Hacker News Reader

Comment by deckar01 | Hacker News Reader

TLDR; Anonabox can be rooted with minimal effort (backdoor wide open). The attack vector is an undocumented web interface with a hard coded password ("admin"), an open SSH port that accepts the same credentials, and grants root access.

It is clear that they are lazy and a little out of their depth, but are they malicious?

View on HN

Considering that their Kickstarter was shut down 6 months ago due to their lies, and that they started up again at Indiegogo despite the warnings, and that they've been concealing information and attacking their critics through sockpuppets? Yes, I think it's fair at this point to call them malicious.

They've been acquired by http://www.sochule.com/

Which seems to specialize in social marketing?

This update promises another update (which is now overdue) that covers these issues: https://anonabox.com/news/anonabox-blog-when-there-is-blood-...

In Part 2 & 3 of this blog series, we will discuss:

-- Anonabox's Hardware

-- Anonabox's Firmware

-- Open Source vs. Closed Source

-- The Blackhole

-- Product Roadmap (New products coming Q3...maybe sooner)

-- Third Party Hardware & Firmware Review

-- Black Duck Software | Open Source Code Audit

The "acquisition" is rather questionable: https://twitter.com/asherlangton/status/575768324757266432 https://twitter.com/asherlangton/status/583509322946125824

A simple fact is they do not _have_ the source code. They are only patching the firmware the router came with from China when they bought it. They are not even building Tor themselves but relying on an old unsupported version straight from OpenWrt's repository.

I wrote that analysis and honestly - no - I don't think it's malicious. Incompetent perhaps, but not malicious.

I should clarify: I don't think they're adding backdoors maliciously. It's their conduct -- proceeding despite the concerns raised, attacking critics, etc. -- that is greedy and malicious.

Now, that I am inclined to agree with :) And fact is - using the device as shipped to us is more dangerous than not using it at all. Anybody within WiFi range can basically do whatever they want.

This is an arena in which malice could plausibly try to disguise itself as incompetence. It's fine to give people the benefit of that doubt, but it is a doubt.

Reply on news.ycombinator.com