Slashdot Mirror
Anonabox Recalls Hundreds of Insecure 'Privacy' Routers
Sparrowvsrevolution writes: It turns out all those critics of the controversial Tor router project Anonabox might have been on to something. Late last month, Anonabox began contacting the first round of customers who bought its tiny, $100 privacy gadget to warn them of serious security flaws in the device, and to offer to ship them a more secure replacement free of charge. While the miniature routers do direct all of a user's Internet traffic over Tor as promised, the company says that its first batch lacked basic password protection, with no way to keep out unwanted users in Wi-Fi range. And worse yet, the faulty Anonaboxes use the hardcoded root password 'admin,' which allows any of those Wi-Fi intruders to completely hijack the device, snooping on or recording all of a user's traffic.
Anonabox's parent company, Sochutel, says that only 350 of the devices lacked that password protection, and that it's fixed the gaping security oversights in newer version of the router.
The initial security criticisms of Anonabox helped to convince Kickstarter to freeze the proejct's $600,000 crowdfunding campaign in October. But Anonabox relaunched on Indiegogo and was later acquired by the tech firm Sochutel. Sochutel claims that the security flaws in the routers developed prior to its acquisition of Anonabox were out of its control, and that it's now hiring outside auditors to check its products' security.
Anonabox's parent company, Sochutel, says that only 350 of the devices lacked that password protection, and that it's fixed the gaping security oversights in newer version of the router.
The initial security criticisms of Anonabox helped to convince Kickstarter to freeze the proejct's $600,000 crowdfunding campaign in October. But Anonabox relaunched on Indiegogo and was later acquired by the tech firm Sochutel. Sochutel claims that the security flaws in the routers developed prior to its acquisition of Anonabox were out of its control, and that it's now hiring outside auditors to check its products' security.
Technically, they do have "privacy"--in a bathroom-at-Bill-Cosby's-house sort of way.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
Security is hard, and it was more profitable to push crap out the door than actually do what we promised.
Honestly, TFS makes it sound like someone slapped together something and either naively believed they'd made something secure .. or straight up lied about having made something secure.
No wifi password and default admin passwords? That's pretty pathetic for something which purports to be a security/privacy tool.
Sounds like someone wrote the marketing literature before creating the product.
Lost at C:>. Found at C.
Sochutel acquired a security-focused product in the middle of its development cycle and obviously didn't either retain or maintain an appropriate relationship with the development team that was working on it at the time. As a result, the final product had a bunch of dev environment sloppiness that should have been cleaned up before moving it into production. This is the most basic level of IT project management, and entirely within their control.
I would have thought that the biggest concern was that most tor exit nodes were run by the NSA and other security organisations.
Get a real router and learn how to set it up properly.
Outside auditors? Just log into the damn thing. If admin works and you can't change it, it's bad. You don't really need to go to outside help for that. Oh and see if the wifi broadcasts as open with no way to change it. That's not exactly hard.
National Security Auditing, perhaps?
This sig left unintentionally blank.
Why not just do a firmware update via the admin web interface?
Why in the world would you ship them back to have this done?
Do not look at laser with remaining good eye.
I shed a tear when I realized I had no mod points left :-/
Slashdot Valentines Beta Massacre: iT WORKED! The boycotts killed Beta!!
Well, since it wasn't linked in the summary above, I'll do a shameless self-plug here:
Anonabox Analysis
And yes - I am the author of that analysis, so if anybody got questions I'll be happy to respond here.
Security holes...
If they fucked up that bad, over things this simple, I would NEVER use their gear.
"If any question why we died, Tell them because our fathers lied."
Did no one test this security device for security before shipping it? Does this episode demonstrate the perls of outsourcing your developement to some newly qualified intern in the far east?
What is OpenWrt?
This is apparently the cheapest trash they could make, with security problems so obvious that even a novice pen-tester would find them in the first few minutes. They cannot have had a single competent security expert involved in development. The words "gross negligence" and "fraud" come to mind.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I am very curious about using this or a VPN service and knowing just how traceable my connection is. Bare with me, I want to explain my home set up and as your expert insight...
I use PrivateInternetAccess.com whenever I leave my home network. I understand that the first hop is not obfuscated but after that I should appear to be anywhere that I choose (from their selections). And if I goto any site that shows my IP address this does play out as being the case. BUT.... I use the free tracking service preproject.com and it places my laptop within 300ft no matter how I try to hide it. HOW? Shouldn't the Prey App show where PIA says I'm coming out at? And moreover how effective is PIA? Should I even bother with using it? Is there any way to truly mask where you are while online?
Given that no source has been published by either company, whoops?
Go on down to the ATM Machine, enter your PIN Number and withdraw enough cash to by a NIC Card. Check its UPC Code then write some HTML Language. Redundant mother fucker.
https://anonabox.com/about/
By mid 2014, the product had been reduced 3 times in size thanks to the Chinese engineer I had hired back in 2013.
I guess that may explain this
https://reclaim-your-privacy.c...
I assume this also helps
August Germar
Founder & CTO
August is a security, privacy and IT guru with over 20 years of relevant experience. In addition to being a SysAdmin, he also owned his own ISP for 10+ years.
Marc Preston
Chief Executive Officer
Marc is a highly experienced CEO with over 7 years experience in developing custom platforms, websites, Facebook games and mobile apps for Fortunte 500 companies.
so a ex-system admin and an app developer think (thought) they have a clue about proper security protocols (well I would hope the ex-system admin has some idea)