Securing Home Automation with Tor
Dikshit, Kalyan
Be Safe. Be Secure Today the technological worlds centralize principle is to automate each conceivable thing for simplicity in life, providing security, saving electricity and time. Home automation is “The Internet of Things"…The way that all of our devices and appliances will be networked together to provide us with a seamless control over all aspects of our home and more. Also a step toward what is referred to as the "Internet of Things," in which everything has an assigned IP address, and can be monitored and accessed remotely. The idea of automating each appliance in the home is done from many years ago, it started with connecting two electric wires to the battery and close the circuit by connecting load as a light.
 Hi everyone. My name is Kalyan Dixit and my talk is about securing smart home automation with tower. So it's a very upcoming topic because we have seen many cyber attacks and I mean what harmful I mean it does cause to a infrastructure in a very big way and it can be fatal if it is not taken properly. So the first question that comes up whenever we speak of home automation is that what is exactly home automation? I mean why that we have hearing it nowadays more than the previous decade. If you see like it I mean the thing is that home automation is always there in home automation was always there from even from the 1960s and 1970s. The only difference that we have seen is that we have never seen in that in a huge scale. For example, connecting a battery to a bulb is nothing but home automation like using a switch to lighten the bulb is home automation. But the only thing is that we have never seen the compactness of it in a very smaller scale rather than in a big scale. If you have seen like if you search like what is exactly home automation it is nothing but it involves the controlling of all the smaller up like a application so you using a smaller gateway by using a protocol either in Bluetooth or Wi-Fi so that you could have a entire control in your hand. So the thing is that when we had the technology has been has been grown exponentially in the last five years. In the same way the home automation has came up from the back to it came from dead so that you know many people who have been thinking like how to automate those stuff for home applications have increased their working and they came to know about the new protocols or the new technology that has been existed in this decade which can help them to make it more successful than the previous decade. So early home automation began with labor saving machines and self-contained electric or gas powered home appliances and also which involves the introduction of washing machines, water heaters and sewing machines and etc. But in 2012 by in the United States according to the ABI research around 1.5 million automation systems were installed so that is just a tip of an iceberg if you have taken the growth rate in the next five to ten years and first generation was a wireless technology which involves the fuel lower rate protocols like Zigbee automation then we have seen the artificial intelligence taking place taking the place and we have this home assistance coming up like Amazon ECO and we have even AI in a small mobile of ourselves then the third generation is nothing but the entire AI making a robotics or making a robot which can take care of the entire grid or a entire neighborhood for it. So the question comes up always is why now why now this technology has been so popular and why we have been hearing it in the last five years. So if you have seen the convenience of development of such devices was much harder in the previous decade on the previous two decades because we didn't have the particular technology or we didn't have the particular protocols which can support those hardware systems. It is the same scenario when Apple thought to introduce a MacBook before the iPod but the existing technology couldn't be held so they started with an iPod then they later have been moved to MacBook in the same way we had the idea but the problem was that we didn't have the particular hardware and software resources which can support the idea or implement in a very mass scale and the most important part is that people had a more affordability right now than compared to previous decade because people income has been increased in a huge and drastic way or in the world and also people whenever we have a smartphone coming up every once or two years people would like to use the latest technology and it. So the comfortness of using a technology has been increased exponentially or rapidly in the last three years and we have seen that you know when we use machines the wastage of energy will be reduced to the minimum level or we could achieve a zero rate of wastage and also you could we travel or we work every time so it would be much easier to look on our family or to know what is happening in our own home or what is going on in our absence and also to have a luxury of yourself by sitting at a same place and controlling your entire home by just a click so that you need not go over for making a coffee but you can just send a command for the coffee maker saying that I need so and so coffee and also we have seen that you know people started to introduce this smart lock system where you need not carry a hardware or a physical key to your home but just using a sensor and a prepared little device it can unlock it for you. So these are a few of the observations that have been taken in the next five to ten years and if you see the total expected adoption has been decreased in the next five years but if you see the fires from now especially in the terms of a connected device security system and smart thermostats has been increased and recently there have been a great article which says that people have installed more thermostats in the previous five years but the always the question comes down to like is it secure the same technology that we have been using for our loud ones or to take care of our home but is it secured the question is that it is not secured at this point because there are many numerous factors which come into the play so I mean there is a story