I've been working through the technical elements of the anonabox setup. I'll leave the moral outrage to others, personally I think $50 for anonymity with tor is great but impossible. Currently I'm (somewhat hilariously) trying to reverse engineer the firmware in an open source operating system to a product described as 100% open source, but here's what I have so far:

The source shipped so far is a bunch of config files that appear to be hand-loaded onto devices running an existing image according to a forum post[1]. You would expect to see a firmware image built using OpenWRT the imagebuilder or complete toolchain with some degree of code audit if you want to promise no backdoors.

The firewall configuration uses both OpenWRT's UCI and a separate unintegrated iptables script. The configuration means that the device will leak protocols other than TCP and UDP with specific destination ports out through the wan interface onto the other network or the Internet.

There's a hard coded root password in the build. OpenWRT doesn't have one and asks you to set your own.

The lan side wifi is completely open and unencrypted. If you were to use this device thinking you're safe, anyone can sniff what you're doing if they're within wireless range before it goes through Tor. Because Tor provides transport encryption, almost all .onion sites use HTTP.

The device exposes port 9040 on all interfaces, this is the tor socks port. I don't yet know whether this could be used to get to the lan side network (e.g. 127.0.0.1 HTTP interface) from tor as I haven't looked into it yet by chaining proxies as I haven't had time, but I don't think it's needed.

There's hard-coded host key material, the startup entropy state is unknown - basically lots of potential crypto problems that to be honest can be saved until we see actual thing and it's code.

From the config files it looks like the hardware uses kernel modules that load firmware in binary blob form from the device's flash memory. This is common in routers and makes kernel upgrades difficult because the blobs are designed for specific kernel versions.

The source code for the device's OS is not available. There's an upgrade firmware available but looking at the firmware using various extraction and carving tools yielded nothing. Some initial analysis shows that there's a prologue and a higher entropy possibly compressed or encrypted component. This is not an open hardware platform.

Without some serious modifications the device will almost certainly suffer from a transparent proxy leak problem[2].

In conclusion the technical claims don't match what has been provided at this stage. I'd be quite happy to discuss things with the developers, but fundamentally this project is not going to deliver the anonymity customers have been told they will even if the security problems are fixed and the source for everything is opened up. I'm a bit disheartened that they're taking the money and going to ship, but I accept that it's hard to turn down half a million dollars.

[1] - http://www.torouter.com/developer/showthread.php?tid=4

[2] - https://trac.torproject.org/projects/tor/wiki/doc/Transparen...

I don't what the point of lying about the source of the boards was. That was just stupid. This user htilonom is just milking it for all it's worth though.

I've seen those devices retail for as much as $30. $50 isn't unreasonable. That price should ensure they can deliver.

After it's done with Germar, the reddit mob should take its pitchforks over to Starbucks. What a scam that place is. Slapping their logo on coffee from some third world country, claiming they made it. Outrageous!

If the price was the only issue, $50 wouldn't be unreasonable at all. People underestimate the cost of distribution, offering support and warranties, vat/sales taxes etc.. $50 just for reselling the unmodified Chinese devices would be reasonable many places.

So I agree that making a fuss over the price is silly. Especially since their initial goal was low. A $7500 kickstarter to fund a bit of developer time to put together something nice is not unreasonable. Everything beyond that should pretty much be considered pre-orders.

But the lies and deception, false claims and apparent total lack of understanding of how to make the device secure on the other hand, goes far beyond stupid.

Either you're a shill or you haven't actually read the post.

Do you want to buy a tor router with default open wifi and admin password set to 'developer!'?

...?

You understand that your router came with the username 'admin' and the password 'password' when you bought it right?

(don't get me wrong, there's some weird stuff going on with that kickstarter, but the password/username thing is such a strawman it hurts me to see people talking about it)

It's not really a strawman. By default OpenWRT doesn't have a root password, and asks you to set one in order to be able to log into the interface or over SSH.

A lot of devices running OpenWRT that are shipped these days (e.g. mainly routers of some sort) come with WPA-PSK encrypted wireless network, not an open wireless network. It's common to see the password put on a sticker on the device or supplied with it, and it's usually algorithmically or randomly generated.

Because the default wifi is open anyone in the local area will be able to connect to the device, passively sniff wireless traffic going through the bridge etc. before it hits tor, including any usernames and passwords used to log into the router other than through SSH.

Here in Europe, standalone routers are not very popular, since ISPs provide CPEs (customer premises equipment) that are a combination of a modem and router with multiple Ethernet ports and Wi-Fi. The norm is for the ISP to configure them with unique web-interface passwords, WiFi SSIDs as well as WPA keys, printed on the back of the device [1].

[1} http://imgur.com/i8W4aQb

Here in Scotland my broadband router has a unique wifi password, but the admin password for configuring the router is always 'sky'.

Outstanding. Sounds like any banner ad you happen across could own your network with a variant of <img src="hxxp://192.168.0.1/admin.cgi?op=login&password=sky">.

To protect against these kinds of attacks (and DNS rebinding attacks), most (?) modern browsers won't allow a webpage to make requests to non-routable IP addresses unless the page itself came from a non-routable IP address. Not that that's a fix, but it definitely helps mitigate the issue.

I just tested Firefox and Chrome, both made a HTTP request successfully to my laptop's rfc1918 address referenced from a web page on the internet. Maybe you are thinking of IE's "zones" feature?

At least my router did not. It came with a sticker with a random password. My other routers all have ethernet ports and came with wifi disabled.

What router is it?

I've literally never encountered a router that didn't have a default password on it.

Some times service providers will set a random (or user) password before shipping the device, but they all reset to the default one when you factory reset it.

I thought it was just universal.

I'm actually quite interested to know which manufacturers ship a custom rom per device with a unique password.

Fritz Boxes have a unique password, it's printed on the sticker on the back. My consumer grade Telekom router does the same, same for the vodafone router my brother owns. It's de-facto standard for all consumer grade adsl/cable modems/routers that german telkos hand off to their customer.

Um. You might be confusing the password that is configured by the service provider and the password that set by the manufacturer.

The fritz box default password is 'password'.

http://www.routeripaddress.com/routers/10609/avm-fritz-box-f...

Maybe confusing the WiFi password and the admin password? I just got a new modem/router today and the WiFi is WPA2 secured by default with a random passcode printed on a sticker on the base of the unit... but once connected, the login for configuring the unit itself is your standard default admin/password deal.

ADSL/Cable modems are usually set up to download firmware from the ISP, at least in cable modems throttling is usually done on the device as well, so it is sort of resets every time you turn it off and on.

My router at least uses the same password for wifi and admin access by default. I'll have to check on the fritz box though.

.. from the manufacturer? No it didn't. Your ISP set a random password when they configured it for you.

Regular routers don't advertise as security products.