TLDR; Anonabox can be rooted with minimal effort (backdoor wide open). The attack vector is an undocumented web interface with a hard coded password ("admin"), an open SSH port that accepts the same credentials, and grants root access.
It is clear that they are lazy and a little out of their depth, but are they malicious?
Considering that their Kickstarter was shut down 6 months ago due to their lies, and that they started up again at Indiegogo despite the warnings, and that they've been concealing information and attacking their critics through sockpuppets? Yes, I think it's fair at this point to call them malicious.
A simple fact is they do not _have_ the source code. They are only patching the firmware the router came with from China when they bought it. They are not even building Tor themselves but relying on an old unsupported version straight from OpenWrt's repository.
I should clarify: I don't think they're adding backdoors maliciously. It's their conduct -- proceeding despite the concerns raised, attacking critics, etc. -- that is greedy and malicious.
Now, that I am inclined to agree with :) And fact is - using the device as shipped to us is more dangerous than not using it at all. Anybody within WiFi range can basically do whatever they want.
This is an arena in which malice could plausibly try to disguise itself as incompetence. It's fine to give people the benefit of that doubt, but it is a doubt.
It is a tremendously bad idea to route all of your traffic through Tor. It completely breaks the Tor security/privacy model.
Negative bonus points for doing it as a WiFi AP - that's a great way to accidentally reconnect to a different AP when your connection to the Tor AP drops, and immediately tie your Tor traffic to your regular connection through automatic reconnects.
This is likely the reason why the Anonabox generates random SSIDs; it forces the user to expect to have to connect to a new network regularly, and additionally reduces the amount of time available for an attacker to attempt to create a duplicate AP.
Of course, even this tactic isn't foolproof, and it's made rather ineffective by Anonabox's rather glaring flaws, but I can understand the rationale.
That idea doesn't work, though. Most devices/OSes remember your last access point, and will, upon a Anonabox failure / deauth / whatever, happily reconnect to your regular (non-Tor!) WiFi AP. That instantly compromises you. Changing the Anonabox SSID doesn't change that.
I had a look at the Invizibox firmware and it is somewhat better than Anonabox. However, and this is important - they are not Open Source. They TOO are only patching a binary firmware delivered by the manufacturer of the router (Gainstrong).
Putting aside the question of legality, a port scan that does not have prior authorization is pretty generally considered "impolite". As an analogy, it's certainly not illegal to touch someone else's laptop screen, and if I gesture at something and accidentally land a fingerprint on someone's screen, I'll apologize. Legality notwithstanding, it's kind of a dick move if you see me do that, to walk over and tell me I don't need to apologize to the person, and then plant your own fingersmudge right there next to mine.
In any case, if you're located inside the US, it's almost certainly a violation of your ISP's terms of service.
Frankly, it strikes me as very odd that a company that is manufacturing a product that is supposed to help maintain your anonymity and increase your security online fails to safeguard the end-user through basic security recommendations that have been around for YEARS. Would these "holes" be plugged up as a matter of course? Something doesn't add up..... Thanks for your thorough analysis, though. This makes it increasingly clear that not every company that purports to offer "anonymous" or "secure" services can or should be trusted - even if it wasn't malicious or intentional.
A generally applicable rule of thumb is that any company that claims to provide "anonymous" or "secure" services/products is untrustworthy, unless proven otherwise.
It's extremely hard to make money from perfect security/anonymity, so any commercial entity is likely to have screwed up at least something, whether intentional or not.
Color me crazy, but the odd 126 ip space kinda makes to me. Consider that one of the more common attacks on Tor users is IP leakage from the browser. In this setup the local ip would map to a real public ip, but would be entirely useless.
I personally don't think that it's a good solution. Poor operational security can't be solved by misdirection.
I still don't see the point. If there's a vulnerability that can be used to leak your LAN address, you want the leaked address to be as generic as possible. Something like "192.168.0.2" is perfect; a crazy 126.16.2.x address is unusual and could be used to fingerprint Anonabox users.
That and the semi-randomized SSID have been bugging me all day while I wrote that wiki entry. I simply can't see the logic in or reasoning behind those decisions.
There is a danger with running "just anything" over tor, which is that, ultimately, your data will be visible to the exit node. And if you run anything (like facebook, apps, etc.) over that same link, it will be very easy for the person running the exit node to tie the information to a particular person (you).
I was going to reply with a bunch of stuff about how Tor exit nodes don't terminate TLS, but I thought more about what you are saying. You're right, it's not a good idea at all to be logged into any account that de-anonymizes you in any way while using Tor, because then for the rest of that Tor session, you are potentially compromised.
Your anonymous presence and your public presence should always be 100% separate.
In general, I don't think it is a good idea to connect to multiple services over the same Tor link. One of those services could be compromised in some way (hacked, government backdoors, etc.), and could be used to de-anonymize sessions at other services, by using the ip-address of the exit-node and the time-frame in which the communication took place.
It is clear that they are lazy and a little out of their depth, but are they malicious?