🥇Open tool for monitoring networks with IoT devices

We explain what IoT Inspector is and how it works.

/ фото PxHere PD

On the security of the Internet of Things

At the consulting firm Bain & Company (PDF, page 1) it is stated that between 2017 and 2021, the IoT market volume will double, from $235 billion to $520 billion. Smart home gadgets will account for $47 billion. Experts in cybersecurity express concerns about such growth rates.

According to According to Avast, in 40% of cases, at least one smart device has a critical vulnerability, endangering the entire home network. At Kaspersky Labs, it was found, that in the first quarter of last year, smart gadgets faced three times more attacks than in all of 2017.

To protect smart devices, employees of IT companies and universities are developing new software tools. A team of engineers from Princeton University created the open platform Princeton IoT Inspector. This is a desktop application that monitors the behavior and operation of IoT devices in real time.

How the system works

IoT Inspector tracks the activity of IoT devices on the network using the technique of ARP spoofing. It can be used to analyze device traffic. The system collects anonymous information about network traffic to identify suspicious activity. However, data such as IP and MAC addresses are not taken into account.

When sending ARP packets the following code is used:

class ArpScan(object):

    def __init__(self, host_state):

        assert isinstance(host_state, HostState)

        self._lock = threading.Lock()
        self._active = True

        self._thread = threading.Thread(target=self._arp_scan_thread)
        self._thread.daemon = True

    def start(self):

        with self._lock:
            self._active = True

        utils.log('[ARP Scanning] Starting.')
        self._thread.start()

    def _arp_scan_thread(self):

        utils.restart_upon_crash(self._arp_scan_thread_helper)

    def _arp_scan_thread_helper(self):

        while True:

            for ip in utils.get_network_ip_range():

                time.sleep(0.05)

                arp_pkt = sc.Ether(dst="ff:ff:ff:ff:ff:ff") / 
                    sc.ARP(pdst=ip, hwdst="ff:ff:ff:ff:ff:ff")
                sc.sendp(arp_pkt, verbose=0)

                with self._lock:
                    if not self._active:
                        return

    def stop(self):

        utils.log('[ARP Scanning] Stopping.')

        with self._lock:
            self._active = False

        self._thread.join()

        utils.log('[ARP Scanning] Stopped.')

After analyzing the network, the IoT Inspector server establishes which websites the IoT gadgets are exchanging data with, how frequently they do this, and the volumes of data they transmit and receive. As a result, the system helps identify suspicious resources that may send personal data without the user's knowledge.

Currently, the application works only on macOS. You can download the zip archive from project site. To install it, you'll need macOS High Sierra or Mojave, and the Firefox or Chrome browser. The application does not work in Safari. A guide for installation and setup is available is available on YouTube.

This year, the developers promised to add a version for Linux, and in May — an application for Windows. The source code of the project is available on GitHub.

Potential and Drawbacks

The developers claim that the system will help IT companies find vulnerabilities in the software of IoT devices and create safer smart devices. Even now, the tool can detect vulnerabilities related to security and performance.

IoT Inspector identifies devices that exchange data too frequently, even when not in use. The tool also helps to detect smart devices that slow down the network, such as those that download updates too often.

There are still shortcomings with IoT Inspector. As the application is experimental, it has not been tested on all IoT devices with different configurations. Therefore, the tool itself may negatively impact the performance of smart devices. For this reason, the authors do not recommend connecting the application to medical gadgets.

Currently, the developers are focused on fixing bugs, but in the future, the Princeton University team plans to expand the functionality of their application and integrate machine learning algorithms. These will help increase the likelihood of detecting DDoS attacks to 99%. All ideas from the researchers can be found in this PDF report.

Other Projects in the IoT Field

A group of American developers, collaborating with Danny Goodman, author of books on JavaScript and HTML, is creating a tool for monitoring the Internet of Things ecosystem — The Thing System.

The goal of the project is to unite smart home IoT gadgets into a single network and centralize management. The developers say that devices from different manufacturers often cannot interact with each other and operate separately. To solve this problem, the authors of the initiative created software that can work with various network protocols, gadgets, and client applications.

A list of supported devices is available on the project website. There you can also find source code and quick start guide.

Another open project — PrivateEyePi. The initiative's authors share software solutions and source code for building personalized IoT networks based on Raspberry Pi. The site features a wealth of guides to help construct wireless sensor networks temperature, humidity, as well as set up home security systems.

/ фото PxHere PD

The future of such solutions

Open-source projects, libraries, and frameworks are increasingly appearing in the IoT market. The Linux Foundation, which also operates in the IoT sphere (they created the operating system Zephyr), states that open-source tools are regarded as more secure. This perspective arises from the involvement of the 'collective wisdom' of the cybersecurity community in their development. From all this, it can be concluded that projects like IoT Inspector will become more frequent and help make this segment of devices more secure.

Posts from the First Blog about Corporate IaaS: