Attacks/Breaches
8/8/2007
09:55 AM
50%
50%

XeroBank Launches Anonymizing Tool Suite

XeroBank, formerly known as Torrify, offers up 'rubber glove' against malware and prying eyes

XeroBank this weekend at DefCon gave users a first peek at the newest version of xB Machine -- a broad suite of tools designed to let users do a wide range of tasks anonymously over the Web.

The xB Machine is a portable, secure computing environment, with browser, email, and chat functions, coupled with access to any anonymized Web service the user desires. The details and transactions inside each xB Machine account are protected with 256-bit AES encryption. The software also has a self-destruct sequence for nuking user data or just refreshing the system, according to Steve Topletz, a XeroBank administrator.

"This is the end of personal firewalls and antivirus software -- you no longer need to worry about which computing environment you're in." Topletz claimed. "You can put this on a flash drive and run it on virtually any operating system, without worry of compromising your IP address, or reconfiguring your software to maintain protection against viruses and bugs."

The xB Machine software is available as a free download. Topletz also offered free, one-month trials of XeroBank Plus accounts to the first 1,000 Dark Reading readers to email the company with "Dark Reading" in the subject line.

XeroBank Plus normally costs $8 a month, which includes 200 Kbit/s connectivity, anonymous Web browsing, and email. Its Pro and Premium services are more expensive at $30 and $400 a month, respectively, but offer more capabilities -- including anonymous instant messaging, voice over IP, FTP, and P2P applications. All XeroBank service users get an encrypted, offshore email account.

Applications and networks that offer anonymous, untraceable usage might be viewed as a mixed blessing. For secretive users, they are a godsend. For IT managers and security professionals tasked with monitoring end users, they may be a gigantic nightmare. Regardless, many security experts anticipate it's only a matter of time before privacy advocates, law enforcement, and legislators lock horns over the sale and use of anonymized tools.

XeroBank's Topletz doesn't see it that way. In fact, he says such products are a boon to users who are prone to sloppy computing hygiene -- and to justifiably-paranoid IT managers, who cringe each time a mobile user returns from a long trip and re-attaches to the enterprise network.

"XB Machine allows users to dirty up an OS without resetting any configurations, or bringing in viruses -- it's a disposable rubber glove for computing," Topletz told Dark Reading. "Many enterprises are looking to implement this in their IT infrastructure because it brings in so many capabilities, and it protects against Trojans and worms, which cost them both revenue and time."

Security consultant Robert Hansen, CEO of SecTheory LLC, likes the idea of having multiple browsers, emails, and/or virtual machines. "But separation of critical assets is a lot more work than people are willing to do, and it doesn't change the security model for those individual applications. It just compartmentalizes them."

Hansen also points out a potential drawback with any commercial security service. "If people have to pay for this, it isn't exactly anonymous now, is it?"

But on its Website, XeroBank says it protects the user's identity, even from XeroBank itself. "Payments made to XeroBank are anonymized from us. When an order is placed, it is assigned a transaction ID number. That transaction ID number does not have any personally identifying information attached to it. Accounts are then paid for by using a third party payment processor, who cannot share the information with XeroBank" the company says.

"When the account is paid for with our third party processor, it tells XeroBank to activate the account that has that transaction ID number, and the transaction ID number is then destroyed," the company states.

XeroBank is planning to add further capabilities to xB Machine. Topletz said the company's adding an auto updater in the next month; the company will also add financial cryptography, which enables secure anonymous banking transactions from anywhere in the world, sometime in the next three to six months.

The launch of xB Machine coincides with some recent re-branding at XeroBank. The company, formerly known as Torrify, renamed one of its flagship products to xB Browser, which many know better as Torpark, and is a modified version of Mozilla's Firefox browser. The moves were made to avoid confusion with the Tor Project, a separate entity.

"Tor" refers to "the onion router," a toolset that underpins a wide range of anonymous applications.

— Terry Sweeney, Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?