which I have like how I experienced that this can be a very bad way or a very in a negative way where a remote hacker can watch over your loud ones or they can manipulate your key or they can lock you out of your own home even though you have the key to your home I mean when I just went to my sister's house for a weekend then they had a smart TV bought it on newly so the thing was that I was always curious to know like how do this smart TV works so when I was going to the manual I have came to know that it you just say the same Wi-Fi network so that you can just transmit from all the Netflix or Amazon but the problem was that when I started a scan for it like a IP scan I just came to know that there are other devices which are connected in the same network which happen to be have a very very less authentication or a vulnerable to authentication bypassing but when I was able to access the main interface hub I could see the entire home of theirs and the entire cameras their thermostats and their heaters and everything so by just a single click I can just make sure that they don't use it anymore in their future but I could also make sure that you know it reacts in a very weird way so that you know they it makes them impossible to use it for the next usage. So this is how the hackers list have a look about your home like the cameras the thermostats or the smart applications which are connected to it so the question is like why are they not secured so if you see the problem is that whenever we have a devices with this type of technology we don't have a dedicated service support for it in the first place because whenever we contact a customer care they will say that we will try to send it to our engineering team but you never hear from them until unless it has been affected in a very huge way in a massive scale and also they are not frequent or updates or patches for it because these devices are not their primary concern for their income so they just release the device and the patches or updates or the vulnerabilities which has been identified to it are not patched in the next three months or next 90 days or the next six months too so in this scenario the attacks on this increase in a much easier way because after a vulnerability has been in the wild and after a few days it comes to the public platform so whenever it is been in the public platform any person who is well known in that particular field can take advantage of it and just create a huge cyber attack on the entire systems in the world and also we don't have a lifetime support as we have an open source operating system for Ubuntu if you take they have increased from three years to five years the LTA support for the next three releases but we don't have any lifetime support for this type of devices because you know they just do it for an minimal scale and they don't take care for the next three years the regular updates or the regular patches which has to be released and of life of these devices are released very early because for example if they release version one system in the first quarter by the third quarter they will be coming up with the version two of the system but by the time the v2 version comes out the v1 version I mean v1 version doesn't have a support for it for the next year so I mean they force people to by the v2 version saying that we had a huge upgrade in this and those but whatever the v1 devices which are in the market and which are connected to the internet and we have seen a lot of times that you know there is a there is an improper or broken authentication systems which are very poor to be imagined for example if you if you have seen if you try to append test a system if you cannot login but if you can go to the source code there will be a source code which is similar to like you know login.html id equals to one but if you change id equals to two we have seen many cases which have a redirection mechanism which can read direct you to the login page by just changing a single parameter in it and also we do have a hard coded passwords installed in the firmware which is easier to extract by using the tools like binwalk and others and strings and hexas so that we could know the which firmware has been in that and also we do have a backdoor account installed by the company so that you know they could push patches for the future approach but they never do that only just for namesake they just have a backdoor account so that they can know the data or they can sell your data to the interested parties for it and the question comes up is that how can we make sure that you know we do have a very secured home automation system so this we could we have a home open source home automation software which have proper updates and the code is been altered regularly and the patches has been released in a very fortnight or a monthly manner but the question is them the question is how secure are the open source software itself in the I mean how can we use an open source software in the most efficient way so at this point we have around a five open source home automation software so they are KalaOS and the automatic and home assistant open hab and open or taxi or open or ticks and even all the five open source software support the minimal hardware system and they do have a dedicated support and they do have a code in the open source platform on the github and they get updates frequently and also the software is audited and any security issues has been reported to the internal team will get immediately passed in the next 24 hours to 72 hours so the question is that how do we even though we install the software how do we make sure that you know no one can access the home automation network except you so for that we will be using Tor because you know Tor has been a great source for people who have been battling the privacy issues and we have seen a huge spike after the Snowden leak that you know most people started to use Tor than the previous last decade and after it and Tor has gone many changes in terms of the latency issues and in terms of node attacks or in terms of a timing attacks for it. Yeah so for this demo we will be using the open source of the automation system called, so we will be using a