Review: Anonabox or InvizBox, which Tor router better anonymizes online life?

A while back, we covered the controversy over a few Kickstarter projects aiming to provide something in increasing demand as of late: a foolproof way to connect any Wi-Fi capable device to the Tor anonymized network. Two such Tor "travel router" projects have since become actual product: InvizBox, from a team in Ireland, and the resurrected Anonabox, which was acquired by the tech holding company Sochule. A third, the open source PORTAL project, originally coded by "opsec" champion the grugq, is being turned into a consumer product by Ryan Lackey and Marc Rogers of CloudFlare and will be getting its bow at the RSA Conference later this month.

These devices are, to varying degrees, effective ways to hide from unwanted attention of all sorts. That is, they'll work short of a state actor looking to use a giant datacenter dedicated to performing all manner of de-anonymizing attacks by using the Tor takeover conspiracy model of the week, zero-day malware, or people's own simple mistakes against them. But these routers all follow slightly different approaches. Anonabox is a stunningly hands-off product that has no user interface other than its lengthy Wi-Fi password; InvizBox provides hands-off privacy with the addition of an administrative interface to apply fixes and leverage moderately more complicated Tor capabilities; and PORTAL promises to provide everything—including pluggable protocols for Tor to help it get past the most persistent state-funded nastiness.

We don't have PORTAL in hand yet, but we did receive test units of Anonabox and InvizBox. To see just how effective those two pocket privacy contenders are, we ran them through a head-to-head in the most hostile network environment we know of—Ars Technology Lab's network torture chamber (otherwise known as my office... I've had to do a bit of responsible disclosure along the way).

The bottom line is that these two devices do work. Both provide a way to connect PCs and other devices to the Tor network and access "hidden services" and the larger Internet without having to install and maintain software. Both are based on OpenWRT, the Linux-based open source operating system for embedded devices that is commonly used in Wi-Fi routers.

But despite using essentially the same technology as a base, these two devices significantly diverge in their approach. Your privacy mileage may vary as a result, particularly with Anonabox. For example, there's no way for the end-user of an Anonabox to perform patching or upgrades to correct faults in the underlying code.

Tor them a new one

There are many reasons why anyone might want to use Tor. An increasing number of countries monitor Internet traffic today (including Australia, with its recent sweeping data retention law that calls for widespread collection of Internet metadata). And while the use of virtual private networks to protect privacy is in many cases a better option than Tor, accessing VPNs in countries hostile to privacy is frequently difficult. Journalists, political activists, academics, and anyone wanting to simply use the Internet without surveillance from an ISP, a company, or a government agency needs Tor.

Tor is most effective when it is regularly used by people for everyday things (and when there are more people willing to put up relay and exit servers). Given that there are certain fingerprints associated with Tor use that can be identified by deep packet inspection rules, an observer can tell when you're using Tor; it's easier to hide activity if Tor is always on and in use by many. If you just turn on Tor when you're logging in to your dark market admin console, that can become problematic for anonymity.

There are some trade-offs. Tor is strictly a TCP/IP service, which makes it fine for visiting websites, checking e-mail, and any other task that relies on the three-step handshake of the Transmission Control Protocol to make sure everything gets where it's supposed to. But you can't use Tor for things that stream—like Skype or other voice and video applications, for example. Those use the handshake-less UDP protocol to throw their packets as quickly as possible across the Internet. (Anybody who says they have 'Skyped' over Tor for security doesn't understand how Skype works.)

Tor is also not great if you want speed. The Tor network's throughput depends on the capacity of the relay and exit nodes that are constructed into the "circuit" used for each connection. Using the Tor Browser Bundle on a test system and the two routers tested in this review, we got upload and download speeds ranging from roughly a megabit per second (using the Tor Browser Bundle) to 2.5 megabits per second.

And usually, using Tor is not something that could be described as "foolproof." It requires patches regularly—often immediately when a security concern is uncovered. The Tor Browser Bundle and the USB-bootable operating system TAILS are incremental steps away from the comfort zone of the average computer user.

That's where the Anonabox and the InvizBox come in. Nearly identical in size and form factor and different externally only in the placement of Ethernet and power ports, these devices come in boxes sealed with tamper-sensitive tape to protect the customer from en-route tampering (or at least raise said tampering to the level of someone with counterfeit tamper-proof tape of their own). Both can be used via an Ethernet cable or Wi-Fi, and they secure the Wi-Fi signal with WPA2 (though early versions of Anonabox shipped with unencrypted Wi-Fi). Both require an Ethernet connection to the "Wide-Area Network" side—the Internet-connected network that will host the outbound Tor connection. And you can power either device over USB from a notebook PC or a standard power source (not included).

From there on out, however, your choice matters.

Anonabox

Anonabox is intended, as its developer August Germar told Ars, for a very specific use case. Measuring 64 millimeters wide, 44.5 millimeters deep, and 22.3 millimeters high, the device is "based on a certain set of ideas," and those ideas are that you plug the box in and you log into it with the password you are given over Wi-Fi or just jack into its LAN Ethernet port. From there, users must be happy (or pretend to be) with the Tor security you get and forget all about it. Anonabox will automatically apply Tor software updates and handle all that messy networking stuff without users getting involved.

