How to Kill Your Privacy and IoT your home along the way

Seminar for students of the 5th Year of the Integrated Master Degree on Informatics and Computing Engineering at Faculdade de Engenharia da Universidade do Porto.

Transcript

1. HOW TO KILL YOUR PRIVACY And IoT your home along the way João Pedro Dias Researcher & PhD Student jpmdias@fe.up.pt keybase.io/jpdias
2. What is privacy? ▪ pri·va·cy ▪ /ˈprīvəsē/ ▪ noun ▪ the state or condition of being free from being observed or disturbed by other people. ▪ synonyms : seclusion, solitude, isolation, freedom from disturbance, freedom from interference NgramViewer
3. • Privacy: is the freedom from intrusion of 3rd parties into one's personal matters, and personal information (applies to the person). • Confidentiality: ensuring that only authorized individuals will have access to the information (applies to the data). • Secrecy: your messages can only be understood by intended recipients • Anonymity: the ability to send and receive messages without revealing sender or receiver • Autonomy: avoidance of interference/intervention by people who violated our secrecy or anonymity and are using it to control us • Integrity: assurance that the data is real, accurate and safeguarded from unauthorized user modification. • Security: is the protection of systems from any damage to their hardware, software or information, in a way that it can compromise the services they provide or the data they hold.
4. • “Arguing that you don’t care about the right to privacy because you have nothing to hide, is no different than saying you don’t care about free speech because you have nothing to say.” • “Privacy isn’t about something to hide. Privacy is about something to protect. And that’s who you are. That’s what you believe in. That’s who you want to become. Privacy is the right to the self. Privacy is what gives you the ability to share with the world who you are on your own terms.” -- Edward Snowden • From XKCD • https://xkcd.com/1269/ alt: I'm the Philosopher until someone hands me a burrito.
5. But does privacy matter? • "All human beings have three lives: public, private, and secret." - Gabriel Garcia Marquez But why does it matter to me that have nothing to hide? • Identity Theft and other kinds of fraud • Influence (e.g. Advertising, Opinions) • Surveillance & Tracking • Implications on the individual right to freedom
6. • Because “New technologies are radically advancing our freedoms, but they are also enabling unparalleled invasions of privacy.” – Electronic Frontier Foundation • Knowledge is power; knowledge about you is power over you. Your information will be used to anticipate your actions and manipulate the way you shop, vote, and think. – Why Privacy Matters, https://whyprivacymatters.org/ But why should we care about privacy?
9. MOVIES ABOUT PRIVACY
10. “We must make security and privacy ubiquitous, simple, and understood by all. Only then will we be able to preserve one of the greatest innovations of the last century, the Internet, and allow our world to continue to develop, innovate, and prosper.” -- David Gorodyansky, Privacy and Security in the Internet Age, Wired, 2015
11. PIHEADQUARTERS OR DIY IOT YOUR HOME It's time to finally take back control. – Mr. Robot Workshop
12. Context
13. ▪ Quad Core 1.2GHz Broadcom BCM2837 64bit CPU ▪ 1GB RAM ▪ BCM43438 wireless LAN ▪ Bluetooth Low Energy (BLE) ▪ 40-pin extended GPIO ▪ Price: ~ 35$ (e.g. amazon) Hardware: Raspberry Pi 3
14. OS Distro ▪ MINIBIAN image ▪ Raspbian Jessie based ▪ Kernel 4.1.18+ #846 ▪ ~ 15 secs boot ▪ ~ 31 MB RAM used ▪ ~ 477 MB disk space used ▪ DHCP client enabled ▪ SSHD enabled ▪ root user enabled ▪ (default password: raspberry – change it ASAP) • Resources: • https://minibianpi.wordpress.com/
15. Hardware: Node-MCU ESP-12E (ESP8266) ▪ Wireless 802.11 b / g / n ▪ Support STA / AP / STA + AP ▪ OTA ▪ Remote firmware upgrade ▪ Programming Languages: ▪ C (Arduino compatible), Lua and MicroPython ▪ Price: ~ 4$ (e.g. ebay)
