Anonabox Pro Review

I received a handful of emails from readers asking if I had an EDC (Everyday Carry) kit and what it contained. I decided I would refresh my kit them post an article about it but my first through was securing your Internet connection when outside of a trusted network.

WIFI you should be worried

There are literally hundreds of articles on the internet and clips from news style shows talking about the dangers of using unprotected WIFI on untrusted networks. An untrusted network is any network you don’t directly control (work, library, coffee shop, hotel, airport, etc).

Even though many sites use protected TLS connections these days, attackers can still perform Man In The Middle style attacks. They can also harvest DNS queries and do a tone of reconnaissance.

So obviously protecting your connection when out an about is critical.

Anonabox

The Anonabox has had an interesting past with a canceled Kickstarter campaign but it is one of the most recognized names in hardware WIFI VPN/TOR devices.

Anonabox offers multiple types of devices:

• Original : The original TOR gateway that had a hard coded WIFI password and required a hard-wired WAN connection. Obviously this isn’t a good device for travellers or users on the move.
• Fawkes : An updated TOR gateway that has the ability to use WIFI as for WAN and that has an admin interface to upgrade the firmware or change WIFI passwords.
• Tunneller: A VPN client (does not support TOR) that supports many third party VPN services that provide OpenVPN configuration information.
• Pro: The nec plus ultra of the Anonabox line that supports everything and has a more powerful processor. HideMyAss and VyprVPN have dedicated pre-configured screens and you get a 30 day free trial of each.

Of course I chose the Pro version to test and was excited about how it may be able to fill a gap in my everyday carry kit.

Competition

Anonabox is the most well know product but it is far from the only one. The 2 other main competitors in this space are:

• InvizBox : I have the new GO on pre-order and will test and review it when it arrives.
• Tinyhardwarefirewall : This company sells $30 mini hardware firewalls configured to work with their own VPN solution (costs about $90 a year). I have heard lots of positive comments about them but can’t seem to get my hands on one in Canada.

There are several dozen write-ups

There are several dozen write-ups of these devices on the internet and I didn’t want to write a me too article. You can go read any of those to see the interface or get a basic review.

I want to look at the more important aspects of the device.

The Anonabox main review

When configured to use TOR, The session establishment is quick and solid. Using Wireshark, I double checked that there was no DNS leaking. Any traffic that cannot be routed over TOR is blocked. This is a good thing.

Tor is good but not perfect

Now for all the talk about the wonders of TOR, I still feel it isn’t practical for the average user. Using TOR means your connection is encrypted and routed through several (3-10) different TOR nodes before it exits the TOR network and back to the internet. This means you are introducing latency (aka delay) in your internet browsing. TOR is not a good choice for any internet activity that requires fast connectivity (such as streaming). When using the Anonabox Pro with the default TOR configuration, Browsing the internet was noticeably slower introducing a 0.5-1.5 second delay in all web page loads (compared to going through the Anonabox without any security enabled).

Secured WIFI

Once you setup your device with its own password, the manual recommends you setup a secure WPA2 password for the WIFI connection (client to Anonabox) which you should do immediately. You can go in and use any WIFI password your little heart desires.

Password protected Root

When connecting to the management interface of the Anonabox via WIFI, you can add (and should add) a password for ROOT. I wish I could change the name of the Root account too but having a custom selected password is good.
IT should prevent using the same password for ROOT and your WPA2 WIFI password.

When I log into the management interface, the connection is NOT encrypted. I wish they enabled TLS when loging in.

Anonabox HideMyAss Interface

So configuring an HMA VPN is super easy. You supply your username and password and chose which of their servers you want to connect to. Therein lies the first problem.

You get this incredibly long list of servers to browse through. As an example, there are 8 separate servers for Toronto (Canada). Which one should I pick? When should I switch to another one? There is no option to choose the fastest one of the bunch.

Also many geo-restricted services detect an HMA connection and prevent streaming content (think HULU, Netflix, etc).

In all fairness, setting up an account with the 30 day trial took 2 minutes and had me up and running almost immediately. I noticed that depending on which server I chose (Toronto server since I am testing this while in Toronto), I got wildly different performance metrics. Some connections had a 25-35% speed decrease while 1 of them brought me to a snail paced connection (decreased my normal internet speed by as much as 95%). Remember that there is no automatic way to choose the best connection for a region. It’s a game of trial and error.

I have to mentioned that there are many websites that claim HMA will easily hand over customer records to authorities. HMA says their service should not be used for illegal activities but even as a law abiding citizen, I dislike the idea of my VPN provider kneeling over quickly and handing my info over.