There is not much information available about what's inside the Anonabox, so I performed an unauthorized field modification to find out, using a screwdriver to pop open the case. The board appears to be "custom"—there's no mark on it anywhere to identify nation of origin or manufacturer, though it has a MIPS-based Atheros AR9331-AL3A Wi-Fi system-on-chip and an SK hynix DDR2 RAM chip. (See the gallery above for photos.) It runs on 5 volts/1 amp, so it can be powered easily from any USB-based charger or from a PC's USB port. Some readers have remarked that it appears to be an unbranded Oolite board, and it appears that the FCC identifier on the Anonabox was assigned to the same manufacturer as that of the Oolite: Gainstrong Industry Co., Ltd of Shenzen, China.

Update: It appears that the Anonabox may just have a custom case, as the externals for the Gainstrong device look very familiar.

Correcting a problem from the earliest versions of the product (shipped before Sochule acquired Anonabox), the device I tested uses WPA2 pre-shared key (PSK) with the Temporal Key Integrity Protocol (TKIP) and the Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP) "forced." In other words, it's using AES encryption for the connection, instead of no encryption as early units did. This is not the only change to the code since Anonabox went from Kickstarter to IndieGoGo, and it's an indication that Germar and company have taken some of the criticism of the device constructively.

One thing has not changed: Anonabox has no user interface whatsoever. The only interface the $99 device comes with is a password printed on a sticker; don't lose it, because it's your password forever. (The password is at least 24 characters long. I tried entering it on my iPhone 12 times before it actually took.) The Wi-Fi SSID of the Anonabox tested was "Anonabox," and like the password, it will never change. And if there's a software problem with Anonabox itself... well, it may be time to buy a new one.

Germar and company also made an interesting choice regarding how they configured Anonabox's networking. Rather than using one of the well-established private network IP address ranges (like 192.168.x.x or 10.x.x.x), the Anonabox uses an IP address block allocated to Softbank in Japan (126.x.x.x). While everything going out of the Anonabox passes through Tor anyway, and the device doesn't support local routing on the LAN-side by design, there's an outside chance this could cause interesting problems for anyone using Softbank Telecom services. When we attempted to ping the Anonabox from inside by its gateway address, it appeared to pass the pings through to a Softbank server tunneled through Tor. It did the same thing with a port scan (sorry, Softbank).

On the plus side, the version of Anonabox we received was fairly well locked down. Port scans showed no open ports from the Internet side, and it appeared to be entirely locked down from the LAN side as well (though it did respond to pings from the LAN side). When we acted like a bad user and tried to access services that would not route over Tor—specifically, things like Skype—they didn't work. No telltale UDP traffic leaked out to give us away to potential onlookers.

However, there was some UDP traffic that did leak—mostly to Google. Some Simple Service Discovery Protocol M-SEARCH multicast traffic and Quick UDP Internet Connections (QUIC) traffic slipped past Anonabox's firewall rules. The only other non-Tor traffic coming from the device was Network Time Protocol requests to hosts at NTP.org.

When we asked Germar about the UDP issue, he said the firewall rules had been fixed in the latest batch of Anonaboxes shipped after this advance unit. "We have a nightly build that supplies the firewall rules," he told Ars. However, there was no way to apply the updated firewall rules to this test Anonabox because... there's no administrative interface.

There have been a number of other problems uncovered in earlier releases of Anonabox. A post this week detailed a way to gain access as root to Anonabox over a secure shell using IPv6 (and the post demonstrated that the hard-wired root password for the device was "admin"). That led to a recall of devices that had been shipped, and the bug was fixed, sort of, in our test unit: IPv6 was disabled.

So what would Anonabox users do if another major software bug or vulnerability was discovered in the device's core software configuration? Apparently, they'd need to ship it back to the manufacturer or just buy a new one.

The lack of a user interface also, ironically, creates something of an anonymity problem. If you're using a Wi-Fi router that's openly broadcasting the SSID "Anonabox," it's not terribly difficult for someone to track down who's using Tor in a specific location. Aside from that, the lack of an interface makes the Anonabox somewhat one-note; there's no way to, for example, configure Tor to use a specific Tor bridge or proxy.

Germar said that "the inspiration for this device was Arab Spring. They blocked Twitter, and our goal was to create something that a group of people can use to get back onto Twitter and Facebook. That's a solution for a specific threat model. It's not really possible to build something that's all things for all people." Germar went on to say that Anonabox plans to create different devices for other tasks. The current version is "not a Swiss Army knife," he admitted. "It's meant to do one thing."

That one thing is delivering Tor access from locations not explicitly blocking access to Tor relays or shutting down Tor traffic by its fingerprint. So if you want a black-box security device that you can give just about anyone in order to access Tor from their home network's router or a work or hotel Ethernet port, Anonabox may be an acceptable option depending on their risk profile. However, we'd recommend waiting to see the third-party security audit the company says is being performed on its not-quite-open source code to make sure.