16. Hardware: Circuit - 1x LED - 1x DHT11 or DHT22 (temp/humidity sensor) - Jump Cables - 1x Breadboard - 330 Ω resistor - 4700 Ω resistor WiFi.begin(wifi_ssid, wifi_password); Serial.println(WiFi.localIP());
17. Docker “Docker is a tool that can package an application and its dependencies in a virtual container that can run on any Linux server. This helps enable flexibility and portability on where the application can run, whether on premise, public cloud, private cloud, bare metal, etc.” Source: https://www.linux.com/news/docker- shipping-container-linux-code
18. docker-compose (1/2) “Compose is a tool for defining and running multi-container Docker applications. With Compose, you use a Compose file to configure your application's services. Then, using a single command, you create and start all the services from your configuration.” Source: https://github.com/docker/compose For package install help (using apt-get on Raspbian): https://blog.hypriot.com/post/your-number-one-source-for-docker-on- arm/
19. docker-compose (2/2) 1. Define your app's environment with a Dockerfile so it can be reproduced anywhere. 2. Define the services that make up your app in docker- compose.yml so they can be run together in an isolated environment. 3. Lastly, run docker-compose up and Compose will start and run your entire app. • Source: https://github.com/docker/compose version: '2' services: web: build: . ports: - "5000:5000“ volumes: - .:/code redis: image: redis Sample docker-compose.yml
20. MQTT “MQTT is a machine-to-machine (M2M)/"Internet of Things" connectivity protocol. It was designed as an extremely lightweight publish/subscribe messaging transport.” Source: http://mqtt.org/ PubSubClient client(espClient); void callback(char* topic, byte* payload, unsigned int length) { … } void setup() { … setup_wifi(); client.setServer(mqtt_server, 1883); client.setCallback(callback);} void reconnect(){ … client.connect((char *)clientName.c_str()) client.subscribe(actuator_led_status);} void loop() { … client.publish(temperature_celsius_topic, String(t).c_str(), true);}
21. mosquitto • “Eclipse Mosquitto™ is an open source (EPL/EDL licensed) message broker that implements the MQTT protocol versions 3.1 and 3.1.1.” • Source: https://mosquitto.org/
22. Influxdb “InfluxDB is an open-source time series database. It is written in Go and optimized for fast, high-availability storage and retrieval of time series data in fields such as operations monitoring, application metrics, Internet of Things sensor data, and real-time analytics.” Source: https://docs.influxdata.com/influxdb/v1.3/guides/ Resources: https://docs.influxdata.com/influxdb/v1.3/guides/
23. Grafana “Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, Elasticsearch, OpenTSDB, Prometheus and InfluxDB.” Source: https://github.com/grafana/grafana Resources: http://docs.grafana.org/guides/getting_started/
24. Telegraf • “Telegraf is an agent written in Go for collecting, processing, aggregating, and writing metrics. • Design goals are to have a minimal memory footprint with a plugin system so that developers in the community can easily add support for collecting metrics from well known services (like Hadoop, Postgres, or Redis) and third party APIs (like Mailchimp, AWS CloudWatch, or Google Analytics).” • Source: https://github.com/influxdata/telegraf • Resource: https://www.influxdata.com/time-series-platform/telegraf/
25. Node-RED • “Node-RED is a programming tool (VPL) for wiring together hardware devices, APIs and online services (…). • It provides a browser- based editor that makes it easy to wire together flows using the wide range of nodes in the palette that can be deployed to its runtime in a single-click.”
26. PiHeadQuarters
27. mqtt Network
28. TALK IS CHEAP. SHOW ME THE CODE! https://github.com/jpdias/piheadquarters
29. it’s hammer DEMO time!
30. IT’S OVER. THANK YOU! Q&A João Pedro Dias @jpd1as Porto, Portugal http://jpdias.me https://keybase.io/jpdias jpmdias@fe.up.pt 11 Oct. 2017 @ SESI/SES – FEUP