 Hi everyone, my name is Kalyan Dixit and my talk is about securing smart home automation with tar. So it's a very upcoming topic because we have seen many cyberattacks and I mean, what harmful come in, it does cause to a infrastructure in a very big way and it can be fatal if it is not taken properly. So the first question that comes up whenever we speak of home automation is that what is exactly home automation? I mean, why that we have hearing it nowadays more than the previous decade? If you see like, the thing is that home automation is always there in, home automation was always there from even from the 1960s and 1970s. The only difference that we have seen is that we have never seen in that in a huge scale. For example, connecting a battery to a bulb is nothing but home automation, like using a switch to lighten the bulb is home automation, but the only thing is that we have never seen the compactness of it in a very smaller scale rather than in a big scale. If you have seen like a few search like what is exactly home automation, it is nothing but it involves the controlling of all the smaller up like an instance using a smaller gateway by using a protocol either in Bluetooth or Wi-Fi so that you could have an entire control in your hand. So the thing is that when we had the technology has been has been grown exponentially in the last five years. In the same way, the home automation has came up from the back to it came from dead so that you know many people who have been thinking like how to automate those stuff for home appliances have increased their working and they came to know about the new protocols or the new technology that has been existed in this decade which can help them to make it more successful than the previous decade. So early home automation began with labor saving machines and self-contained electric or gas powered home appliances and also which involves the introduction of washing machines, water heaters and sewing machines and etc. But in 2012 by the in the United States according to the ABI research around 1.5 million automation systems were installed so that is just a tip of an iceberg if you have taken the growth rate in the next five to ten years and first generation was a wireless technology which involves fuel lower rate protocols like ZIGB automation then we have seen the artificial intelligence taking place taking the place and we have this home assistance coming up like Amazon ECO and we have even AI in a small mobile of itself then the third generations are nothing but the entirely AI making a robotics or making a robot which can take care of the entire grid or a entire neighborhood for it. So the question comes up always is why now why now this technology has been so popular and why we have been hearing it in the last five years. So if you have seen the convenience of the development of such devices was much harder in the previous decade on the previous two decades because we didn't have the particular technology or we didn't have the particular protocols which can support those hardware systems. It is the same scenario when Apple thought to introduce a MacBook before the iPod but the existing technology couldn't be held so they started with an iPod then they later have been moved to MacBook in the same way we had the idea but the problem was that we didn't have the particular hardware and software resources which can support the idea or implement in a very mass scale and the most important part is that people had a more affordability right now than compared to a previous decade because people income has been increased in a huge and drastic way or in the world and also people whenever we have a smartphone coming up every once or two years people would like to use the latest technology and it so the comfortness of using a technology has been increased exponentially or rapidly in the last three years and we have seen that you know when we use machines the wastage of energy will be reduced to the minimum level or we could achieve a zero rate of wastage and also you could we travel or we work every time so it will be much easier to look on our family or to know what is happening in our own home or what is going on in our absence and also to have a luxury of yourself by sitting at the same place and controlling your entire home by just a click so that you need not go over for making a coffee but you can just send a command for the coffee maker saying that I need so-and-so coffee and also we have seen that you know people started to introduce this smart lock system where you need not carry a hardware or a fiscal key to your home but just using a sensor and a prepared Bluetooth device it can unlock it for you so these are the few of the observations that have been taken in the next five to ten years and if you see the total expected adoption has been decreased in the next five years but if you see the fires from now especially in the terms of a connected device security system and smart thermostats has been increased and recently there have been a great article which says that people have installed more thermostats in the in the previous five years but the always the question comes down to like is it secure the the same technology that we have been using for our loud ones or to take care of our home but is it secured the question is that it is not secured at this point because there are many numerous factors which come into the play so I mean there's a story which I have like how I experienced that this can be a very bad way or a very in a negative way where a remote hacker can watch over your loud ones or they can manipulate your key or they can lock you out of your own home even though you have the key to your home I mean when I just went to my sister's house for a weekend then they had a smart TV bought it on newly so the thing was that I was always curious to know like how do this smart TV works so when I was going to the manual I I have came to know that it you just say the same Wi-Fi networks or you can just transmit from all the Netflix or Amazon but the problem was that when I started a scan for it like a IP scan I just came to know that there are other devices which are connected in the same network which happened to be have a very very less authentication or unable to authentication by passing but when I was able to access the main interface hub I could see the entire home of theirs and the entire cameras their thermostats and the heaters and everything so by just a single click I can just make sure that they don't use it anymore in their future but I could also make sure that you know it reacts in a very weird way so that you know it makes them impossible to use it for the next usage so this is how the hackers list have a look about your home like the cameras the thermostats or the smart applications which are connected to it so the question is like why are they not secured so if we see the problem is that whenever we have a devices with this type of technology we don't have a dedicated service support for it in the first place because whenever we contact a customer care they will say that we will try to send it to our engineering team but you never hear from them until unless it has been affected in a very huge way in a massive scale and also there are no frequent or updates or patches for it because and these devices are not their primary concern for their income so they just release the device and the patches or updates or the vulnerabilities which has been identified to it are not patched in the next three months or the