Security testers discovered a number of serious flaws in the project.
The Kickstarter campaign for Anonabox, a Tor-enabled router, is over. It crashed and burned this week after a group of Redditors discovered a number of serious flaws in the project, forcing Kickstarter to remove the fundraiser.
Harnessing the widespread desire for simpler, privacy-enhancing technology, the Anonabox campaign initially debuted to much positive hype. August Germar, the Anonabox creator, promised an “open source embedded networking device designed specifically to run Tor.” And with nearly 9,000 backers, the campaign quickly blew by its fundraising goal of $7,500, reaching $585,549 in its first five days.
But the honeymoon did not last long. Criticism first surfaced on Reddit, centering on Germar’s claims that he and his team built a “custom” board and case after four years of development. Redditors discovered that they had instead bought a generic case from a Chinese supplier and simply increased the flash memory, Wired reports. Users posted photos of the Anonabox and the Chinese device side-by-side, and during an AMA with Germar they confronted him with their suspicions.
“You can see the model number ‘WT3020′ on your anonabox PCB,” one Redditor wrote. “That’s your picture, right? Are you really claiming your device isn’t just an off-the-shelf WT3020?”
The problems with the Anonabox did not end there. As the security community took note of the project, testers found issues with the router’s software as well, including vulnerabilities that could “punch holes in its Tor protections” and leave a user even less secure than if they connected to the unprotected Internet, a computer security analyst told Wired.
Adding fuel to the fire, Redditors and other critics cracked the hashed root password installed on all Anonaboxes. It was “developer!” – an incredibly weak choice.
A Kickstarter spokesperson declined to give a specific reason for cancelling the Anonabox campaign, merely providing a link for possible reasons for a project suspensions.
Leave a Reply