Can Kaleidescape function properly in an isolated VLAN on a home network?

[jmpage2]

I normally place any IoT type device on an isolated VLAN for network segmentation and security. However my suspicion is that for Kaleidescape devices specifically this might cause problems with local access and control unless I build connections from my primary LAN to the isolation VLAN by opening up the needed ports for traffic between the two.

Wondering if any network savvy people here have dealt with this?

Thanks

 

[artur9]

@jmpage2 if I may ask the question: You consider your home theater devices to be IoT devices? Is that common in the IoT world?

 

[Wonkavision]

In my book, IoT devices are things like my thermostat, pinball machines, and stock/sports ticker. Those all live on a dedicated IoT VLAN.

My Kaleidescape Strato E and Terra Prime SSD 8TB Movie Server, on the other hand, are both connected via Ethernet to my primary entertainment VLAN. I consider Kaleidescape a dedicated media system rather than a typical IoT device.

While you certainly can isolate Kaleidescape on its own VLAN, I haven’t encountered any compelling reason to do so, particularly if it introduces complications with device discovery, local control, or communication with other components of my home theater system.

I generally segment my network based on device function, trust level, and communication requirements rather than simply whether something connects to the internet.

 

[jmpage2]

Anything that connects to the Internet with SSL communications and you can't decrypt the communications on fits into the IoT (Internet of Things) or OT (Operational Technology) bucket from a cyber security perspective.

Basically if you don't know what the device is doing the question is do you trust it to sit on your network and not do something that you wouldn't want it doing or something that could be destructive like trying to hack into your other devices/servers.

There is a geniune risk of any of those umbrella of devices getting compromised through a bad firmware update that includes malicious software, etc... and this has happened to a variety of devices many times.

Also, some companies take cyber security more seriously than others... I'm a lot less concerned about an Apple TV going off the reservation than something from a small company that probably doesn't have a single security engineer working there.

Keep in mind as well that Plex itself was recently shown to be vulnerable to some of the critical vulnerabilities were uncovered in October.

At the end of the day the best practice is to isolate those devices so that they can't communicate with other devices on your network. Since most devices are cloud controlled this usually doesn't affect operation... however, there are still many devices that use older techniques such as direct connectivity over a local LAN for control. It's then up to the user to decide if they trust the device to sit on the local LAN or if they will go further and restrict it from communicating over the specific ports/protocols it needs to do its job and simply not let it do anything else.

Paranoid? Maybe.. but security people tend to be paranoid.

 

[DieZwei]

Sure you can do it, but as you already mentioned yourself, you´d need to open up communication between your IoT VLAN and the VLAN where your control devices (iPhone, iPad, automation system - depends on what you´re using) reside and communication to the Internet.

 

[jmpage2]

Well this was an unknown to me that has since been confirmed. Most newer devices use cloud control specifically so they can be made secure on a hardened network. If I open the app to control my garage openers, thermostat, shower, ceiling fans, all of that communication is proxied through the cloud.

 

[DieZwei]

If I open the app to control my garage openers, thermostat, shower, ceiling fans, all of that communication is proxied through the cloud.

Wow, that means if your Internet connection is down, you won´t be able to control your house?

 

[OCD2]

Wow, that means if your Internet connection is down, you won´t be able to control your house?

A lesson I learned a long time ago before building a house with home automation is to design backup functionality for mission critical functions such as natural gas generator power for HVAC, refrigeration, garage doors, etc., and manual switches for bathroom lights and so on.

 

[DieZwei]

A lesson I learned a long time ago before building a house with home automation is to design backup functionality for mission critical functions such as natural gas generator power for HVAC, refrigeration, garage doors, etc., and manual switches for bathroom lights and so on.

Yes, same for me. Basic functionalty like switching lights lives in the house infrastructure bus, automation sits on top of that and adds additional functionality. When that drops, the house is still usable, just the convenience suffers.

 

[Wonkavision]

Anything that connects to the Internet with SSL communications and you can't decrypt the communications on fits into the IoT (Internet of Things) or OT (Operational Technology) bucket from a cyber security perspective.

Basically if you don't know what the device is doing the question is do you trust it to sit on your network and not do something that you wouldn't want it doing or something that could be destructive like trying to hack into your other devices/servers.

I don’t disagree with the security concerns. Any networked device can potentially be compromised, and segmentation is certainly a legitimate way to limit the damage.

Where I disagree is with the classification. Using encrypted communications that can’t be inspected as the definition of IoT would effectively put nearly every modern networked device into that category, including our computers, phones, and Apple TVs.

My point wasn’t that Kaleidescape is somehow immune to security vulnerabilities. It’s that I prefer to make segmentation decisions based on the actual risks, functionality, and communication requirements of the equipment rather than simply labeling everything with an internet connection as IoT.

In my particular setup, I haven’t seen a compelling reason to isolate my Kaleidescape equipment further, although I certainly understand why someone with a different security philosophy might choose to do so.

 

[jmpage2]

Wow, that means if your Internet connection is down, you won´t be able to control your house?

I have Starlink as a backup internet on an SD-WAN so this isn't really something I am concerned with. Also, the overwhelming majority of homes that have these devices seem to be getting along fine with these limitations because nowadays Internet services for most Americans are highly reliable with up time of greater than 99.9% or about an hour or three of down time per year.

