 Hi, my name is Kalyan. It's spelled as K-A-L-Y-N. I'm from Hyderabad, India. So my talk here is about smart homes security with Tor. So I mean, before I start, I wanted to know how many of people use smart homes or Tor in their daily lives. OK, so I mean, we have seen pretty much cyber attacks recently in Mirai, Botnet, and Brickabot, which really takes advantage of the unsecured smart homes and just lock you out of your own home. So let's get started. Yeah, I mean, there's a brief description about me. So Internet of Things is something like when I say to the people, people will think, what is he saying? People who know about Internet of Things, OK, they understand it. People who doesn't know anything, they say that he's just a mad man rambling something which we don't know about. So I mean, if you search in Wikipedia, because that's the only thing we do every time we go for Google or something like that, we search the definitions of a few things. So if you search Internet of Things in Wikipedia, you will be getting the following information from it, saying that it's an intercontability between devices where they exchange data between them and everything. So yeah. Hello? OK, thank you. So I'm sorry? Yeah, I mean, I could do that if you want. So this is what we get from a search in Wikipedia use about Internet of Things most of the time. So intercontability between devices that are in various forms like a sensor, a camera, or a smartphone, or a smart hub. So yeah, I mean, the brief Internet of Things that we have right now, so laptops, ovens, machines, and smart hubs, fridges, cars, and everything. So this is like estimated number of things that we get smart homes in the following years. So if you see like 2020 at the last over there, we have around like 50.1 billion devices that can get connected to internet by in the next three years. So we need security because you don't want to be a loser by getting logged out of your house. Because before, we had a hardware key which got duplicated much easier. And now it is pretty much easier to just make you out of your house within like five seconds. So if you see the scenario of how do these IoT things get exploited in there, like I mean, I kind of did it in four types. Basically, DDoS attacks. I mean, you get DDoS attacked on your public IP address for your smart home or botnets and malware attacks, which we have seen recently in like 2016 and 2017. And the weakening parameters, because we should accept that people make products, but they are not secure because they have hard-coded passwords or back doors or many other like XSS or CSRF, which are pretty much useful to bypass authentication system most of the time and data breaches. Like we have seen, I think there was a month dedicated for data breaches in this year, but I'm not sure which month was that. But in every one, which is like you get turned to a third party service, and the third party gets hacked. So indirectly, when you're secure, your data got breached by the third party. So most of the times, we happen to be in the second and the fourth and fifth case. Yeah, sorry for that. So yeah, I mean, what we have learned from recent attacks is that we lack security evidence because most of the people doesn't know that they have to change your default router password or your smart home password or a hard-coded default password, which is present. But most of the people doesn't know that it has an authentication system in their devices. And default credentials, as we have seen that, if you have seen the top 2017 password, we still have the password as the password itself in the first rank. So that's a kind of problem with us. And there are too many devices to manage people. People like to be very comfortable in their lives. They don't want to spend their time fixing all these things. So they just want to connect to the internet on that time. And they just forget that there's a device which can take your entire data and put it on internet for others to use. And making everything smart is not always a good idea, as my father says that it makes man lazy because if you see the ratio of the people who have technology and love technology, they just want to use smart devices in everyday life. But it kind of reduces the interaction with objects. For example, you can control your fan or your kitchen from your mobile phone. But you don't walk to your fan to off it off or you don't want your kitchen to off the oven or something like that. Because at some point of time, you kind of depend on your smart home to do everything for you rather than do it for yourself. Because it just kind of we miss that interaction with the systems. Because if everything becomes smart, nothing will be no more a human being rather than a robot which do this kind of task. That's it. And the other thing is that we don't have timely updates when there's an exploit or a zero day, which is in the wild or came into the market. Because we have seen recently the NSA's zero days or the ethanol blue or Hanukkah. Because Microsoft didn't bother to patch the Windows XP systems and Windows 7 systems. But later on when it was at its peak, they said, OK, we are going to give you the patch because we feel bad or because it is our fault. But at first they ignored it, basically. Yeah, I mean, this is kind of funny because no one experts your refrigerator or smart TVs to send spam mails. Because whenever I get a spam mail, so it is going to be like you have like 50 million euros or 50,000 pounds from a system or a mobile phone. But it is kind of fascinating and funny at the