Attacks/Breaches
8/8/2007
09:55 AM
Connect Directly
RSS
E-Mail
50%
50%

XeroBank Launches Anonymizing Tool Suite

XeroBank, formerly known as Torrify, offers up 'rubber glove' against malware and prying eyes

XeroBank this weekend at DefCon gave users a first peek at the newest version of xB Machine -- a broad suite of tools designed to let users do a wide range of tasks anonymously over the Web.

The xB Machine is a portable, secure computing environment, with browser, email, and chat functions, coupled with access to any anonymized Web service the user desires. The details and transactions inside each xB Machine account are protected with 256-bit AES encryption. The software also has a self-destruct sequence for nuking user data or just refreshing the system, according to Steve Topletz, a XeroBank administrator.

"This is the end of personal firewalls and antivirus software -- you no longer need to worry about which computing environment you're in." Topletz claimed. "You can put this on a flash drive and run it on virtually any operating system, without worry of compromising your IP address, or reconfiguring your software to maintain protection against viruses and bugs."

The xB Machine software is available as a free download. Topletz also offered free, one-month trials of XeroBank Plus accounts to the first 1,000 Dark Reading readers to email the company with "Dark Reading" in the subject line.

XeroBank Plus normally costs $8 a month, which includes 200 Kbit/s connectivity, anonymous Web browsing, and email. Its Pro and Premium services are more expensive at $30 and $400 a month, respectively, but offer more capabilities -- including anonymous instant messaging, voice over IP, FTP, and P2P applications. All XeroBank service users get an encrypted, offshore email account.

Applications and networks that offer anonymous, untraceable usage might be viewed as a mixed blessing. For secretive users, they are a godsend. For IT managers and security professionals tasked with monitoring end users, they may be a gigantic nightmare. Regardless, many security experts anticipate it's only a matter of time before privacy advocates, law enforcement, and legislators lock horns over the sale and use of anonymized tools.

XeroBank's Topletz doesn't see it that way. In fact, he says such products are a boon to users who are prone to sloppy computing hygiene -- and to justifiably-paranoid IT managers, who cringe each time a mobile user returns from a long trip and re-attaches to the enterprise network.

"XB Machine allows users to dirty up an OS without resetting any configurations, or bringing in viruses -- it's a disposable rubber glove for computing," Topletz told Dark Reading. "Many enterprises are looking to implement this in their IT infrastructure because it brings in so many capabilities, and it protects against Trojans and worms, which cost them both revenue and time."

Security consultant Robert Hansen, CEO of SecTheory LLC, likes the idea of having multiple browsers, emails, and/or virtual machines. "But separation of critical assets is a lot more work than people are willing to do, and it doesn't change the security model for those individual applications. It just compartmentalizes them."

Hansen also points out a potential drawback with any commercial security service. "If people have to pay for this, it isn't exactly anonymous now, is it?"

But on its Website, XeroBank says it protects the user's identity, even from XeroBank itself. "Payments made to XeroBank are anonymized from us. When an order is placed, it is assigned a transaction ID number. That transaction ID number does not have any personally identifying information attached to it. Accounts are then paid for by using a third party payment processor, who cannot share the information with XeroBank" the company says.

"When the account is paid for with our third party processor, it tells XeroBank to activate the account that has that transaction ID number, and the transaction ID number is then destroyed," the company states.

XeroBank is planning to add further capabilities to xB Machine. Topletz said the company's adding an auto updater in the next month; the company will also add financial cryptography, which enables secure anonymous banking transactions from anywhere in the world, sometime in the next three to six months.

The launch of xB Machine coincides with some recent re-branding at XeroBank. The company, formerly known as Torrify, renamed one of its flagship products to xB Browser, which many know better as Torpark, and is a modified version of Mozilla's Firefox browser. The moves were made to avoid confusion with the Tor Project, a separate entity.

"Tor" refers to "the onion router," a toolset that underpins a wide range of anonymous applications.

— Terry Sweeney, Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2021
Published: 2014-10-24
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.4.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

CVE-2014-3604
Published: 2014-10-24
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2014-6230
Published: 2014-10-24
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.

CVE-2014-6251
Published: 2014-10-24
Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length, then triggering the overflow with a mining.notify request.

CVE-2014-7180
Published: 2014-10-24
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.