Additionally it has been reported that HMA will block the account of any user that receives a DMCA copyright violation notice. I don’t condone illegal activities but this means they are storing too much information for my liking. Remember that some streaming sites with geolocated locks have Terms of Service that make it illegal to stream their content outside of the US, which means if you stream it, you are a pirate and could have your records turned over or account blocked.

My HideMyAss VPN connection never dropped and I felt it was easy enough for the average Joe. If you are ok with the type of logs they keep and how quickly they cooperate with law enforcement then go on.

Anonabox and VyprVPN.

VyprVPN was touted as the fasted VPN service around and I was excited to test it. I signed up within 2 minutes and was up and running with it in 3 minutes.

You have one location choice per region and the speed was good. Choosing locations relatively close meant I had consistently good performance, at least for the first hour.

Then my connection stopped working and after a couple of support requests with Anonabox and Vypr, I found out my Vypr account had been frozen. You would think an account error message would pop-up somewhere to alert you.

It seems they flagged my account for verification to avoid VPN fraud. What the heck does that mean. Right now I have about a dozen different VPN accounts with different services I use for testing (ProXPN, tunnelbear, UnlimitedVPN, etc) and I have never had this happen. They said a manual configuration was also detected and were wondering why? I could only imagine they saw the Anonabox connection as a manual configuration since I wan’t using any of their software. In order to reactivate my 30 day trial, they wanted credit card information, proof of my home address and more.

For a VPN being used on a privacy device, I felt this was a pretty bad situation. I found VyprVPN support slow (took a couple of days for my ticket to get escalated to the point where someone could tell me what was going on) and extremely rude. When I explained that I was testing the connection for a blog review and requested the 30 day trial be re-activated, they said “too bad. give us the information we need or we won’t reactive”. When I said I wouldn’t provide it “They said my request to have my account deleted was accepted and would be done shortly”.

So bottom line, Anonabox… Get rid of VyprVPN and I recommend everyone chose another provider.

You can use VPN and TOR together

Yes you can but no you shouldn’t the privacy gain is minimal and the performance connectivity is so huge, it makes the entire thing non usable.

Using the USB 2.0 port on the Anonabox Pro

The marketing claims you can plug a USB device into the Anonabox and share the contents with user.

Unfortunately there are no instructions provided in the booklet or online on how to configure it. Plus there is no configuration option in the management interface.

My guess is that this will be added with a future firmware update so we’ll have to see when it is made available.

As I write this, the latest firmware for for the Anonabox pro is version 3.9 and there is plenty of room for improvement to the interface.

WebRTC leak

Since I couldn’t use VyprVPN, I switched to HMA to test IP leaks. As mentioned above in TOR, I had not DNS leak and was happy to learn that HMA also didn’t leak DNS.

WebRTC detection listed my HMA IP address but also successfully detected my local IP (not so good).

Comparing Anonabox Pro Tor speeds with the TOR browser

I was wondering how the Anonabox pro would perform against the TOR browser (speed wise). The average speeds were close (performed 12 different tests each and used the averages). The TOR browser was always consistently faster though. I’m not sure why but could be that the Anonabox pro has a tough time keeping up with the encryption/decryption activities.

Conclusion

Positive

• I liked the small, sleek and light device. It is easy to carry everywhere and is powered by a micro-USB cable (provided in the box). This means I can hook it up to my portable battery and use it all day.
• The packaging is nice but the manual is a little too basic. I wish it had a more technical guide online for geeks.
• Setup is easy

Not so good

• The first unit I received had a WIFI connection (both its main connection and the WIFI uplink client connection die regularly). I tried everything and finally Anonabox support replaced it which fixed this issue. I won’t penalize them for this, since electronics do die and support was quick.
• No support for USB sharing yet
• TOR connection is good but not as good as the TOR client.

The bad and the ugly

• Configuring another OpenVPN service is complicated and I wasn’t able to do it. I have been in security for over 15 years and am able to setup complex firewalls so this was a bit of shocker to me.
• The preferred VPN solutions have bad privacy and confidentiality records so they aren’t preferred solutions. I wish they offered more robust privacy oriented VPN partners.
• VPN tests showed noticeable drop in download performance which is bad. When comparing this to my high end Asus router using the same VPN provider, my Asus performed much much better which leads me to believe there is an implementation issue.
• I couldn’t find instructions or a management interface option to configure .onion hosting, even though it is advertised.

The summary of the summary

I only found the Pro useful and stable when connected to the TOR network which surprised me. I really wanted to be able to use it with a good fast and privacy-enhacing VPN service.

TOR worked well every time but then again the TOR browser was consistently faster.

So overall I loved the idea. I was extremely hopeful that this device would be part of my everyday carry but sadly it won’t be.
I’m hoping someone at Anonabox will read this and push for the improvements the device needs but only time will tell.