same time. Because if people see that a refrigerator sending a spam mail, they're going to laugh at you saying that how can it do that. But still, of course, it can do because when it's connected to internet, it is wide open, much more than the normal refrigerator that we use. Yeah, so this is from the IoT botnet in 2016, I think. So yeah, 25,000 CC cameras got hacked. And they launched a DDoS attack. It is kind of smart in terms of the guy who attacks it. Because if you like to know the origin of the source of an attack, so it becomes much easier to know that it is coming from a camera. But it can be a kind of confusing for the people since people never expect a camera to DDoS your site or DDoS your infrastructure most of the time. So do we need security? So yes. So sometimes we have security in the last picture because in a few websites, if you see the source code, you will be having something like that. Login.html is equals to 1 is for the login page. But if you see the next line, it will be like login.html equals to 2. So if you click on the login.html is equals to 2, you directly can enter a hub of cameras to control everything. So we need to accept that we became lazy because of technology that we depend upon. And also to automate our daily tasks because you don't want to spend much more time on doing daily chores than you want to automate most of your stuff, like your morning coffee so that you could just get up and go there and pick your coffee and do your work. And also it saves money most of the time for us. So I mean, people would like to have their own personalized home setup most of the time because people are not so sure in these days of using a commercial product rather than building on it on their own or working on their own home automation systems. So and a few people like me who would like to experiment new things and how they work, they would like to tinker with them most of the time knowing how they work or how do they interact with each other in their own protocols. And it can be a new experience altogether if you have taken certain responsibilities while we do this stuff. So yeah, for people who doesn't know how does Thor work. So Thor is like an open VPN system where you get connected to a different number of clients once you download their Thor browser. So Thor client starts up their relay nodes and you get connected to another relay node randomly. So your IP address is not revealed in this process or at the ISP level also. So they are like two type of relay nodes. The first one are the entry node and the exit node. So the entry node doesn't know your IP address or anything but only it just carries your request to the next node. So it has basically three fields. The entry node, the your request and the next node IP address, that's it. So the exit node can only, so the ISP only knows the exit node of the Thor relay rather than your original IP address which is kind of good because we like in this age of digital security and privacy we need a few things to do like which can be against a few governments or against legal reasons. But still we just wanted to know how things work and how do they get implemented in the real world. So the question comes up like how can we use Thor on smart homes? Basically we have seen that most of the encrypted sites have a problem with libraries or TLS implementation and also we don't have a proper solution to make smart things much more secure than what we have, what they say they are secured. So we don't want others to pry on our personal lives anymore or we don't want to know that you got hacked after three months and you don't want to know that your son has been watched by someone in the internet by a doll you bought it which is connected to internet. Yeah, so we will be using an open source system called Home Assistant, it is mainly written in Python. So we can install this on Raspberry Pi and we can operate it from the Thor. So you can connect your Raspberry Pi without a need of an extra monitor by using a micro USB and a normal RJ45 jack to your computer. And you can use your laptop screen as your Raspberry Pi screen. So I am using a latest Raspberry Pi 3B Plus version with the latest Raspberry N operating system. So recently the SSH has been like off by default due to the attacks on IoT things. So you could have like if you want SSH to be enabled by default you could just add a folder in your boot file just a empty folder saying it is SSH and whenever the Raspberry Pi boots it detects there is a SSH folder in it and you could use your Raspberry Pi from the start. So we'll be connecting our system to the Raspberry Pi screen by using a VNC which you can enable it on entering the sudo raspi-config command and you can just go for interfacing options and on the VNC server. So by default all the latest Raspbian OSes come with the real VNC server installed by them so you just need to enable the VNC server over there and just type the command. So to install home assistant in a Raspberry Pi you can just enter, so I have installed it. So to start its service so you just need to enter has. So while it's starting to boot, so we could just open. So our RC file is the file which has all the details of the Tor configurations for a client and a server. So I mean how do we connect Tor to the smart home will be creating a hidden service in the Tor so that we will have a unique onion address given to us and we'll be using a string called server authentication, sorry, and also a stealth keyword which also makes it much more secure to the other Tor nodes so that they don't know