Raspberry Pi 3 with a 8GB or 16GB memory card. So for that we will be, instead of using an extra monitor we could use the Raspberry Pi by going through a headless display by just using a RJ45 CAT5 cable so that we could access the UI part by using SSH and then we will be using VNC, I mean RDP protocols so that we could access to the interface part of it and we would be adding few details in the Tor RC file since you know we could create the basically the entire idea is to create a hidden onion site so that you know no one can know the URL of the site and we will be also using a stealth keyword so that the other nodes even don't know this on and set on it and we will be also creating an authentication cookie like in the backend encryption key pairs of they get entered so that until unless you have an authentication cookie you cannot log into your home automation system so if someone by chance know your onion URL but they don't even have an access to the in website of the system until unless they do possess the authentication cookie for it so the if you see the hidden service directory is nothing but it's an open have to is nothing but a normal software application name and hidden port is nothing but in which port that we would like to run in which port we would like to run the authentication system in the Tor on inside and the remaining and the remaining part is the local host and the open soft open soft open system instance are running on it and we do we even add a hidden service authorized client which specifies that you need a authentication cookie to log into it so until unless you don't have it you cannot log in so we will be adding those three lines of code in the Tor Rc file we will just restart the Tor and we do have a the thought that generates a unique onion address in the host name and you could get that by using the more command and after that in the output of the command you could see a unique domain name and authentication cookie where the QRST is a sample cookie but if you add it to your Tor client set access you can just access the system in that and the client is you 2017 is just a name you can just add a different name and you can even have a different types of names for it for example if you are having three people to I mean you are planning to give access to three people you could create a three generic names and we have a different three unique on a addresses which are associated with a unique authentication cookies for it you could access your open app to either from your laptop or your mobile phone for example if you go for a laptop you should install the Tor EXE file or in the Windows or you could just install it in the Linux system change the add the hidden hidden so out in the Tor Rc file and add the unique onion address and the authentication cookie restart the Tor file from your client side and I mean to the mobile side you could just install our bot in Android or iOS just you can just add it in your settings type and if you use our Fox for the accessing on-and-sites in your mobile phone you could point it to the unique onion address that we have generated for it and it works. Yeah, is there any other questions that you would like to ask? This is a local instance running on the local host. Yeah, this is a unique on an address that has been generated for it and I'm sorry. Okay, sure. I mean I'll just move on minute that's it. Yeah. ask get. Auch. Thank you.
 Hi everyone. My name is Kalyan Dixit and my talk is about securing smart home automation  with tower. So it's a very upcoming topic because we have seen many cyber attacks and  I mean what harmful I mean it does cause to a infrastructure in a very big way and it  can be fatal if it is not taken properly. So the first question that comes up whenever  we speak of home automation is that what is exactly home automation? I mean why that we  have hearing it nowadays more than the previous decade. If you see like it I mean the thing  is that home automation is always there in home automation was always there from even  from the 1960s and 1970s. The only difference that we have seen is that we have never seen  in that in a huge scale. For example, connecting a battery to a bulb is nothing but home automation  like using a switch to lighten the bulb is home automation. But the only thing is that  we have never seen the compactness of it in a very smaller scale rather than in a big scale.  If you have seen like if you search like what is exactly home automation it is nothing but  it involves the controlling of all the smaller up like a application so you using a smaller  gateway by using a protocol either in Bluetooth or Wi-Fi so that you could have a entire control  in your hand. So the thing is that when we had the technology has been has been grown  exponentially in the last five years. In the same way the home automation has came up from  the back to it came from dead so that you know many people who have been thinking like  how to automate those stuff for home applications have increased their working and they came  to know about the new protocols or the new technology that has been existed in this decade  which can help them to make it more successful than the previous decade.  So early home automation began with labor saving machines and self-contained electric  or gas powered home appliances and also which involves the introduction of washing machines,  water heaters and sewing machines and etc. But in 2012 by in the United States according  to the ABI research around 1.5 million automation systems were installed so that is just a tip  of an iceberg if you have taken the growth rate in the next five to ten years and first  generation was a wireless technology which involves the fuel lower rate protocols like  Zigbee automation then we have seen the artificial intelligence taking place taking the place  and we have this home assistance coming up like Amazon ECO and we have even AI in a small  mobile of ourselves then the third generation is nothing but the entire AI making a robotics  or making a robot which can take care of the entire grid or a entire neighborhood for it.  So the question comes up always is why now why now this technology has been so popular  and why we have been hearing it in the last five years.  