4 ms·

It forces the users to disconnect the devices and hopefully learn to buy more secure devices (and pressure vendors and stores, etc).

• bogomipz 10y ago
  But in front of every compromised IoT device is a compromised router. Whose responsibility is that? I am going to say the majority of users down know how to update the firmware on their routers. From the experience I have had with customer/technical support reps at cable companies for basic things like a service outage. I can't imagine them dealing with compromised devices and firmware upgrades or locating IoT devices in customer's home. I don't think they have either the staff capacity or sometimes even the technical skill to do so with any efficiency. Then there's the potential for false positives or bad data where my connection get s null routed and I have to wait on hold for 45 minutes or an hour to talk to someone who may or many not know whats going on. Then I need to prove that there is no IoT device on my local LAN to a support person who might not even know what a mac address is. This just sounds like a mess.
  • wmf 10y ago
    in front of every compromised IoT device is a compromised router. Why do you say that? AFAIK the devices being infected by Mirai use UPnP to expose themselves so the router probably has no responsibility for the insecurity. It would be great if we could build some sort of immune system into home routers and force IOT companies to pay for it, but that doesn't seem likely. Short of mass-bricking these devices, any solution is going to be incredibly labor-intensive and expensive.
    • bogomipz 10y ago
      Sure but UPNP just opens up the outbound connection no? A command and control connection for a botnet would still need an inbound NAT rule as would the ability to get the IoT device on the LAN in the first place compromise it right? Or am I missing something?
      • wmf 10y ago
        NATs allow outbound connections by default; UPnP opens up incoming connections.
        • bogomipz 10y ago
          Oh I see the UPnP IGP AddPortMapping. Do the Merkai access that UPnP profile out of the box?
      • fryguy 10y ago
        My understanding of UPNP is that it allows the router itself to become a discover-able device on the network. Then the IoT device connects to the router and adds a static port mapping from the router's public IP address on a specific port to the IoT's private IP address. The NAT still works as it normally does where any packets that try to leave the network get remapped by the router seamlessly. The danger in this case is the IoT device has a listening port on your public IP address, allowing attackers to connect directly to it through your router.