Slashdot Mirror
Anonabox Recalls Hundreds of Insecure 'Privacy' Routers
Sparrowvsrevolution writes: It turns out all those critics of the controversial Tor router project Anonabox might have been on to something. Late last month, Anonabox began contacting the first round of customers who bought its tiny, $100 privacy gadget to warn them of serious security flaws in the device, and to offer to ship them a more secure replacement free of charge. While the miniature routers do direct all of a user's Internet traffic over Tor as promised, the company says that its first batch lacked basic password protection, with no way to keep out unwanted users in Wi-Fi range. And worse yet, the faulty Anonaboxes use the hardcoded root password 'admin,' which allows any of those Wi-Fi intruders to completely hijack the device, snooping on or recording all of a user's traffic.
Anonabox's parent company, Sochutel, says that only 350 of the devices lacked that password protection, and that it's fixed the gaping security oversights in newer version of the router.
The initial security criticisms of Anonabox helped to convince Kickstarter to freeze the proejct's $600,000 crowdfunding campaign in October. But Anonabox relaunched on Indiegogo and was later acquired by the tech firm Sochutel. Sochutel claims that the security flaws in the routers developed prior to its acquisition of Anonabox were out of its control, and that it's now hiring outside auditors to check its products' security.
Anonabox's parent company, Sochutel, says that only 350 of the devices lacked that password protection, and that it's fixed the gaping security oversights in newer version of the router.
The initial security criticisms of Anonabox helped to convince Kickstarter to freeze the proejct's $600,000 crowdfunding campaign in October. But Anonabox relaunched on Indiegogo and was later acquired by the tech firm Sochutel. Sochutel claims that the security flaws in the routers developed prior to its acquisition of Anonabox were out of its control, and that it's now hiring outside auditors to check its products' security.
Technically, they do have "privacy"--in a bathroom-at-Bill-Cosby's-house sort of way.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
Security is hard, and it was more profitable to push crap out the door than actually do what we promised.
Honestly, TFS makes it sound like someone slapped together something and either naively believed they'd made something secure .. or straight up lied about having made something secure.
No wifi password and default admin passwords? That's pretty pathetic for something which purports to be a security/privacy tool.
Sounds like someone wrote the marketing literature before creating the product.
Lost at C:>. Found at C.
Sochutel acquired a security-focused product in the middle of its development cycle and obviously didn't either retain or maintain an appropriate relationship with the development team that was working on it at the time. As a result, the final product had a bunch of dev environment sloppiness that should have been cleaned up before moving it into production. This is the most basic level of IT project management, and entirely within their control.
Outside auditors? Just log into the damn thing. If admin works and you can't change it, it's bad. You don't really need to go to outside help for that. Oh and see if the wifi broadcasts as open with no way to change it. That's not exactly hard.
National Security Auditing, perhaps?
This sig left unintentionally blank.
Why not just do a firmware update via the admin web interface?
Why in the world would you ship them back to have this done?
Do not look at laser with remaining good eye.
I shed a tear when I realized I had no mod points left :-/
Slashdot Valentines Beta Massacre: iT WORKED! The boycotts killed Beta!!
Well, since it wasn't linked in the summary above, I'll do a shameless self-plug here:
Anonabox Analysis
And yes - I am the author of that analysis, so if anybody got questions I'll be happy to respond here.
Security holes...
If they fucked up that bad, over things this simple, I would NEVER use their gear.
"If any question why we died, Tell them because our fathers lied."
Did no one test this security device for security before shipping it? Does this episode demonstrate the perls of outsourcing your developement to some newly qualified intern in the far east?
What is OpenWrt?
This is apparently the cheapest trash they could make, with security problems so obvious that even a novice pen-tester would find them in the first few minutes. They cannot have had a single competent security expert involved in development. The words "gross negligence" and "fraud" come to mind.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
the Prey App
Is this something running on your computer where it's capable of bypassing whatever network configuration you've got?
If I have been able to see further than others, it is because I bought a pair of binoculars.
I use the free tracking service preproject.com and it places my laptop within 300ft no matter how I try to hide it. HOW?
I'm pretty sure Prey uses a database of known wifi networks and their locations. For example, the Google Maps cars don't just take pictures, they also record a fingerprint of every 802.11 network they encounter; SSID, coordinates, the router's MAC address. There are public crowdsourced databases that do this, too. If you power up your computer and you're in range of a wireless network that's in one of these databases, Prey will locate you that way.
Thanks to the War on Drugs, it's easier to buy meth than it is to buy cold medicine!
If it's antitheft software than at a minimum i'd expect it to be running as administrator and phoning home every few minutes reporting the last 5 networks it was connected to and every wireless AP it can see along with signal strengths for wifi geolocation/triangulation. At a minimum.
Any program you're running could do most of that (except maybe tap into the wireless AP list without admin access).
If I have been able to see further than others, it is because I bought a pair of binoculars.