So if you have seen the convenience of development of such devices was much harder in the previous  decade on the previous two decades because we didn't have the particular technology or  we didn't have the particular protocols which can support those hardware systems.  It is the same scenario when Apple thought to introduce a MacBook before the iPod but  the existing technology couldn't be held so they started with an iPod then they later  have been moved to MacBook in the same way we had the idea but the problem was that we  didn't have the particular hardware and software resources which can support the idea or implement  in a very mass scale and the most important part is that people had a more affordability  right now than compared to previous decade because people income has been increased in  a huge and drastic way or in the world and also people whenever we have a smartphone  coming up every once or two years people would like to use the latest technology and it.  So the comfortness of using a technology has been increased exponentially or rapidly in  the last three years and we have seen that you know when we use machines the wastage  of energy will be reduced to the minimum level or we could achieve a zero rate of wastage  and also you could we travel or we work every time so it would be much easier to look on  our family or to know what is happening in our own home or what is going on in our absence  and also to have a luxury of yourself by sitting at a same place and controlling your entire  home by just a click so that you need not go over for making a coffee but you can just  send a command for the coffee maker saying that I need so and so coffee and also we have  seen that you know people started to introduce this smart lock system where you need not  carry a hardware or a physical key to your home but just using a sensor and a prepared  little device it can unlock it for you.  So these are a few of the observations that have been taken in the next five to ten years  and if you see the total expected adoption has been decreased in the next five years  but if you see the fires from now especially in the terms of a connected device security  system and smart thermostats has been increased and recently there have been a great article  which says that people have installed more thermostats in the previous five years but  the always the question comes down to like is it secure the same technology that we have  been using for our loud ones or to take care of our home but is it secured the question  is that it is not secured at this point because there are many numerous factors which come  into the play so I mean there is a story which I have like how I experienced that this can  be a very bad way or a very in a negative way where a remote hacker can watch over your  loud ones or they can manipulate your key or they can lock you out of your own home even  though you have the key to your home I mean when I just went to my sister's house for  a weekend then they had a smart TV bought it on newly so the thing was that I was always  curious to know like how do this smart TV works so when I was going to the manual I  have came to know that it you just say the same Wi-Fi network so that you can just transmit  from all the Netflix or Amazon but the problem was that when I started a scan for it like  a IP scan I just came to know that there are other devices which are connected in the same  network which happen to be have a very very less authentication or a vulnerable to authentication  bypassing but when I was able to access the main interface hub I could see the entire  home of theirs and the entire cameras their thermostats and their heaters and everything  so by just a single click I can just make sure that they don't use it anymore in their  future but I could also make sure that you know it reacts in a very weird way so that  you know they it makes them impossible to use it for the next usage.  So this is how the hackers list have a look about your home like the cameras the thermostats  or the smart applications which are connected to it so the question is like why are they  not secured so if you see the problem is that whenever we have a devices with this type  of technology we don't have a dedicated service support for it in the first place because whenever  we contact a customer care they will say that we will try to send it to our engineering  team but you never hear from them until unless it has been affected in a very huge way in  a massive scale and also they are not frequent or updates or patches for it because these  devices are not their primary concern for their income so they just release the device  and the patches or updates or the vulnerabilities which has been identified to it are not patched  in the next three months or next 90 days or the next six months too so in this scenario  the attacks on this increase in a much easier way because after a vulnerability has been  in the wild and after a few days it comes to the public platform so whenever it is  been in the public platform any person who is well known in that particular field can  take advantage of it and just create a huge cyber attack on the entire systems in the  world and also we don't have a lifetime support as we have an open source operating system  for Ubuntu if you take they have increased from three years to five years the LTA support  for the next three releases but we don't have any lifetime support for this type of devices  because you know they just do it for an minimal scale and they don't take care for the next  three years the regular updates or the regular patches which has to be released and of life  of these devices are released very early because for example if they release version one system  in the first quarter by the third quarter they will be coming up with the version two of  the system but by the time the v2 version comes out the v1 version I mean v1 version  doesn't have a support for it for the next year so I mean they force people to by the  v2 version saying that we had a huge upgrade in this and those but whatever the v1 devices  which are in the market and which are connected to the internet and we have seen