Right now I cannot recommend the Anonabox Pro (or other variants).

I am anxious to test the Invizbox in 3-4 weeks when it ships. I am also talking to Tinyhwardwarefirewall to see if they can ship me (to Canada) a mini device for testing.

Sample of the incredibly long difficult to choose HideMyAss server list

Cleaner VyprVPN Server list

Confusing interface to configure another OpenVPN Service on the Anonabox Pro

How to thrive under pressure

Your body is a miraculous creation that is able to quickly adapt to different situations often without you even realizing it. When working in pressure situation, your body reacts by making physiological changes [for the worst] that also impact how you think. Truth is pressure is the new normal and you must learn to deal with it or it will crush you. 

Here are simple steps to help you conquer any pressure situation:

Be in the moment

As an IT professional, I have seen the effect of extreme pressure on experts handling large and complex IT outages or security incidents. Even the most expert professional can find themselves in a vortex of destruction. If I notice people going down the wrong path, I try to help them centre themselves and concentrate on this moment. 

I ask them to sit down and find an object they can concentrate on. I ask them to find a small spot on that object and to stare at it. I ask them to then be mindful of their breathing. To concentrate on long inhalations, to hold it and then to do a long exhale. I ask them to keep looking at that spot and to feel their body breathing. To feel their chest expanding and contracting.

Gratitude

When you are under stress, your body releases cortisol. This is what fuels the fight or flight response and isn't ideal when the situation requires deep thought and solid reasoning. 

Once we complete the first breathing step. I then work with the person to find out what they are grateful for. Research has shown that gratitude can reduce the level of cortisol by 23%. Even when things seem very bad, there are always things to be grateful for. Think about what is going right, even when it seems there isn't much. 

As an example, there are large forest fires in Fort McMurray right now forcing the evacuation of tens of thousands of people. It is a horrible situation but if I were a family being forced out of my house, I would also be grateful that i was with my family and they are safe. I would be thankful that I had a car that is allowing me to evacuate. You get the idea. regardless of how bad things may seem at first, there is always something to be grateful for.

Prioritize

When under extreme pressure, the situation may seem hopeless and you may lose track of what really is important. IT is important to take a step back and put things into perspective. My mantra is "this isn't brain surgery". I recommend you sit down in a quiet area and (once you have done the breathing exercise) ensure you are working on the right priorities. It is easy to get "mixed up" and focus on the wrong things when under extreme pressure. We tend to fix the thing that is the latest and loudest. 

Surround yourself with the right people

We were handling a major datacenter outage a couple of years ago and the entire tech team was struggling to figure out what was going on. As I observed the lead, I realized he was getting too stressed and was starting to make "less rational" decisions. I took him aside and guided him through the first 2 steps. Once he was calm, I asked him to perform the prioritization activity alone in an isolated room and he did an excellent job. As soon as I put him back in the control room, things started to boil over again and I realized it was partially due to the amount of technical people around him being overly pessimistic. 

I replaced to people with fresh non negative experts and realized the lead was now "more in control" and less stressed. Moral of the story is to take the time and ensure you are surrounded by the right people. If there are people being overly negative, push them away and you will see the level of pressure diminish greatly.

Take a break

You may be under pressure because you are handling a major situation or because your boss expects a major deliverable in a short window and key information may be missing. Regardless of why you are under pressure, sometimes you have to take a short break and change your mindset. Once you perform the above steps, it is also important to stop, walk away from the situation and do something that changes your mood, mindset and situation.

Let's say you are working on an important report, information is missing, people are not cooperating and your boss is breathing down your neck. You may be a little stressed. You will feel pressured to perform. Make sure you follow the above steps, then determine an interval at which you will step away from your desk and go for a short walk.

As an example, my personal limit is 45 minutes. After 45 minutes of straight undivided concentrated work, I will typically walk away for 5 minutes and do something else. The something else may be a short walk in the office, a trip to get a coffee, sit outside and take a breath of fresh air, etc.

You will be energized when you get back and be much more productive. The complaint I hear too often is I can't go because there is too much work. Research has shown that not taking these short breaks will actually hurt your productivity and the stress will also dull your abilities,

Creators of Siri to launch next generation AI assistant May 9

Siri, Google Now and Cortana launched with great fanfare. We expected great things and for the most part, they are all disappointing. Truth is none of them really lived up to our expectations.

The creators of Siri have been hard at work creating the next generation of AI, which they claim will be able to handle much more complex tasks. The new AI will be able to parse natural language queries and will be able to handle chained commands. We expect you will be able to ask it to find a flight Toronto to Los Angeles next Thursday in the afternoon priced between $300-$700. And it will be able to do all of this without kicking you out to another app. 

