Research finds consumer-grade IoT devices showing up on corporate networks | Hacker News Reader

Research finds consumer-grade IoT devices showing up on corporate networks

theregister.com

26 pointssamizdis11 comments

It seems like we have all the pieces where the part of the corporate network that's exposed to employees in the office doesn't have to be terribly special or locked down.

With all the work-from-home shifting, they are already used to dealing with devices coming from networks they can't control. So they could just treat the office floor network similarly.

Exactly. The days of strong (but imperfect) network perimeter security and soft squishy underbelly once you’re inside are over, or at least should be.

Report cited in article: The Connected Enterprise: IoT Security Report 2021

Oct 20, 2021, Palo Alto Networks

https://www.paloaltonetworks.com/resources/research/connecte...

Well, duh. I've never seen an office that didn't have crap people brought from home and hooked up. "Hey we don't get good wifi in here, I'll bring an old router tomorrow."

That's not the implication. The term IoT suggests devices not related in any way to networking like a smart toaster, wifi connected coffee pot, or your wristwatch.

In our company, if they detect more than one MAC address behind a corporate switch port, they shut down the port. I don't know the exact rules, but I know, it does not need much to trigger to lock the port.

I've seen that, but it's a losing battle. People will unplug company IP phones and plug in their thing instead. Or use any number of other user-space networking, wifi sharing, etc, tools. Eventually you end up having to whitelist every legit MAC addr. Even that isn't safe, since I can spoof the MAC of anything I just unplugged, and many of them have helpful labels on them. So now you have to deploy certificates, and exceptions for things that don't support them. I imagine bad actors recognize which sorts of devices don't support certificates, so they would know what to unplug and spoof. Ugh.

Just treat the office network as untrusted and be done with it. That's how every "WFH" worker is coming into your network anyway.

I don’t know if it’s a losing battle. That doesn’t happen at my workplace because they tell you day 1 that your employment is at risk if you do that. We can’t even plug in usb devices other than mouse dongles and approved printers. No charging phones, no flash drives(only certain approved devices that few people have). I’m in IT and I never encounter people going rogue.

I wouldn't trust "threat of being fired" to work universally across thousands of people though. People are strange.

Even WFH users have to use an company notebook. If you let use the user with to work with there home PCs, then yes, you lost anyway.

Reminds me of the coffee machine script from https://github.com/NARKOZ/hacker-scripts

Reply on news.ycombinator.com