<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div class=""><div class="">I was talking to Cristian at lunch also about integrating SPIN, so yes, detecting and quarantining infected IoT device is important, but the big question is what do we do with the infected device.<br class=""></div></div></blockquote><div><br class=""></div>Basically using the same quarantining used for new devices would be sufficient:</div><div><br class=""></div><div>a) drop all connections to the „outside"</div><div>b) if the device is connected wirelessly isolate it at AP level</div><div>c) inform the end user and recommend to remove it from the network (?)</div><div><br class=""></div><div>I don’t know in detail how you implemented the quarantining, are there any papers about it?</div><div><br class=""><blockquote type="cite" class=""><div class=""><div class=""><blockquote type="cite" class="">-----Original Message-----<br class="">From: Peter Steinhäuser <<a href="mailto:ps@embedd.com" class="">ps@embedd.com</a>><br class="">Sent: October 22, 2018 1:51 PM<br class="">To: Jacques Latour <<a href="mailto:Jacques.Latour@cira.ca" class="">Jacques.Latour@cira.ca</a>><br class="">Cc: Jelte Jansen <<a href="mailto:ripe@tjeb.nl" class="">ripe@tjeb.nl</a>>; Jim Reid <<a href="mailto:jim@rfc1035.com" class="">jim@rfc1035.com</a>>; RIPE IoT WG List<br class=""><<a href="mailto:iot-wg@ripe.net" class="">iot-wg@ripe.net</a>><br class="">Subject: Re: [iot-wg] "The Internet of Threats: Fighting FUD with MUD"<br class=""><br class="">Unfortunately MUD does not solve the possibility of corrupted/hacked update<br class="">servers. This is a highly likely attack type we will see in the future.<br class=""><br class="">I highly appreciate your approach of detecting behaviour pattern changes of<br class="">devices, it could help reducing the effects of hacked devices as well as from<br class="">corrupted firmware updates.<br class=""><br class="">I also think a collaboration with the SPIN project would be really beneficial, they<br class="">work on similar concepts and solutions and can contribute a lot.<br class=""><br class=""><blockquote type="cite" class="">Yes, we just talked about this at lunch, MUD would be useful to lockdown your<br class=""></blockquote>smart TV to netflix and youtube only + vendor firmware update.<br class=""><blockquote type="cite" class=""><br class=""><br class=""><blockquote type="cite" class="">-----Original Message-----<br class="">From: Peter Steinhäuser <<a href="mailto:ps@embedd.com" class="">ps@embedd.com</a>><br class="">Sent: October 22, 2018 10:02 AM<br class="">To: Jacques Latour <<a href="mailto:Jacques.Latour@cira.ca" class="">Jacques.Latour@cira.ca</a>><br class="">Cc: Jelte Jansen <<a href="mailto:ripe@tjeb.nl" class="">ripe@tjeb.nl</a>>; Jim Reid <<a href="mailto:jim@rfc1035.com" class="">jim@rfc1035.com</a>>; RIPE IoT<br class="">WG List <<a href="mailto:iot-wg@ripe.net" class="">iot-wg@ripe.net</a>><br class="">Subject: Re: [iot-wg] "The Internet of Threats: Fighting FUD with MUD"<br class=""><br class="">Hi Jacques,<br class=""><br class=""><blockquote type="cite" class="">I just joined this group. Today's and tomorrow's smart television<br class="">are more a<br class=""></blockquote>full blown computer with screen and keyboard, and it difficult to pin<br class="">down exactly what the device should be doing in a MUD profile. It's<br class="">not a real IoT device.<br class=""><br class="">nevertheless a MUD file could be used to describe service classes of<br class="">a TV, like „TV Streaming“, „Social Media“ etc. to give the end user<br class="">simple choices and at least some control about what the device should be<br class=""></blockquote></blockquote>allowed to do.<br class=""><blockquote type="cite" class=""><blockquote type="cite" class=""><br class="">Regards,<br class="">Peter<br class=""></blockquote></blockquote></blockquote></div></div></blockquote></div><br class=""><div class=""> <br class=""><div id="sig" style="border-top: dotted 1px #999999; padding-top: 10px; padding-botton: 10px; margin: 11px 0; font-family: 'Lucida Grande', Verdana, Arial, Sans-Serif; font-size: 11px;" class=""> <img src="https://www.dropbox.com/s/tgpbappyzk8y5za/embeDD_mail_sig.png?raw=1" width="180" height="38" align="left" style="margin-right: 20px; padding-top: 2px;" class=""> <div style="color: #999999;" class=""> <strong style="color: #333333;" class="">Peter Steinhäuser, CEO</strong><br class=""> embeDD GmbH · Alter Postplatz 2 · 6370 Stans · Switzerland<br class=""> Phone: +41 (41) 784 95 85 · Fax: +41 (41) 784 95 64 </div> <div style="clear: both;" class=""></div> </div> </div> <br class=""></body></html>