like which address that you are accessing to and it also requires an authentication cookie to access the home smart home system. So without the authentication cookie your onion address cannot be routable to the exact protocol. Yeah. What kind of address would you call? Yeah, unique onion address you will be having unique. Yeah. So yeah, the hidden service directory says where it is installed exactly and the service port number is the port number where you would like to access the Tor port number. You could even keep it as your, the same port number as the home assistant or you could just keep it for default as a HTTP port number. The hidden service authorize client is the thing which gives you a authentication cookie and the stealth keyword is something like which makes you the connection more secure without the cookie. No one can like route to your onion address and it becomes like you cannot get, I mean there'll be no scanning of your iPad address or DDoS attacks on your system and no one even connected to your smart home system even though they have an onion address. So after you have make the changes you just need to save it on the Tor RC file and you just need to restore the Tor service because it can now create a unique onion address for you with a cookie which you can access in it. So the words short 2017 Tor or hash 2017 Tor are like a generic client names which you can specify on your own and also the hidden service directory can be anything as you like. Now we need to access the unique onion address and authentication cookie from the hidden directly slash host name which has your, so yeah this is your unique onion address, the authentication cookie which you are supposed to enter in your Tor RC file on your client side so that you could access your smart home from that unique onion address. So you need to open the Tor RC file on the installed directory slash Tor browser slash browser Tor browser and data and Tor and Tor RC so you need to define it as a hidden service authentication and your onion address with your authentication cookie. So whenever you go for that onion address your Tor knows that you are the genuine client who has an authentication cookie and who has access to the home smart home system. So this will be your starting screen where you can add your devices by, so basically you can add your device information in a configuration.yaml file and just keep it on the server so that it automatically detects that there's a IoT device connected to home assistant and home assistant supports around many. So it's suppose the Amazon Echo, Apple TV and Ikea, Kodi, MQTT and even Nest and Sonos media player. I mean the total number of components will be around 736 at this point so they are like thinking to add more components in the future releases of home assistant. Once you add the information in the Tor RC file in your client system you just need to restart the Tor browser to update its changes from it. Yeah, it works, yeah. So basically if you have seen there is a not so secured it works on HTTP because we have shown it to the HTTP protocol porters. So if you want much more encryption you could just add your private certificate by using let's encrypt which can give you free HTTPS certificate to it and you will be having a much more secured way and you just need to change the line in here. So you could just take out port number 80 and you could just keep the history pairs port number as 443 and you could access by using the history pairs port number and you could even get your own certificate from let's encrypt and sometimes we have a problem of dynamic IP just assigned to us so then you could use a duck DNS server, duck DNS service so that you could connect to your home, smart home by using the DNS server so it will be much easier and much more secure. Yeah, yeah. I mean, if you have any doubts, yeah, sure. I'm sorry, the software that we are using is entirely open source. Okay. Yeah. So I mean, I have a command list so that I could give it to you so I'll be attaching it with my PowerPoint so that you could have all the command that you should work on the server side and the client side also. Yeah, any more? Yeah, I'll be uploading it as soon as possible. Any more questions? Yeah, I mean, that is the one thing that because if you want all things then you need to compromise at some point, so. But of course, there will be some latency issues with the thought but I know, I mean, you don't want to be watched by someone so you need to compromise it like on the speed side but thought is really working on to get more to reduce the latency issues and they are working on to secure thought internally more by sandboxing the entire process and also working on new algorithms for the thought release and so that whenever you kind of the random relay you get connected to will be the fastest relay in the network. Yeah, sure. Otherwise, thought is designed not to be the fastest otherwise that would be a better thought. I mean, I mean, I'm not saying too fast like 100 GPS network or 100 GPS network but if you have seen that, if you want to access Facebook by a thought if you compare the accessing speed by a ISP level to a thought level, we will be having a lag in the loading time. So it can be reduced to some point so that it is not at speed as possible from the ISP level but you will be, it will be good to access like you don't want to wait the next 30 seconds just to look at a blank screen loading the Facebook.com in thought. So any more questions that you can ask? Thank you so much and have a great day and happy hacking.