we need to be vocal about it.
And ostracize. 

Be intolerant of the people wielding the "commercial realities" that create this situation.
And fix our security processes, not only the algorithms and protocols.

We managed to get rid of people littering everywhere, smoking in our offices...
We can get rid of bad security, too.

Grüße, Carsten

---

From: "Cao Zhen \(CZ\)" <[email-masked]>
Date: Thu, 21 Mar 2013 09:36:11 +0800

Hi Hannes, 

Thanks for sharing this interesting work. 

I have got a question but did not find an answer in the paper, how the scanning agent can determine the target is an "embedded device"?

Best regards,
zhen

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Hannes Tschofenig
> Sent: Thursday, March 21, 2013 3:08 AM
> To: [email-masked]
> Subject: [Lwip] Internet Census 2012 -- Insecure embedded devices
> 
> Hi all,
> 
> _______________________________________________
> Lwip mailing list
> [email-masked]
> https://w

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Thu, 21 Mar 2013 11:07:38 +0100 (CET)

That's a good question.

I believe they just assume that those devices with default passwords are indeed embedded devices.

While that may not be 100% true most desktop and mobile phone operating system do not come with default accounts shipped anymore. During the initial system setup you have to configure them to something.

In the embedded space it is, however, still very common to have the devices come with default accounts. Just think about all those folks who install a Raspberry Pis. They just download the images and never change the passwords.

Gesendet: Donnerstag, 21. März 2013 um 02:36 Uhr

Von: "Cao Zhen (CZ)" <[email-masked]>

An: "'Hannes Tschofenig'" <[email-masked]>, [email-masked]

Betreff: RE: [Lwip] Internet Census 2012 -- Insecure embedded devices

Hi Hannes,

Best regards,

zhen

> today I found this article and I thought I should share it with you given all the security discussions

> in the group:

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 21 Mar 2013 10:19:06 +0000

> Thanks for sharing this interesting work. 

Yes, its interesting, but also ethically dodgy IMO. If you
reboot 400k devices without permission then you probably do
disrupt something important for someone. It could also be
the case that some of the traffic their botnet generated
also cost someone some money.

> I have got a question but did not find an answer in the paper, how the scanning agent can determine the target is an "embedded device"?

Good luck getting answers from the anonymous author.

I guess one thing that this wg could do would be to
write up a document noting the admin/admin stupidity
and e.g. the recent upnp camera findings and say
"don't do that" and provide some recommendations on
what embedded device manufacturers should do. But
maybe doing work on busybox and associated distros to
make those more secure by default might be more
effective.

S.

> https://www.ietf.org/mailman/listinfo/lwip
>

---

From: Johannes Gilger <[email-masked]>
Date: Thu, 21 Mar 2013 11:26:25 +0100

The author only uses telnet logins to try to connect to the devices. I
don't know any current OS which enables telnet by default, much less
with root:root or admin:admin, not even the Raspberry Pi. So the set of
possible devices is already relatively small. Furthermore the author
developed and cross-compiled his bot-binary for OpenWRT platforms.

Regards,
Jojo

Office: 211
Phone: +49 241 80 20781

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Thu, 21 Mar 2013 13:53:56 +0100 (CET)

The Raspberry Pi was just a more modern example. The same pattern does, however, apply.

A quote from

http://www.guardian.co.uk/technology/blog/2012/oct/08/technology-links-newsbucket

:

"

So Raspberry Pi ships with a) sshd on b) root login on sshd on c) the
same default password on every Pi - doh! Do not plug in your pi to a net
before changing at least one of the above, or you will, like a famous
professor in the [Cambridge] computer lab last week, get hacked, and
deserve to be:)

"

More info here: http://raspberrypi.stackexchange.com/questions/508/how-can-i-protect-against-intrusion-and-malware-before-connecting-it-to-the-inte

These embedded devices stick around for a long time without anyone paying attention to them. In addition, my fear is that many of these devices will never be updated. To quote a paragraph from a workshop report (http://tools.ietf.org/html/draft-gilger-smart-object-security-workshop-01#section-4):
"

Designing a software update mechanism into the system is crucial to
ensure that both functionality can be enhanced and that potential
vulnerabilities can be fixed. Functionality as well as security will
need to remain unchanged for several years. Also the importance of
security threats changes over time.

"

Ciao

Hannes

Gesendet: Donnerstag, 21. März 2013 um 11:26 Uhr

Von: "Johannes Gilger" <[email-masked]>

An: "Hannes Tschofenig" <[email-masked]>

Cc: "Cao Zhen (CZ)" <[email-masked]>, [email-masked]

Betreff: Re: [Lwip] Internet Census 2012 -- Insecure embedded devices

Regards,

Jojo

--

RWTH Aachen University

52074 Aachen

Office: 211

Phone: +49 241 80 20781

---

From: Brian Haberman <[email-masked]>
Date: Thu, 21 Mar 2013 18:18:44 -0400

> http://internetcensus2012.bitbucket.org/images/hilbert_icmp_map.png

Just one quick point on the above... It is unclear how much of the black 
blocks are due to under-utilization.  The data was collected by 
utilizing ICMP traffic and many service providers block ICMP traffic. 
So, those black blocks could be due to lost ICMP probe traffic.

Regards,
Brian

---

From: Bob Hinden <[email-masked]>
Date: Wed, 27 Mar 2013 15:18:31 -0700

On Mar 21, 2013, at 3:18 PM, Brian Haberman <[email-masked]> wrote:

> Just one quick point on the above... It is unclear how much of the black blocks are due to under-utilization.  The data was collected by utilizing ICMP traffic and many service providers block ICMP traffic. So, those black blocks could be due to lost ICMP probe traffic.

My view as well.  The report made a lot of assumptions about things they couldn't reach.  I think the only part know for sure was that they couldn't reach them.  The rest is speculation.  

Bob