a lot of  times that you know there is a there is an improper or broken authentication systems  which are very poor to be imagined for example if you if you have seen if you try to append  test a system if you cannot login but if you can go to the source code there will be a  source code which is similar to like you know login.html id equals to one but if you change  id equals to two we have seen many cases which have a redirection mechanism which can read  direct you to the login page by just changing a single parameter in it and also we do have  a hard coded passwords installed in the firmware which is easier to extract by using the tools  like binwalk and others and strings and hexas so that we could know the which firmware has  been in that and also we do have a backdoor account installed by the company so that you  know they could push patches for the future approach but they never do that only just  for namesake they just have a backdoor account so that they can know the data or they can  sell your data to the interested parties for it and the question comes up is that how can  we make sure that you know we do have a very secured home automation system so this we could  we have a home open source home automation software which have proper updates and the  code is been altered regularly and the patches has been released in a very fortnight or a  monthly manner but the question is them the question is how secure are the open source  software itself in the I mean how can we use an open source software in the most efficient  way so at this point we have around a five open source home automation software so they  are KalaOS and the automatic and home assistant open hab and open or taxi or open or ticks  and even all the five open source software support the minimal hardware system and they  do have a dedicated support and they do have a code in the open source platform on the  github and they get updates frequently and also the software is audited and any security  issues has been reported to the internal team will get immediately passed in the next 24  hours to 72 hours so the question is that how do we even though we install the software  how do we make sure that you know no one can access the home automation network except  you so for that we will be using Tor because you know Tor has been a great source for people  who have been battling the privacy issues and we have seen a huge spike after the Snowden  leak that you know most people started to use Tor than the previous last decade and after  it and Tor has gone many changes in terms of the latency issues and in terms of node  attacks or in terms of a timing attacks for it.  Yeah so for this demo we will be using the open source of the automation system called  so we will be using a Raspberry Pi 3 with a 8GB or 16GB memory card.  So for that we will be, instead of using an extra monitor we could use the Raspberry Pi  by going through a headless display by just using a RJ45 CAT5 cable so that we could access  the UI part by using SSH and then we will be using VNC, I mean RDP protocols so that  we could access to the interface part of it and we would be adding few details in the  Tor RC file since you know we could create the basically the entire idea is to create  a hidden onion site so that you know no one can know the URL of the site and we will be  also using a stealth keyword so that the other nodes even don't know this on and set on it  and we will be also creating an authentication cookie like in the backend encryption key  pairs of they get entered so that until unless you have an authentication cookie you cannot  log into your home automation system so if someone by chance know your onion URL but  they don't even have an access to the in website of the system until unless they do possess  the authentication cookie for it so the if you see the hidden service directory is nothing  but it's an open have to is nothing but a normal software application name and hidden  port is nothing but in which port that we would like to run in which port we would like to  run the authentication system in the Tor on inside and the remaining and the remaining  part is the local host and the open soft open soft open system instance are running on it  and we do we even add a hidden service authorized client which specifies that you need a authentication  cookie to log into it so until unless you don't have it you cannot log in so we will be adding  those three lines of code in the Tor Rc file we will just restart the Tor and we do have  a the thought that generates a unique onion address in the host name and you could get  that by using the more command and after that in the output of the command you could see  a unique domain name and authentication cookie where the QRST is a sample cookie but if you  add it to your Tor client set access you can just access the system in that and the client  is you 2017 is just a name you can just add a different name and you can even have a different  types of names for it for example if you are having three people to I mean you are planning  to give access to three people you could create a three generic names and we have a different  three unique on a addresses which are associated with a unique authentication cookies for it  you could access your open app to either from your laptop or your mobile phone for example  if you go for a laptop you should install the Tor EXE file or in the Windows or you could just  install it in the Linux system change the add the hidden hidden so out in the Tor Rc file and  add the unique onion address and the authentication cookie restart the Tor file from your client  side and I mean to the mobile side you could just install our bot in Android or iOS just you  can just add it in your settings type and if you use our Fox for the accessing on-and-sites in  your mobile phone you could point it to the unique onion address that we have generated for it and  it works. Yeah, is there any other questions that you would like to ask?  This is a local instance running on the local host.  Yeah, this is a unique on an address that has been generated for it and  I'm sorry. Okay, sure. I mean I'll just move on minute that's it.  Yeah.  get. Auch.  Thank you.