 

[jmpage2]

I don’t disagree with the security concerns. Any networked device can potentially be compromised, and segmentation is certainly a legitimate way to limit the damage.

Where I disagree is with the classification. Using encrypted communications that can’t be inspected as the definition of IoT would effectively put nearly every modern networked device into that category, including our computers, phones, and Apple TVs.

My point wasn’t that Kaleidescape is somehow immune to security vulnerabilities. It’s that I prefer to make segmentation decisions based on the actual risks, functionality, and communication requirements of the equipment rather than simply labeling everything with an internet connection as IoT.

In my particular setup, I haven’t seen a compelling reason to isolate my Kaleidescape equipment further, although I certainly understand why someone with a different security philosophy might choose to do so.

One of the ways we make risk assessments in the cyber world is the expertise and sophistication of who is producing the software/firmware for the devices. Devices made by small boutique companies with limited (or no) security knowledge are much higher risk than say an iPhone with signed firmware. Multiple times small companies (and even mid size ones) have used public repo sources to roll their firmware and gotten bitten when a repo had been infected with malware that they unknowingly rolled into their code.

I have no knowledge of how Kaleidescape does things specifically but I just tend to put anything like that on my IoT subnet when possible.

You actually can put security certificates on many of the devices you mentioned (phones, PCs, etc) and use a proxy at the network edge to do full decrypt of their traffic so you can see what they are doing.

Like I said it just comes down to best practice and risk assessment.... and yes, we do generally classify devices with specialized embedded code that regularly communicate with public cloud services we can't see into as "IoT" type devices but people can call them whatever they like.

 

[artur9]

Wow, that means if your Internet connection is down, you won´t be able to control your house?

My embryonic home automation is openhab based to avoid that.

And I don't believe in cloud control of devices I own either:

AWS outage reminds us why $2,449 Internet-dependent beds are a bad idea

“Would be great if my bed wasn’t stuck in an inclined position ..."

arstechnica.com

 

[markrubin]

I use RTI as a control system: it does not require an active cloud connection unlike some systems:
for example Control 4 allows your dealer to have complete control of your system: they can even shut you down if you don’t pay your service fee….

 

[rafaelsmith]

I include my media players and game consoles...i.e Apple TV, Rokus, Kaleidescape, smart tvs, even my AVR, etc on my IOT vlan. Have not had any issues thus far. I have firewall rules setup to allow control devices on the main network to be able to access devices on the IOT vlan. My security cameras (Unifi Protect) are even further segmented on their own VLAN that has no access to the internet....only the NVR has access to the internet.

 

[jmpage2]

I include my media players and game consoles...i.e Apple TV, Rokus, Kaleidescape, smart tvs, even my AVR, etc on my IOT vlan. Have not had any issues thus far. I have firewall rules setup to allow control devices on the main network to be able to access devices on the IOT vlan. My security cameras (Unifi Protect) are even further segmented on their own VLAN that has no access to the internet....only the NVR has access to the internet.

Do you use DHCP leases on things like your mobile phones, PCs, etc. to be able to have communication to the IoT VLAN on the ports needed or do you just open up that traffic direction from the entire main VLAN to the IoT VLAN?

 

[rafaelsmith]

Do you use DHCP leases on things like your mobile phones, PCs, etc. to be able to have communication to the IoT VLAN on the ports needed or do you just open up that traffic direction from the entire main VLAN to the IoT VLAN?

The latter.

Using Unifi Zone Based Firewall...I created a "Secure Zone" which contains my main lan and management vlan....then a "UNsecure Zone" which contains my IOT and Camera VLANs.

Source (Secure) -> Destination (Unsecure) I allow traffic.
Source(Unsecure) -> Destination (Secure) I block traffic.

Several other specific rules to allow for things like Pihole, mDNS to work as well as blocking access from the IOT devices to its gateway as well as any of the other gateways. Rules to block the protect cameras from accessing the internet but allow the NVR which is on the Camera VLAN to access the internet.

 

[jmpage2]

The latter.

Using Unifi Zone Based Firewall...I created a "Secure Zone" which contains my main lan and management vlan....then a "UNsecure Zone" which contains my IOT and Camera VLANs.

Source (Secure) -> Destination (Unsecure) I allow traffic.
Source(Unsecure) -> Destination (Secure) I block traffic.

Several other specific rules to allow for things like Pihole, mDNS to work as well as blocking access from the IOT devices to its gateway as well as any of the other gateways. Rules to block the protect cameras from accessing the internet but allow the NVR which is on the Camera VLAN to access the internet.

I have enterprise equipment so I was curious what you were doing.

Unifi is definitely the way to go for anyone who wants a highly capable home network that won't completely break the bank.

 

[DieZwei]

I use RTI as a control system: it does not require an active cloud connection unlike some systems:

That´s actually the case for any serious control system. We use Crestron, same here.

for example Control 4 allows your dealer to have complete control of your system: they can even shut you down if you don’t pay your service fee….

Control4 doesn´t require a recurring fee on its own. So you´re referring to dealer´s who are charging there own fee just for keeping the system up and running?

 

[rafaelsmith]

I have enterprise equipment so I was curious what you were doing.

Unifi is definitely the way to go for anyone who wants a highly capable home network that won't completely break the bank.

Yeah, I have been pleased with Unifi setup. Took some time but eventually replaced everything with Unifi gear. For me, the Zone Based Firewall made setting firewall rules up much more easy and intuitive.