4 ms·

TLDR; Anonabox can be rooted with minimal effort (backdoor wide open). The attack vector is an undocumented web interface with a hard coded password ("admin"),

TLDR; Anonabox can be rooted with minimal effort (backdoor wide open). The attack vector is an undocumented web interface with a hard coded password ("admin"), an open SSH port that accepts the same credentials, and grants root access. It is clear that they are lazy and a little out of their depth, but are they malicious?

asherlangton 12y ago
Considering that their Kickstarter was shut down 6 months ago due to their lies, and that they started up again at Indiegogo despite the warnings, and that they've been concealing information and attacking their critics through sockpuppets? Yes, I think it's fair at this point to call them malicious.
- shkkmo 12y ago
  They've been acquired by http://www.sochule.com/ http://www.sochule.com/ Which seems to specialize in social marketing? This update promises another update (which is now overdue) that covers these issues: https://anonabox.com/news/anonabox-blog-when-there-is-blood-in-the-streets-buy-part-1.html https://anonabox.com/news/anonabox-blog-when-there-is-blood-... In Part 2 & 3 of this blog series, we will discuss: -- Anonabox's Hardware -- Anonabox's Firmware -- Open Source vs. Closed Source -- The Blackhole -- Product Roadmap (New products coming Q3...maybe sooner) -- Third Party Hardware & Firmware Review -- Black Duck Software | Open Source Code Audit
  - asherlangton 12y ago
    The "acquisition" is rather questionable: https://twitter.com/asherlangton/status/575768324757266432 https://twitter.com/asherlangton/status/575768324757266432 https://twitter.com/asherlangton/status/583509322946125824 https://twitter.com/asherlangton/status/583509322946125824
  - lbthomsen 12y ago
    A simple fact is they do not _have_ the source code. They are only patching the firmware the router came with from China when they bought it. They are not even building Tor themselves but relying on an old unsupported version straight from OpenWrt's repository.
lbthomsen 12y ago
I wrote that analysis and honestly - no - I don't think it's malicious. Incompetent perhaps, but not malicious.
- asherlangton 12y ago
  I should clarify: I don't think they're adding backdoors maliciously. It's their conduct -- proceeding despite the concerns raised, attacking critics, etc. -- that is greedy and malicious.
  - lbthomsen 12y ago
    Now, that I am inclined to agree with :) And fact is - using the device as shipped to us is more dangerous than not using it at all. Anybody within WiFi range can basically do whatever they want.
- rst 12y ago
  This is an arena in which malice could plausibly try to disguise itself as incompetence. It's fine to give people the benefit of that doubt, but it is a doubt.

asherlangton 12y ago

Considering that their Kickstarter was shut down 6 months ago due to their lies, and that they started up again at Indiegogo despite the warnings, and that they've been concealing information and attacking their critics through sockpuppets? Yes, I think it's fair at this point to call them malicious.

shkkmo 12y ago
They've been acquired by http://www.sochule.com/ http://www.sochule.com/ Which seems to specialize in social marketing? This update promises another update (which is now overdue) that covers these issues: https://anonabox.com/news/anonabox-blog-when-there-is-blood-in-the-streets-buy-part-1.html https://anonabox.com/news/anonabox-blog-when-there-is-blood-... In Part 2 & 3 of this blog series, we will discuss: -- Anonabox's Hardware -- Anonabox's Firmware -- Open Source vs. Closed Source -- The Blackhole -- Product Roadmap (New products coming Q3...maybe sooner) -- Third Party Hardware & Firmware Review -- Black Duck Software | Open Source Code Audit
- asherlangton 12y ago
  The "acquisition" is rather questionable: https://twitter.com/asherlangton/status/575768324757266432 https://twitter.com/asherlangton/status/575768324757266432 https://twitter.com/asherlangton/status/583509322946125824 https://twitter.com/asherlangton/status/583509322946125824
- lbthomsen 12y ago
  A simple fact is they do not _have_ the source code. They are only patching the firmware the router came with from China when they bought it. They are not even building Tor themselves but relying on an old unsupported version straight from OpenWrt's repository.

lbthomsen 12y ago

I wrote that analysis and honestly - no - I don't think it's malicious. Incompetent perhaps, but not malicious.

asherlangton 12y ago
I should clarify: I don't think they're adding backdoors maliciously. It's their conduct -- proceeding despite the concerns raised, attacking critics, etc. -- that is greedy and malicious.
- lbthomsen 12y ago
  Now, that I am inclined to agree with :) And fact is - using the device as shipped to us is more dangerous than not using it at all. Anybody within WiFi range can basically do whatever they want.
rst 12y ago
This is an arena in which malice could plausibly try to disguise itself as incompetence. It's fine to give people the benefit of that doubt, but it is a doubt.