2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_0_155.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_156_983.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_984_1319.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_1320_9911.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_9912_12671.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_12672_12971.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_12972_21551.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_21552_21767.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_21768_22427.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_22428_29819.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_29820_29939.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_29940_29999.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_30000_30299.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_30300_32447.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_32448_32819.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_32820_32867.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_32868_33083.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_33084_33671.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_33672_34451.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_34452_35075.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_35076_35219.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_35220_35435.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_35436_35483.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_35484_35675.png 2017_Securing_Home_Automation_with_Tor_AYrWxLCNP3o_35676_35847.png
Hi everyone. My name is Kalyan Dixit and my talk is about securing smart home automation with tower. So it's a very upcoming topic because we have seen many cyber attacks and I mean what harmful I mean it does cause to a infrastructure in a very big way and it can be fatal if it is not taken properly. So the first question that comes up whenever we speak of home automation is that what is exactly home automation? I mean why that we have hearing it nowadays more than the previous decade. If you see like it I mean the thing is that home automation is always there in home automation was always there from even from the 1960s and 1970s. The only difference that we have seen is that we have never seen in that in a huge scale. For example, connecting a battery to a bulb is nothing but home automation like using a switch to lighten the bulb is home automation. But the only thing is that we have never seen the compactness of it in a very smaller scale rather than in a big scale. If you have seen like if you search like what is exactly home automation it is nothing but it involves the controlling of all the smaller up like a application so you using a smaller gateway by using a protocol either in Bluetooth or Wi-Fi so that you could have a entire control in your hand. So the thing is that when we had the technology has been has been grown exponentially in the last five years. In the same way the home automation has came up from the back to it came from dead so that you know many people who have been thinking like how to automate those stuff for home applications have increased their working and they came to know about the new protocols or the new technology that has been existed in this decade which can help them to make it more successful than the previous decade. So early home automation began with labor saving machines and self-contained electric or gas powered home appliances and also which involves the introduction of washing machines, water heaters and sewing machines and etc. But in 2012 by in the United States according to the ABI research around 1.5 million automation systems were installed so that is just a tip of an iceberg if you have taken the growth rate in the next five to ten years and first generation was a wireless technology which involves the fuel lower rate protocols like Zigbee automation then we have seen the artificial intelligence taking place taking the place and we have this home assistance coming up like Amazon ECO and we have even AI in a small mobile of ourselves then the third generation is nothing but the entire AI making a robotics or making a robot which can take care of the entire grid or a entire neighborhood for it. So the question comes up always is why now why now this technology has been so popular and why we have been hearing it in the last five years. So if you have seen the convenience of development of such devices was much harder in the previous decade on the previous two decades because we didn't have the particular technology or we didn't have the particular protocols which can support those hardware systems. It is the same scenario when Apple thought to introduce a MacBook before the iPod but the existing technology couldn't be held so they started with an iPod then they later have been moved to MacBook in the same way we had the idea but the problem was that we didn't have the particular hardware and software resources which can support the idea or implement in a very mass scale and the most important part is that people had a more affordability right now than compared to previous decade because people income has been increased in a huge and drastic way or in the world and also people whenever we have a smartphone coming up every once or two years people would like to use the latest technology and it. So the comfortness of using a technology has been increased exponentially or rapidly in the last three years and we have seen that you know when we use machines the wastage of energy will be reduced to the minimum level or we could achieve a zero rate of wastage and also you could we travel or we work every time so it would be much easier to look on our family or to know what is happening in our own home or what is