Use "Parental controls" for IoT security?

[Jerry12]

ASUS router has "Parental controls" to block, per device:

• Adult
• Instant Message and Communication
• P2P and File Transfer
• Streaming and Entertainment

Q. Are these controls useful at all for securing IoT devices like NAS, thermostats, and smart TVs from contacting malware or spyware servers?

Q. Just what do these controls block?

This feature isn't designed for this but why not turn it on if it doesn't break anything? Well, actually, it turns out that Synology NAS cannot install packages with these controls enabled, and the symptom is simply that it spins for 3 hours and gives no diagnostic information at all. And trying to install another package during that time seems to quietly add it to the queue, AFAICT. It took me hours to figure that out.

 

[L&LD]

@Jerry12, I don't consider a NAS to be an 'IoT' device.

But, filtering for 'Adult' content on your thermostat may help keep the heat down.

 

[Grisu]

Why dont you put your IoT devices on guest wifi, so they are separated from your intranet.

 

[Jerry12]

That's good advice. I did put most of those devices on the guest wifi.

But they could still spy, join a bot net, or do other mischief.

 

[CaptainSTX]

That's good advice. I did put most of those devices on the guest wifi.

But they could still spy, join a bot net, or do other mischief.

On a weekly basis just log into you router and go to traffic analyzer and look at how much traffic each device is using. Not much no problem a lot then you need to see what the device is doing.

Human intervention is sometimes required to manage your network.

 

[Jerry12]

On a weekly basis just log into you router and go to traffic analyzer and look at how much traffic each device is using. Not much no problem a lot then you need to see what the device is doing.

A good idea, indeed! I turned it on 4 days ago and discovered my Nexus 7 tablet uploading nearly 3 GB/day over SSL/TLS since then while just sitting and charging! It was a steady 117 MB/hour. Downloads were only 4-6 MB/hour.

Today I rebooted it and uninstalled some apps, then later rechecked its traffic. The uploads phased out (down to 0-200KB) between "3h" and "5h" on the Traffic Analyzer graph. Assuming that means 03:00 - 05:00, it was 5-8 hours before rebooting!

One Mac was also uploading ≈117 MB/hour, also phasing out by 05:00, then going up and down between that and 0 the rest of the day. I'll reboot it.

Any ideas about what's going on?

 

[Jerry12]

Correction: The Mac upload traffic started when the Nexus 7 ended.

Nexus 7 graph:

Mac graph:

What to look into now?

 

[Grisu]

someone likes your data.

 

[CaptainSTX]

Have you also clicked on the apps button to see if it provides any other clues to what is going on?

 

[Jerry12]

Have you also clicked on the apps button to see if it provides any other clues to what is going on?

Yes, the Apps button confirms that it's almost all SSL/TLS upload traffic.

The consistent upper bound might be due to rate limiting in the cable network.

 

[CaptainSTX]

One WAG is that it is the I-Pad backing itself up to the cloud. Go into the log/connections and see what IPs the I-Pad is connecting to. Might be able to determine where the I-Pad is connecting by seeing who the IPs belong to. If it is someplace outside the USA might be time to do a factory reset on the I-Pad.

If you are running Skynet you also could try blocking the offending destination IPs and/or countries and see what happens.

 

[Jerry12]

Go into the log/connections and see what IPs the I-Pad is connecting to.

Log/Connections is interesting!

The tablet has been fine since a few hours before (!) rebooting it. It's the Macbook Air that's now doing most of the SSL/TLS uploads and the Nest Hello has also joined in.

To test a hypothesis that a browser tab was doing the SSL/TLS uploads, I closed most of the MBA's Chrome windows, restarted Chrome, and quit everything else. Then it was used for a video conference. Traffic Analyzer shows its SSL/TLS uploads have been down to 11 - 65MB for 4 hours.

Log/Connections showed lots of connections. I ran whois on the IPs. I'll check again when it's not in use.

 

[Jerry12]

BTW the Nest Hello just has one connection and that's to GOOGLE-CLOUD which seems fine but its upload traffic was <2KB/day for the previous few days and going up and down today, peaking at 125MB/hour.

Is Traffic Analyzer straightforward to interpret or complicated by subtleties, e.g. does it confuse clients after DHCP assignments change? (I doubt the DHCP assignments are changing but this would explain the traffic hog handoffs.)

Thanks for the suggestions.