About a year ago I wrote a post called What Is Normal?
The argument I was making was fairly simple:
If you don’t know what normal behaviour looks like for your network and the hosts on it, how can you identify abnormal behaviour?
At the time I was mostly thinking about corporate networks — environments with people dedicated to security, monitoring tools and hopefully some understanding of what should and shouldn’t be happening.
Then I came across a report of a domestic coffee machine generating roughly 1TB of network traffic over ten days.
Interestingly, most of that traffic appears to have remained on the local network rather than being uploaded to the internet, and the suspicion was a software or networking fault.
But what if it hadn’t been?
What if that coffee machine had been exfiltrating data for months? Who would have noticed?
Because why would you be looking?
It’s a coffee machine.
There is a general trend towards connecting more and more devices to our home networks.
Alexa, thermostats, televisions, fridges, doorbells, EV chargers and now, apparently, coffee machines.
A few questions immediately come to mind:
- Why?
- Who does this benefit?
- What are the security implications?
Why does a coffee machine need an internet connection?
I can understand software updates, diagnostics, ordering supplies and perhaps some remote functionality.
But if my coffee machine refuses to produce the morning cup one day, I’m probably going to boil the kettle, reach to the back of the cupboard for the Nescafé granules (they’re still a thing, kids) and make a mental note to get the machine repaired.
Unless, of course, there is something else going on.
Perhaps that’s a post for another day.
The security question interests me more.
Every one of these devices contains some form of computer and network stack. That means each one is potentially vulnerable.
A compromised IoT device doesn’t need to be particularly powerful to be useful to somebody running a botnet. Thousands of relatively insignificant devices can collectively generate a significant amount of traffic.
And some connected devices control things in the physical world.
Imagine waking up on a cold January morning to discover that your internet-connected thermostat has been compromised.
The heating is locked at 5°C.
The screen tells you to send Bitcoin somewhere if you’d like control of your heating back.
That’s hypothetical, but the ingredients are already there: an internet-connected computer controlling something physical.
Which brings me back to my original question.
What is normal?
In an enterprise network, we expect some level of monitoring.
But who monitors a domestic network?
Should your ISP have some responsibility for identifying obviously abnormal behaviour?
If a household that normally uploads 20GB a month suddenly starts generating terabytes of outbound traffic, should somebody notice?
And how would an ISP distinguish between a compromised device and somebody who simply installed another 22 IoT devices over the weekend?
Perhaps there is a solution.
Most ISPs supply their customers with a router. These devices already have some ability to identify connected equipment, using MAC address information and other network characteristics.
What if we extended this capability?
Imagine a domestic router that fingerprints connected devices and establishes a baseline of normal traffic behaviour.
Not by examining the contents of everyone’s communications, but by understanding traffic volumes, destinations, protocols and patterns.
A television communicating with YouTube? Probably normal.
A coffee machine suddenly generating hundreds of gigabytes of traffic or connecting to thousands of unusual destinations?
Perhaps worth investigating.
If the router detects a significant departure from normal behaviour, it could send the homeowner a simple notification:
“We’ve noticed unusual network activity from your coffee machine. Is this expected?”
No complicated security dashboard, no requirement to understand TCP/IP, just an indication that something might be wrong.
Customers who want additional assistance could opt into an enhanced service where their ISP helps investigate the behaviour.
Interestingly, there is already a standard that could contribute to this.
Manufacturer Usage Description (MUD), RFC 8520, published in 2019, describes a mechanism through which manufacturers can declare the network communications their IoT devices are expected to require.
Combine manufacturer-defined behaviour with observed network activity, and we could begin to establish a reasonable understanding of what is normal for individual domestic devices.
Of course, that introduces another set of questions.
Who owns the monitoring information?
How much visibility should an ISP have into somebody’s home network?
How do we ensure security monitoring doesn’t become surveillance or censorship?
And who ultimately takes responsibility?
We increasingly expect ordinary people to operate homes containing dozens of internet-connected computers, but provide them with almost none of the security expertise or monitoring we’d expect in a corporate environment.
As enterprise security becomes more sophisticated, poorly secured and poorly monitored domestic devices remain an attractive target.
Perhaps it’s unreasonable to expect everyone to become a cybersecurity expert simply to make a cup of coffee.
We keep putting computers into things.
Perhaps we need to spend a little more time thinking about who is responsible for securing and monitoring them.
