PITCHR: Prevention of IoT-enabled Crime using Home Routers

Research summary

The home router is taking on increased importance as homes become smarter. Having traditionally been the access point for home users to access email and web services through a desktop computer, they are now becoming the entry point for a myriad of Internet-connected devices. These include smart assistants (eg Amazon Echo and Google Home), smart wearables (eg Fitbit), smart security (eg Ring and baby monitors), smart appliances (eg smart kettles, fridges and washing machines), smart energy (eg Nest and smart plugs) and many more. 

In 2016, the Mirai botnet caused a massive distributed denial of service (DDoS). The attack showed the impact of combining the power of millions of devices to bombard a system with traffic until it's overwhelmed. Mirai took advantage of insecure IoT devices, (such as routers, printers and cameras) scanning the Internet for open ports and attempting to log in using frequently-used default username and password combinations. Once the system had control of devices, it could send requests to a system to overload it. In November 2014, a Russian website was found to be streaming live webcam feeds from homes and businesses, with over 500 coming from the UK.  In all cases, this traffic was requested and used by URLs that should have been recognised as illegitimately requested.  

Internet Service Providers (ISPs) are the organisations that provide consumers and businesses with services to access, use, or participate in the Internet. The question arises as to whether ISPs, through router intelligence, could play a substantive role in recognising IP spoofing, where employed, and denying the traffic egress. If ISPs can combine central cyber intelligence and situational awareness with that at the edge, there is a huge potential to prevent and mitigate these forms of cyber crime.

This project aims to:

• To understand the perceived role of ISPs in preventing attacks using household consumer IoT – this will allow us to establish reasonable responsibility and expectations of ISPs
• To understand the role of manufacturers of home routers – this will allow us to understand whether there should be a minimum role played by manufacturers, in the way new expectations of device manufacturers have arisen
• To understand the cost implications of router-based defence systems – this will help inform recommendations for ISPs and manufacturers, since customers are price sensitive
• To understand the impact on, and benefits for, citizens – to enable a cost-benefit analysis
• To understand the current research landscape in the area