next 90 days or the next six months too so in this scenario the attacks on this increase in a much easier way because after a vulnerability has been in the wild and after a few days it comes to the public platform so whenever it is been in the public platform any person who is well known in that particular field can take advantage of it and just create a huge cyber attack on the entire systems in the world and also though we don't have a lifetime support as we have an open source operating system for Ubuntu if you take you know they have increased from three years to five years the LTA support for the next releases but we don't have any lifetime support for this type of devices because you know they just do it for in a minimal scale and they don't take care for the next three years the regular updates or the regular patches which has to be released and end of life of these devices are released very early because for example if they release version one system in the first quarter by the third quarter they will be coming up with the version two of the system but by the time the v2 version comes out the v1 version i mean v1 version doesn't have a support for it for the next one year so i mean they force people to buy the v2 version saying that we had a huge upgrade in this and those but whatever the v1 devices which are in the market and which are connected to the internet and we have seen a lot of times that you know there is a there is an improper or broken authentication systems which are very poor to be imagined for example if you if you have seen if you try to append test a system if you cannot login but if you can go to the source code there will be a source code which is a similar to like you know login dot html id equals to one but if you change the id equals to two we have seen many cases which have a redirection mechanism which can be redirected to the login page by just changing a single parameter in it and also we do have a hard coded passwords installed in the firmware which is easier to extract by using the tools like binwalk and others and strings and hexas so that we could know the which firmware has been in that and also we do have a backdoor account installed by the company so that you know they could push patches for the future approach but they never do that only just for namesake they just have a backdoor account so that they can know the data or they can sell your data to the interested parties for it and the question comes up is that how can we make sure that you know we do have a very secured home automation system for this we could we have a home open source home automation softwares which have proper updates and the code has been altered regularly and the patches has been released in a very fortnight or a monthly manner but the question is them the question is how secure are the open source softwares itself in the I mean how can we use an open source software in the most efficient way okay so at this point we have around a five open source home automation softwares they are the KalaOS and the Motik and home assistant open hab and open otaxi open otix and even all the five open source softwares support the minimal hardware system and they do have a dedicated support and they do have a code in the open source platform on the github and they get updates frequently and also the software is audited and any security issues has been reported to the internal team will will get immediately patched in the next 24 hours to 72 hours so the question is that how do we even though we install the software how do we make sure that you know no one can access the home automation and network except you so for that we'll be using Tor because you know Tor has been a great source for people who have been battling the privacy issues and we have seen a huge spike after the Snowden leak that you know most people started to use Tor than the previous last decade and after it and Tor has gone many changes in terms of the latency issues and in terms of node attacks or in terms of timing attacks for it yeah so for this demo we'll be using the open source home automation system called open hab and so we'd be using a raspberry pi 3 with a 8 gb or 16 gb memory card for that we'll be instead of using an extra monitor we could use the raspberry by by going through a headless display by just using a RJ45 cat 5 cable so that we could access the UI part by using SSH and then we'll be using VNC I mean RDP protocols so that we could access to the interface part of it and we would be adding few details in the Tor RC file since you know we could create the basically the entire idea is to create a hidden onion site so that you know no one can know the URL of the site and we will be also using a stealth keyword so that the other nodes even don't know the on-site on it and we will be also creating a authentication cookie like in the back end the encryption key pairs of they get ended so that until unless you have an authentication cookie you cannot log into your home automation system so if someone by chance know your onion URL but they don't even have an access to the in website of the system until unless they do possess the authentication authentication cookie for it so the if you see the hidden service directory is nothing but it's an the open have to is nothing but an this is a normal software application name and hidden port is nothing but in which port that we would like to run in which port we would like to run the authentication system in the Tor on-site and the remaining and the remaining part is the local host and the open soft open software system instance are running on it and we do we even add a hidden service authorized client which specifies that you need a authentication cookie to log into it so until unless you don't have it you cannot log in so we will be adding those three lines of code in the Tor RC file we will just restart the Tor and we do have a the Tor that generates a unique onion address in the host name and you could get that by using the more command and after that in the output of the command you could see a unique domain name and authentication cookie where the QRST is a sample cookie but if you add it to your Tor client set access you can just access the system in that and the client ASG 2017 is just a name you can just add a different name and you can even have a different types of names for it for example if you are having three people I mean you are planning to give access to three people you could create three generic names and we have a different three unique onion addresses which are associated with a unique authentication cookies for it yeah you could access your open app too either from your laptop or your mobile phone for example if you go for your laptop you should install the Tor EXE file or in the windows or you could just install it in the Linux system change the add the hidden hidden in the Tor RC file and add the unique onion address and the authentication cookie restart the Tor file from your client side and I mean to the mobile side you could just install our bot in Android or iOS just you can just add it in your settings type and if you use our fox for the accessing on end sites in your mobile phone you could point it to the unique onion address that we have generated for it and it works yeah is there any other questions that you would like to ask this is a local instance running on the local host yeah this is a unique onion address that has been generated for it and I'm sorry okay sure I mean I'll just move on minute that's it thank you