8

With the increased security risks against IoT based smart homes, many security appliances have been commercialized. These appliances or boxes claim to protect the home network from malware, cyber-attacks, and preserve consumer’s data privacy.

There is a growing list of entrants in this space, including F-Secure (SENSE), BitDefender BOX, and many others.

I would like to know how technically these boxes work, is there an open source among them?

Do they simply work like traditional IDS/IPS/Firewall, I am sure there are many differences and the 'cloud support' is one of them, is there other differences?

  • I'm not sure this is really a IoT question. It would probably be better suited to one of the network specific groups – hardillb Jan 8 '18 at 16:18
  • 4
    thanks @hardillb, but I do believe that this question is very specific to IoT, because particularities of IoT networks have motivated security researchers to rethink and rebuild new and more intelligent perimeter security solutions – BiG_TooTh Jan 8 '18 at 17:30
  • anyway.. if i didn't get an answer here, how do I do ? is there a way to link this question directly to the 'Information Security' group, or I just re-ask it there .. can I do that ? – BiG_TooTh Jan 8 '18 at 17:32
  • The moderators can move it if they think it's suitable or they will just delete it and you can ask on the correct site. I still think this is off topic because you are asking how these IDS systems work, which is very specifically a networking question. – hardillb Jan 8 '18 at 20:20
  • 1
    Many questions are valid on more than one site at a time - I think this is fine here as a general catch-all for this type of product (effectively a definition) rather than the in-depth operational specifics that might be covered on Information Security.. – Sean Houlihane Jan 9 '18 at 10:13
7

The boxes are Intrusion Prevention Systems (IPSs) that work by monitoring for "Indicators of Compromise" (IoC). This would be network traffic that is unexpected in your environment; network traffic that goes to a known bad destination; or network traffic that contains packets consistent with malware.

Typically, these boxes come with a subscription. The company selling them sends out frequent updates (daily or more often) that refresh the IoC database. If they discover that some ransomware reaches out to https://ransom.keyserver.evil.example.com, they might immediately add the network address to the IPS blacklist, and publish it to their customers as soon as they can. If you have a device on your network that tries to connect to get a ransomware key, their IPS will break the connection so you don't get infected.

Some of these boxes also come with software that maintains an inventory of your devices. You can take a look at all of the little IoT things on your network today, and bless them all. Tomorrow, if it detects there's a new node on your network, it can pop up a warning on your mobile phone that says "New thing detected on your network, authorize (yes/no)?" This might help you block someone borrowing your wifi, or hacking into your network.

There isn't a direct open source replacement for all of these functions; not because the technology is so special, but because the constant updating of the IoC database requires intel constantly gathered by humans responding to new incidents, and paying a bunch of humans is expensive. You can achieve some of this functionality with an open source IPS system like Snort, but the Snort "community" subscription is updated 30 days after their commercial subscription. That's quite slow when today's common threats include 0-day based malware.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.