Systems and methods for security and control of internet of things and ZeroConf devices using cloud services
Systems and methods for security and control of Internet of Things (IOT) and ZeroConf devices using cloud services. The present disclosure uses an application that runs on a user device in a promiscuous mode to look for potentially vulnerable and compromised machines on the local network. Specifically, the user device can fingerprint ZeroConf and IOT networks based on their static and dynamic behavior. The application discovers all hosts on the network and uses a cloud service such as via a cloud-based system to detect potentially malicious IOTs with known vulnerabilities. Based on an enterprise policy or user's preferences, the solution can alert if any IOT device tries to communicate with the user's device or if the user's device itself broadcasts services running on the device such as screen sharing/file sharing.
1. A non-transitory computer-readable storage medium having computer readable code stored thereon for programming a processor to perform steps of:
causing scanning of a network to detect one or more Internet of Things (IOT) and ZeroConf devices;
based on the scanning, determining a fingerprint of the one or more detected IOT and ZeroConf devices based on at least one of static and dynamic behavior thereof, the fingerprint for each of the one or more detected IOT and ZeroConf devices including at least one of a type of device, a manufacturer of the device, a model of the device, and a configuration of the device; and
providing the fingerprint of the one or more detected IOT and ZeroConf devices to a cloud service for access control and reporting, wherein the access control and reporting include a notification of security risk and associated remedial actions, the remedial actions being manual or automatic.
2. The non-transitory computer-readable storage medium of claim 1 , wherein the computer readable code stored further programs the processor to perform steps of
maintaining a database of the one or more detected IOT and ZeroConf devices; receiving updates from the cloud service based on the fingerprint of the one or more detected IOT and ZeroConf devices; and
performing the access control based on the updates.
3. The non-transitory computer-readable storage medium of claim 1 , wherein the computer readable code stored further programs the processor to perform steps of
determining a security risk of the one or more detected IOT and ZeroConf devices based on the fingerprint and updates from the cloud service.
4. The non-transitory computer-readable storage medium of claim 3 , wherein the security risk is based in part on whether one or more detected IOT and ZeroConf devices utilize factory defined login credentials and/or leak sensitive user data over unencrypted channels.
5. The non-transitory computer-readable storage medium of claim 3 , wherein the security risk is based in part on whether the one or more detected IOT and ZeroConf devices exhibit traffic spikes and/or communicate with any known malicious or botnet servers.
6. The non-transitory computer-readable storage medium of claim 1 , wherein the scanning is in a promiscuous mode on the network.
7. The non-transitory computer-readable storage medium of claim 1 , wherein the access control includes blocking of any of the one or more detected IOT and ZeroConf devices.
8. An apparatus comprising:
a network interface;
a processor communicatively coupled to the network interface; and
memory storing instructions that, when executed, cause the processor to:
cause scanning of a network to detect one or more Internet of Things (IOT) and ZeroConf devices;
based on the scanning, determine a fingerprint of the one or more detected IOT and ZeroConf devices based on at least one of static and dynamic behavior thereof, the fingerprint for each of the one or more detected IOT and ZeroConf devices including at least one of a type of device, a manufacturer of the device, a model of the device, and a configuration of the device; and
provide the fingerprint of the one or more detected IOT and ZeroConf devices to a cloud service for access control and reporting, wherein the access control and reporting include a notification of security risk and associated remedial actions, the remedial actions being manual or automatic.
9. The apparatus of claim 8 , wherein the instructions that, when executed, further cause the processor to
maintain a database of the one or more detected IOT and ZeroConf devices;
receive updates from the cloud service based on the fingerprint of the one or more detected IOT and ZeroConf devices; and
perform the access control based on the updates.
10. The apparatus of claim 8 , wherein the instructions that, when executed, further cause the processor to
determine a security risk of the one or more detected IOT and ZeroConf devices based on the fingerprint and updates from the cloud service.
11. The apparatus of claim 10 , wherein the security risk is based in part on whether one or more detected IOT and ZeroConf devices utilize factory defined login credentials and/or leak sensitive user data over unencrypted channels.
12. The apparatus of claim 10 , wherein the security risk is based in part on whether the one or more detected IOT and ZeroConf devices exhibit traffic spikes and/or communicate with any known malicious or botnet servers.
13. The apparatus of claim 8 , wherein the scanning is in a promiscuous mode on the network.
14. The apparatus of claim 8 , wherein the access control includes blocking of any of the one or more detected IOT and ZeroConf devices.
15. A method comprising:
causing scanning of a network to detect one or more Internet of Things (IOT) and ZeroConf devices;
based on the scanning, determining a fingerprint of the one or more detected IOT and ZeroConf devices based on at least one of static and dynamic behavior thereof, the fingerprint for each of the one or more detected IOT and ZeroConf devices including at least one of a type of device, a manufacturer of the device, a model of the device, and a configuration of the device; and
providing the fingerprint of the one or more detected IOT and ZeroConf devices to a cloud service for access control and reporting, wherein the access control and reporting include a notification of security risk and associated remedial actions, the remedial actions being manual or automatic.
16. The method of claim 15 , further comprising
maintaining a database of the one or more detected IOT and ZeroConf devices;
receiving updates from the cloud service based on the fingerprint of the one or more detected IOT and ZeroConf devices; and
performing the access control based on the updates.
17. The method of claim 15 , further comprising
determining a security risk of the one or more detected IOT and ZeroConf devices based on the fingerprint and updates from the cloud service.
18. The method of claim 17 , wherein the security risk is based in part on whether one or more detected IOT and ZeroConf devices utilize factory defined login credentials and/or leak sensitive user data over unencrypted channels.
19. The method of claim 17 , wherein the security risk is based in part on whether the one or more detected IOT and ZeroConf devices exhibit traffic spikes and/or communicate with any known malicious or botnet servers.
20. The method of claim 15 , wherein the access control includes blocking of any of the one or more detected IOT and ZeroConf devices.