12

Would using a Tor wifi router make IoT more secure from attacks etcetera?

These routers provide a Tor client, and also tunnel all internet traffic through a VPN. This anonymises your internet access since it is not possible for the server to identify your IP address. The VPN makes it hard for anyone to intercept the traffic on the public part of the internet, even if you connect using a 3rd party Wi-Fi hotspot. The node-router path uses standard 802.11 encryption, the router-public part is encapsulated within the VPN.

5
  • 3
    Welcome to the site! Could you elaborate on what exactly you mean by a Tor wifi router, exactly, so it's clearer?
    – Aurora0001
    Jan 7, 2017 at 11:03
  • 5
    The idea of the question is basically good, but it lacks any research and references. Here is a similar question, as you can see the OP provided a link of the corresponding router and some other resource as well. Please improve your question. Jan 7, 2017 at 12:07
  • 2
    I agree the question is too broad at the moment, this makes it difficult to decide if any answer is particularly good. We could answer the question in many different ways, and ideally we would like several different questions asking about smaller aspects of security and how a router fits into this. This site is not structured for discussion, so you need to refine your question to fit the site design. Jan 7, 2017 at 12:13
  • @John, if this isn't an accurate representation of your question, it is best to ask a 2nd question, unless the edits you want to make are small. Jan 7, 2017 at 13:58
  • 1
    Pedantically, I don't see this as an IoT question at all. It would be better to ask "what security benefits do I gain from Tor?" at security.stackexchange.com Although that question is answered at the Tor site itself. Jan 9, 2017 at 8:41

4 Answers 4

10

No, not at all. Using Tor does not make your computer system more secure from attacks. What it does is to make your computer system more anonymous: it makes it hard for a remote computer that you communicate with to correlate your access with other elements of your identity such as your geographical location and what other accounts and sites you may be accessing.

The fact that you use Tor to connect to some sites is irrelevant to attacks unless those attacks come from those sites, and if they do then using Tor does not offer any particular protection. In other words, whether Tor is involved or not, it doesn't change how (in)secure your system is.

The same applies to a VPN. A VPN makes your traffic reach the Internet at a different location, but that doesn't affect how dangerous the traffic might be.

Blocking incoming traffic that doesn't come through Tor or that doesn't come through a VPN would make your system more secure… but that's not related to Tor or VPN, it's just that blocking incoming traffic makes your system more secure.

9

Using Tor means that the people who run Tor exit nodes, because they are charitable people, can run man-in-the-middle on you. This means you open yourself up to attacks that you wouldn't get if you don't use Tor.

As a result depending on your threat model it could decrease the security in this case.

6

Generally, no. A more reslilient network segment makes some attacks harder, but there is no magic solution to fix an endpoint which has a poor security implementation. Businesses sometimes rely on a firewall to block specific threats to vunerable nodes within their network (where software upgrades are difficult), but they use many other defence mechanisms as well.

If an IoT device does not have a robust TLS implementation (certificate pinning, etc), require authentication for all accesses, accept regular signed firmware updates, etc. then you can only assume that it is wide open. Varous organisations are working to make this easier for developers, but there is not a lot in production today except for products runing on a full smartphone-like platform. So your voice-activated hub has the potential to be hard to attack, but the nodes which it accesses are the weakpoints.

A VPN is (to a first approximation) simply a TLS pipe through which the data is passed. Anonymising the IP address where you connect to a server could break the IoT device functionality (many servers geo-locate your access as an additional security layer), and does nothing to anonymise your IoT data (which is identified by something similar to the MAC address of the endpoint)

Remember that many IoT devices have more than one radio interface. The IP port is connected to the internet by design (so a router has limited options for protecting it), and the other interfaces are equally likely to be weak.

0

To claim that adding defense in depth, adds no security is foolish. Using a authenticated tor hidden service one can limit access to vulnerable devices. The Guardian Project has already done a proof-of-concept of securing IoT devices behind tor hidden service. On the tor blog there are detailed instructions on how to set it up.

Guardian Project Describing poc

Tor Blog

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.