Attacks/Breaches
8/8/2007
09:55 AM
Connect Directly
RSS
E-Mail
50%
50%

XeroBank Launches Anonymizing Tool Suite

XeroBank, formerly known as Torrify, offers up 'rubber glove' against malware and prying eyes

XeroBank this weekend at DefCon gave users a first peek at the newest version of xB Machine -- a broad suite of tools designed to let users do a wide range of tasks anonymously over the Web.

The xB Machine is a portable, secure computing environment, with browser, email, and chat functions, coupled with access to any anonymized Web service the user desires. The details and transactions inside each xB Machine account are protected with 256-bit AES encryption. The software also has a self-destruct sequence for nuking user data or just refreshing the system, according to Steve Topletz, a XeroBank administrator.

"This is the end of personal firewalls and antivirus software -- you no longer need to worry about which computing environment you're in." Topletz claimed. "You can put this on a flash drive and run it on virtually any operating system, without worry of compromising your IP address, or reconfiguring your software to maintain protection against viruses and bugs."

The xB Machine software is available as a free download. Topletz also offered free, one-month trials of XeroBank Plus accounts to the first 1,000 Dark Reading readers to email the company with "Dark Reading" in the subject line.

XeroBank Plus normally costs $8 a month, which includes 200 Kbit/s connectivity, anonymous Web browsing, and email. Its Pro and Premium services are more expensive at $30 and $400 a month, respectively, but offer more capabilities -- including anonymous instant messaging, voice over IP, FTP, and P2P applications. All XeroBank service users get an encrypted, offshore email account.

Applications and networks that offer anonymous, untraceable usage might be viewed as a mixed blessing. For secretive users, they are a godsend. For IT managers and security professionals tasked with monitoring end users, they may be a gigantic nightmare. Regardless, many security experts anticipate it's only a matter of time before privacy advocates, law enforcement, and legislators lock horns over the sale and use of anonymized tools.

XeroBank's Topletz doesn't see it that way. In fact, he says such products are a boon to users who are prone to sloppy computing hygiene -- and to justifiably-paranoid IT managers, who cringe each time a mobile user returns from a long trip and re-attaches to the enterprise network.

"XB Machine allows users to dirty up an OS without resetting any configurations, or bringing in viruses -- it's a disposable rubber glove for computing," Topletz told Dark Reading. "Many enterprises are looking to implement this in their IT infrastructure because it brings in so many capabilities, and it protects against Trojans and worms, which cost them both revenue and time."

Security consultant Robert Hansen, CEO of SecTheory LLC, likes the idea of having multiple browsers, emails, and/or virtual machines. "But separation of critical assets is a lot more work than people are willing to do, and it doesn't change the security model for those individual applications. It just compartmentalizes them."

Hansen also points out a potential drawback with any commercial security service. "If people have to pay for this, it isn't exactly anonymous now, is it?"

But on its Website, XeroBank says it protects the user's identity, even from XeroBank itself. "Payments made to XeroBank are anonymized from us. When an order is placed, it is assigned a transaction ID number. That transaction ID number does not have any personally identifying information attached to it. Accounts are then paid for by using a third party payment processor, who cannot share the information with XeroBank" the company says.

"When the account is paid for with our third party processor, it tells XeroBank to activate the account that has that transaction ID number, and the transaction ID number is then destroyed," the company states.

XeroBank is planning to add further capabilities to xB Machine. Topletz said the company's adding an auto updater in the next month; the company will also add financial cryptography, which enables secure anonymous banking transactions from anywhere in the world, sometime in the next three to six months.

The launch of xB Machine coincides with some recent re-branding at XeroBank. The company, formerly known as Torrify, renamed one of its flagship products to xB Browser, which many know better as Torpark, and is a modified version of Mozilla's Firefox browser. The moves were made to avoid confusion with the Tor Project, a separate entity.

"Tor" refers to "the onion router," a toolset that underpins a wide range of anonymous applications.

— Terry Sweeney, Special to Dark Reading

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2963
Published: 2014-07-10
Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName, (2) _2_lastName, or (3) _2_middleName parameter.

CVE-2014-3310
Published: 2014-07-10
The File Transfer feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center does not verify that a requested file was an offered file, which allows remote attackers to read arbitrary files via a modified request, aka Bug IDs CSCup62442 and CSCup58463.

CVE-2014-3311
Published: 2014-07-10
Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467.

CVE-2014-3315
Published: 2014-07-10
Cross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCup76308.

CVE-2014-3316
Published: 2014-07-10
The Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload restrictions via a crafted parameter, aka Bug ID CSCup76297.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.