going on in our absence and also to have a luxury of yourself by sitting at a same place and controlling your entire home by just a click so that you need not go over for making a coffee but you can just send a command for the coffee maker saying that I need so and so coffee and also we have seen that you know people started to introduce this smart lock system where you need not carry a hardware or a physical key to your home but just using a sensor and a prepared little device it can unlock it for you. So these are a few of the observations that have been taken in the next five to ten years and if you see the total expected adoption has been decreased in the next five years but if you see the fires from now especially in the terms of a connected device security system and smart thermostats has been increased and recently there have been a great article which says that people have installed more thermostats in the previous five years but the always the question comes down to like is it secure the same technology that we have been using for our loud ones or to take care of our home but is it secured the question is that it is not secured at this point because there are many numerous factors which come into the play so I mean there is a story which I have like how I experienced that this can be a very bad way or a very in a negative way where a remote hacker can watch over your loud ones or they can manipulate your key or they can lock you out of your own home even though you have the key to your home I mean when I just went to my sister's house for a weekend then they had a smart TV bought it on newly so the thing was that I was always curious to know like how do this smart TV works so when I was going to the manual I have came to know that it you just say the same Wi-Fi network so that you can just transmit from all the Netflix or Amazon but the problem was that when I started a scan for it like a IP scan I just came to know that there are other devices which are connected in the same network which happen to be have a very very less authentication or a vulnerable to authentication bypassing but when I was able to access the main interface hub I could see the entire home of theirs and the entire cameras their thermostats and their heaters and everything so by just a single click I can just make sure that they don't use it anymore in their future but I could also make sure that you know it reacts in a very weird way so that you know they it makes them impossible to use it for the next usage. So this is how the hackers list have a look about your home like the cameras the thermostats or the smart applications which are connected to it so the question is like why are they not secured so if you see the problem is that whenever we have a devices with this type of technology we don't have a dedicated service support for it in the first place because whenever we contact a customer care they will say that we will try to send it to our engineering team but you never hear from them until unless it has been affected in a very huge way in a massive scale and also they are not frequent or updates or patches for it because these devices are not their primary concern for their income so they just release the device and the patches or updates or the vulnerabilities which has been identified to it are not patched in the next three months or next 90 days or the next six months too so in this scenario the attacks on this increase in a much easier way because after a vulnerability has been in the wild and after a few days it comes to the public platform so whenever it is been in the public platform any person who is well known in that particular field can take advantage of it and just create a huge cyber attack on the entire systems in the world and also we don't have a lifetime support as we have an open source operating system for Ubuntu if you take they have increased from three years to five years the LTA support for the next three releases but we don't have any lifetime support for this type of devices because you know they just do it for an minimal scale and they don't take care for the next three years the regular updates or the regular patches which has to be released and of life of these devices are released very early because for example if they release version one system in the first quarter by the third quarter they will be coming up with the version two of the system but by the time the v2 version comes out the v1 version I mean v1 version doesn't have a support for it for the next year so I mean they force people to by the v2 version saying that we had a huge upgrade in this and those but whatever the v1 devices which are in the market and which are connected to the internet and we have seen a lot of times that you know there is a there is an improper or broken authentication systems which are very poor to be imagined for example if you if you have seen if you try to append test a system if you cannot login but if you can go to the source code there will be a source code which is similar to like you know login.html id equals to one but if you change id equals to two we have seen many cases which have a redirection mechanism which can read direct you to the login page by just changing a single parameter in it and also we do have a hard coded passwords installed in the firmware which is easier to extract by using the tools like binwalk and others and strings and hexas so that we could know the which firmware has been in that and also we do have a backdoor account installed by the company so that you know they could push patches for the future approach but they never do that only just for namesake they just have a backdoor account so that they can know the data or they can sell your data to the interested parties for it and the question comes up is that how can we make sure