Would using a Tor wifi router make IoT more secure?

Question

Would using a Tor wifi router make IoT more secure from attacks etcetera?

These routers provide a Tor client, and also tunnel all internet traffic through a VPN. This anonymises your internet access since it is not possible for the server to identify your IP address. The VPN makes it hard for anyone to intercept the traffic on the public part of the internet, even if you connect using a 3rd party Wi-Fi hotspot. The node-router path uses standard 802.11 encryption, the router-public part is encapsulated within the VPN.

Answer 1

No, not at all. Using Tor does not make your computer system more secure from attacks. What it does is to make your computer system more anonymous: it makes it hard for a remote computer that you communicate with to correlate your access with other elements of your identity such as your geographical location and what other accounts and sites you may be accessing.

The fact that you use Tor to connect to some sites is irrelevant to attacks unless those attacks come from those sites, and if they do then using Tor does not offer any particular protection. In other words, whether Tor is involved or not, it doesn't change how (in)secure your system is.

The same applies to a VPN. A VPN makes your traffic reach the Internet at a different location, but that doesn't affect how dangerous the traffic might be.

Blocking incoming traffic that doesn't come through Tor or that doesn't come through a VPN would make your system more secure… but that's not related to Tor or VPN, it's just that blocking incoming traffic makes your system more secure.

Answer 2

Using Tor means that the people who run Tor exit nodes, because they are charitable people, can run man-in-the-middle on you. This means you open yourself up to attacks that you wouldn't get if you don't use Tor.

As a result depending on your threat model it could decrease the security in this case.

Answer 3

Generally, no. A more reslilient network segment makes some attacks harder, but there is no magic solution to fix an endpoint which has a poor security implementation. Businesses sometimes rely on a firewall to block specific threats to vunerable nodes within their network (where software upgrades are difficult), but they use many other defence mechanisms as well.

If an IoT device does not have a robust TLS implementation (certificate pinning, etc), require authentication for all accesses, accept regular signed firmware updates, etc. then you can only assume that it is wide open. Varous organisations are working to make this easier for developers, but there is not a lot in production today except for products runing on a full smartphone-like platform. So your voice-activated hub has the potential to be hard to attack, but the nodes which it accesses are the weakpoints.

A VPN is (to a first approximation) simply a TLS pipe through which the data is passed. Anonymising the IP address where you connect to a server could break the IoT device functionality (many servers geo-locate your access as an additional security layer), and does nothing to anonymise your IoT data (which is identified by something similar to the MAC address of the endpoint)

Remember that many IoT devices have more than one radio interface. The IP port is connected to the internet by design (so a router has limited options for protecting it), and the other interfaces are equally likely to be weak.

Answer 4

To claim that adding defense in depth, adds no security is foolish. Using a authenticated tor hidden service one can limit access to vulnerable devices. The Guardian Project has already done a proof-of-concept of securing IoT devices behind tor hidden service. On the tor blog there are detailed instructions on how to set it up.

Guardian Project Describing poc

Tor Blog