Attacks/Breaches
8/8/2007
09:55 AM
50%
50%

XeroBank Launches Anonymizing Tool Suite

XeroBank, formerly known as Torrify, offers up 'rubber glove' against malware and prying eyes

XeroBank this weekend at DefCon gave users a first peek at the newest version of xB Machine -- a broad suite of tools designed to let users do a wide range of tasks anonymously over the Web.

The xB Machine is a portable, secure computing environment, with browser, email, and chat functions, coupled with access to any anonymized Web service the user desires. The details and transactions inside each xB Machine account are protected with 256-bit AES encryption. The software also has a self-destruct sequence for nuking user data or just refreshing the system, according to Steve Topletz, a XeroBank administrator.

"This is the end of personal firewalls and antivirus software -- you no longer need to worry about which computing environment you're in." Topletz claimed. "You can put this on a flash drive and run it on virtually any operating system, without worry of compromising your IP address, or reconfiguring your software to maintain protection against viruses and bugs."

The xB Machine software is available as a free download. Topletz also offered free, one-month trials of XeroBank Plus accounts to the first 1,000 Dark Reading readers to email the company with "Dark Reading" in the subject line.

XeroBank Plus normally costs $8 a month, which includes 200 Kbit/s connectivity, anonymous Web browsing, and email. Its Pro and Premium services are more expensive at $30 and $400 a month, respectively, but offer more capabilities -- including anonymous instant messaging, voice over IP, FTP, and P2P applications. All XeroBank service users get an encrypted, offshore email account.

Applications and networks that offer anonymous, untraceable usage might be viewed as a mixed blessing. For secretive users, they are a godsend. For IT managers and security professionals tasked with monitoring end users, they may be a gigantic nightmare. Regardless, many security experts anticipate it's only a matter of time before privacy advocates, law enforcement, and legislators lock horns over the sale and use of anonymized tools.

XeroBank's Topletz doesn't see it that way. In fact, he says such products are a boon to users who are prone to sloppy computing hygiene -- and to justifiably-paranoid IT managers, who cringe each time a mobile user returns from a long trip and re-attaches to the enterprise network.

"XB Machine allows users to dirty up an OS without resetting any configurations, or bringing in viruses -- it's a disposable rubber glove for computing," Topletz told Dark Reading. "Many enterprises are looking to implement this in their IT infrastructure because it brings in so many capabilities, and it protects against Trojans and worms, which cost them both revenue and time."

Security consultant Robert Hansen, CEO of SecTheory LLC, likes the idea of having multiple browsers, emails, and/or virtual machines. "But separation of critical assets is a lot more work than people are willing to do, and it doesn't change the security model for those individual applications. It just compartmentalizes them."

Hansen also points out a potential drawback with any commercial security service. "If people have to pay for this, it isn't exactly anonymous now, is it?"

But on its Website, XeroBank says it protects the user's identity, even from XeroBank itself. "Payments made to XeroBank are anonymized from us. When an order is placed, it is assigned a transaction ID number. That transaction ID number does not have any personally identifying information attached to it. Accounts are then paid for by using a third party payment processor, who cannot share the information with XeroBank" the company says.

"When the account is paid for with our third party processor, it tells XeroBank to activate the account that has that transaction ID number, and the transaction ID number is then destroyed," the company states.

XeroBank is planning to add further capabilities to xB Machine. Topletz said the company's adding an auto updater in the next month; the company will also add financial cryptography, which enables secure anonymous banking transactions from anywhere in the world, sometime in the next three to six months.

The launch of xB Machine coincides with some recent re-branding at XeroBank. The company, formerly known as Torrify, renamed one of its flagship products to xB Browser, which many know better as Torpark, and is a modified version of Mozilla's Firefox browser. The moves were made to avoid confusion with the Tor Project, a separate entity.

"Tor" refers to "the onion router," a toolset that underpins a wide range of anonymous applications.

— Terry Sweeney, Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0714
Published: 2015-05-02
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse Server 10.0(1), 10.5(1), 10.6(1), and 11.0(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCut53595.

CVE-2014-3598
Published: 2015-05-01
The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.

CVE-2014-8361
Published: 2015-05-01
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request.

CVE-2015-0237
Published: 2015-05-01
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain.

CVE-2015-0257
Published: 2015-05-01
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup, which allows local users to obtain sensitive information by reading files in the directory.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.