that you know we do have a very secured home automation system so this we could we have a home open source home automation software which have proper updates and the code is been altered regularly and the patches has been released in a very fortnight or a monthly manner but the question is them the question is how secure are the open source software itself in the I mean how can we use an open source software in the most efficient way so at this point we have around a five open source home automation software so they are KalaOS and the automatic and home assistant open hab and open or taxi or open or ticks and even all the five open source software support the minimal hardware system and they do have a dedicated support and they do have a code in the open source platform on the github and they get updates frequently and also the software is audited and any security issues has been reported to the internal team will get immediately passed in the next 24 hours to 72 hours so the question is that how do we even though we install the software how do we make sure that you know no one can access the home automation network except you so for that we will be using Tor because you know Tor has been a great source for people who have been battling the privacy issues and we have seen a huge spike after the Snowden leak that you know most people started to use Tor than the previous last decade and after it and Tor has gone many changes in terms of the latency issues and in terms of node attacks or in terms of a timing attacks for it. Yeah so for this demo we will be using the open source of the automation system called, so we will be using a Raspberry Pi 3 with a 8GB or 16GB memory card. So for that we will be, instead of using an extra monitor we could use the Raspberry Pi by going through a headless display by just using a RJ45 CAT5 cable so that we could access the UI part by using SSH and then we will be using VNC, I mean RDP protocols so that we could access to the interface part of it and we would be adding few details in the Tor RC file since you know we could create the basically the entire idea is to create a hidden onion site so that you know no one can know the URL of the site and we will be also using a stealth keyword so that the other nodes even don't know this on and set on it and we will be also creating an authentication cookie like in the backend encryption key pairs of they get entered so that until unless you have an authentication cookie you cannot log into your home automation system so if someone by chance know your onion URL but they don't even have an access to the in website of the system until unless they do possess the authentication cookie for it so the if you see the hidden service directory is nothing but it's an open have to is nothing but a normal software application name and hidden port is nothing but in which port that we would like to run in which port we would like to run the authentication system in the Tor on inside and the remaining and the remaining part is the local host and the open soft open soft open system instance are running on it and we do we even add a hidden service authorized client which specifies that you need a authentication cookie to log into it so until unless you don't have it you cannot log in so we will be adding those three lines of code in the Tor Rc file we will just restart the Tor and we do have a the thought that generates a unique onion address in the host name and you could get that by using the more command and after that in the output of the command you could see a unique domain name and authentication cookie where the QRST is a sample cookie but if you add it to your Tor client set access you can just access the system in that and the client is you 2017 is just a name you can just add a different name and you can even have a different types of names for it for example if you are having three people to I mean you are planning to give access to three people you could create a three generic names and we have a different three unique on a addresses which are associated with a unique authentication cookies for it you could access your open app to either from your laptop or your mobile phone for example if you go for a laptop you should install the Tor EXE file or in the Windows or you could just install it in the Linux system change the add the hidden hidden so out in the Tor Rc file and add the unique onion address and the authentication cookie restart the Tor file from your client side and I mean to the mobile side you could just install our bot in Android or iOS just you can just add it in your settings type and if you use our Fox for the accessing on-and-sites in your mobile phone you could point it to the unique onion address that we have generated for it and it works. Yeah, is there any other questions that you would like to ask? This is a local instance running on the local host. Yeah, this is a unique on an address that has been generated for it and I'm sorry. Okay, sure. I mean I'll just move on minute that's it. Yeah. ask get. Auch. Thank you.
thing is that home automation is always there in huge scale. For example, connecting a battery to search like what is exactly home automation it is the same way the home automation has came up from electric or gas powered home appliances and also connected device security system and smart of our home but is it secured the question is like how I experienced that this can be a very that when I started a scan for it like a IP scan released and of life of these devices are the version two of the system but by the time the are in the market and which are connected to the will be using a Raspberry Pi 3 with a 8GB or 16GB idea is to create a hidden onion site so that you and we will be also creating an authentication the unique onion address and the authentication