“We were able to make the device completely inoperable by preventing a local operator from controlling the drill through the onboard display and disabling the trigger button."
The wrench has a web UI to program it or monitor it. It also talks a few “standardised” car-manufacturer protocols for recieving and sending instructions/measurements/certifications. And it can send also send stuff to a local history server.
The majority of the CVEs seem to exist in its onboard webUI system, with a few in the manufacturing protocols.
But yes, IoT devices should be on an isolated vlan or on pvlans. That should be standard practice.
Access from wrench->server should be via a firewall that logs connections. And access from management->wrench should be via firewall with logging.
There is no reason for unauthorized people to have access to the wrenches network, and there is no need for the wrench to communicate with anything other than the local history server.
Yup, that would be sensible security practices.
The wrench has a web UI to program it or monitor it. It also talks a few “standardised” car-manufacturer protocols for recieving and sending instructions/measurements/certifications. And it can send also send stuff to a local history server.
The majority of the CVEs seem to exist in its onboard webUI system, with a few in the manufacturing protocols.
But yes, IoT devices should be on an isolated vlan or on pvlans. That should be standard practice.
Access from wrench->server should be via a firewall that logs connections. And access from management->wrench should be via firewall with logging.
There is no reason for unauthorized people to have access to the wrenches network, and there is no need for the wrench to communicate with anything other than the local history server.