Integration with important services will be critical and it is expected to launch with at least 50 name brand partners from Uber to GrubHub. 

Forrester research believes consumers spend 80% of their smartphone time in as little as 5 apps. Like most of you, I have too many apps on my phone. My apps are all soloed and don't talk to each other. My smartphone doesn't really feel smart when I ask it to buy movie tickets and it sends me to an app or website. Truth be told, my phone's built in assistant is nothing more than a circus performer: fun to watch but not really helpful.

As an iPhone owner, I worry that Apple's walled garden will prevent me from being able to use the Viv technology when it is eventually made available to the public. A good strong digital assistant may be enough to persuade me to switch platforms, but for now I wait for Monday's demonstration. 

If Viv is everything we expect it to be, then it could end up owning the most lucrative platform of the future.

Are Apple's best days behind it?

Image by Dominik Fusina used under Creative Commons License

Apple stock took a tumble even though the company made boatloads and boatloads of cash last quarter. Why? Because some investors believe Apple's profitable run has lasted too long and obviously it must eventually come to an end. They saw the reduced growth rate in iPhone sales as a bad omen.

Unfortunately this is not how the world works and it isn't how statistics work. This misguided belief actually has a term and its called the "Gambler's fallacy". 

“[...] is the mistaken belief that, if something happens more frequently than normal during some period, it will happen less frequently in the future, or that, if something happens less frequently than normal during some period, it will happen more frequently in the future (presumably as a means of balancing nature).”

— Wikipedia

When a product has been such an incredibly huge success (like the iPhone), it is natural for observers to be pessimistic about the company's ability to generate another similar home run hit but... Keep in mind that Apple is supplementing its product revenue with service revenue. 

Apple had total revenue of $50B this quarter. Statistica says $6B came from services. Obviously Any other company would love to have a $6B quarterly service business. Apple is working hard to increase its share of the monthly recurring service business, which would complement its fixed-cycle product revenues nicely.

Apple has room for improvement in services like Siri, Apple Music, iCloud online, etc I think Apple maps is a great example of how they can dramatically improve a product if they put their money, people and determination behind it.

I believe (maybe mistakenly), that WWDC will be the launching platform for Apple's push into services. I believe they will challenge  Microsoft and Google head-on. Competition is always good for consumers.

So don't fall for the Gambler's fallacy and don't count Apple out just yet.  Yes Apple growth slowed slightly compared to last year but this is a blip in the radar of an otherwise healthy, innovative, tech leader. 

Would you like some malware with your dental cleaning?

“The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a law that was created to protect millions of working Americans and their family members with medical problems. ”

— American Cancer Society

Most working professionals have an association they can call their own. Dentists have the American Dental Association. The ADA represents 159,000 dentists across the USA and most received a "gift" recently in the form of a USB key with new dental codes.

It turns out of of the recipients is also technically competent and he decided to take a closer look at this "gift" (check out Mike's post on DSLReports.) Re-read that HIPAA description at the top of this post, it applied here.

He checked out the contents of this magical key and realized one of the files tries to open a bad bad webpage known for hosting malware (don't go here : http://ntkrnlpa.cn). Virustotal flags the site as bad. 12/67 detected it as badware day 1. When I asked VirusTotal to rescan the site for malware today, 13/67 detect it as bad. Symantec says the site contains threats. ScanURL recommends you not visit this site. So overall it is pretty safe (no pun intended) to assume this is a bad place and you shouldn't be wondering its streets alone.

The ADA says "some drives" contain malware and believes your antivirus should catch anything nasty on it or linked by it. Anyone involved in cybersecurity knows not to trust antivirus with their safety. Remember that out of 67 major antivirus vendors, only 13 today detect the site as malicious when it is known to be very bad. Antivirus is not a good replacement for good security hygiene. Obviously the ADA says if you haven't use this key, don't.

I don't want to be too harsh on the ADA. This isn't the first time "things" manufactured in China have been loaded as malware. In 2009, we had an outbreak of picture frames loaded with malware. 

Every time you add another step to a digital process, you add additional attack vectors and increase your risks. Instead of sending out USB keys, the ADA should have made the files available for download. By removing the USB key process:

• sending files to the Chinese manufacturer
• Infection is possible by the manufacturer of the USB keys
• infection is possible by the company that turns the keys into promotional cards
• infection is possible by the company that loads the content onto the keys using a duplication machines (which is likely how the ADA mailer was infected)

By making the files available for download, they reduce (but don't eliminate) the possible attack vectors. Additionally companies need to add much more stringent security controls around their digital product production process. I would also recommend that the ADA periodically sensitive its members on HIPAA, their obligations under HIPAA and provide guidance on good security hygiene.