Penetration Test Report (PrincetonUni): Princeton University   Safeplug

Security Audit of Safeplug “Tor in a Box”
AnneEdmundson AnnaKornfeldSimpson JoshuaA.Kroll
PrincetonUniversity PrincetonUniversity PrincetonUniversity
annee@cs.princeton.edu aksimpso@cs.princeton.edu kroll@cs.princeton.edu
EdwardW.Felten
PrincetonUniversity
felten@cs.princeton.edu
Abstract hardware, software, network behavior, and usability of
thedevice. Thefollowingaresomeofourfindings:
We present the first public third-party security audit of
Pogoplug’s Safeplug device, which markets “complete
securityandanonymityonline”byusingTortechnology • The Safeplug functions as a HTTP proxy for the
toprotectusers’IPaddresses.Weexaminethehardware, browser,whichthenusesTorforoutgoingtraffic.
software, and network behavior of the Safeplug device, • Despite the use of Privoxy as an ad-blocker, the
as well as the user experience in comparison to other Safeplug does nothing to prevent users’ browsers
formsofwebbrowsing. AlthoughtheSafeplugappears from collecting both first- and third-party tracking
to use Tor as advertised, users may still be identified in cookies,allowinguserstobede-anonymizedacross
ways they may not expect. Furthermore, an engineer- websitesdespitethepresenceofTor[27].
ing vulnerability in how the Safeplug accepts settings • Safeplug users are vulnerable to a Cross-Site Re-
changeswouldallowanadversaryinternalorexternalto questForgery(CSRF)attackthatallowsanattacker
auser’shomenetworktosilentlydisableTorormodify externaltotheirhomenetworktomodifytheSafe-
otherSafeplugsettings,whichcompletelyinvalidatesthe plugsettings (includingsilentlyturning offtheuse
securityclaimsofthedevice. Beyondthisproblem, the ofTor).
user experience challenges of this type of device make • Amalicioususerwithinthenetworkcanmodifythe
it inferior to the existing gold standard for anonymous Safeplug settings without notifying any other de-
browsing: theTorBrowserBundle. vicesonthenetwork.
• TheSafeplughasahigherwebrequestlatencythan
thatoftheTorBrowserBundle.
1 Introduction
• The use of the Safeplug provides less protection
thantheuseoftheTorBrowserBundle.
PrivacyontheInternetisbecomingincreasinglyimpor-
tantasusersrealizehowvulnerabletheyaretotracking,
surveillance,andtheftoftheirdata. ArecentPewstudy Pogoplugmadeuseofgoodsecurityprinciplesbyus-
listedcompromisedemails/accounts, harassment, stolen ing auditable open source software on their device, and
Social Security Numbers, bank information, and credit hasthelaudablegoalofmakingonlinesecuritythestan-
cardnumbersassomeoftheresultsofonlinevisibility; dardformoreusers. However,thereareothertechnolo-
according to the study, 86% of Internet users have tried giesavailablethataimtoprovidethesamefunctionality,
to become more anonymous online [26]. Despite this, suchastheTorBrowserBundle,whichcanbeusedfree
usersdonotbelievethattheyhavethetoolstosolvethis ofcharge. InordertodetermineiftheSafeplugprovides
problem. value to users, we measure the privacy implications be-
InDecember2013,thecloudstoragecompanyPogo- tween the different technologies. We show that there is
plug released the Safeplug, a small box that plugs into little reason to use the Safeplug over the Tor Browser
a user’s home router. It claims to: conceal your iden- Bundle; in addition to the Tor network technology used
tity, hide where you live, shield your surfing habits, intheSafeplug,theTorBrowserBundlecontainsprotec-
and make you anonymous online by routing all traffic tionsagainsttrackingcookiesandfingerprinting,making
through Tor [25]. We conducted the first public third- itanimprovementovertheprivacyofferingsoftheSafe-
party security audit of the Safeplug by analyzing the plug.
1
toconnecttoviaTor. Theseconfigurationfilesareread
Table 1: Software and the corresponding version num-
by the scripts in /opt/xce/etc/init.d which enable
bersontheSafeplugasofMay2014.
Lighttpd, Privoxy, and Tor. As expected, Privoxy looks
at the tor, ad-block and exceptions configurations,
SafeplugSoftware Version Date UpToDate
and Tor reads the sp.conf file to determine thecorrect
LinuxKernel 2.6.31.8 2009 No Torconfigurationfile(regular,relay,orexitrelay).
LighttpdWebServer 1.4.33 2013 No
PrivoxyProxy 3.0.21 2013 Yes 3 Usability
Tor 0.2.3.25 2012 No
Several aspects of the user experience of the Safeplug
Dropbearsshd v0.52 2008 No
alsoaffectthesecurityofthedevice.
3.1 Information Prior to Using the Device:
2 DesignandOperationofSafeplug
TermsofService
Safeplug[25]offersanyusertheoptionofusingTor[12] The Terms of Service (TOS) are never presented to the
without having to know about it or how it works. It al- user: they aren’t presented in the Safeplug package or
lows users to browse the web from their own standard shownduringtheactivationprocess, andareonlyavail-
webbrowserwithcompletesecurityandanonymity,and able through a small link at the bottom of the Safeplug
it costs $49. Safeplug offers Tor out of the box, with website[25].
no additional software installation, by sitting between a One of the topics the TOS discusses is the use of
user’srouterandtheInternet[28].Pogoplug’smarketing open source software. A standard term of many open
pitchcentersaroundtheprotectionofusers’IPaddresses source licenses states that a company that uses the
byusingTor[16]. open source software must list the software used and
its license, as well as the open source code of their
2.1 SoftwareontheSafeplug own software that uses the license. The TOS con-
tains a link to a page that would supposedly com-
Table 1 shows the software used by the device, the cor- ply with this requirement: http://pogoplug.com/
respondingversionofthesoftware, thedateofthatver- home-en-developers-open-source.html, but the
sion’s release, and if it is up to date as of May 2014. link is dead; instead, the reader sees a 404 error [25].
There are many known vulnerabilities in the pieces of There is an open source page at http://pogoplug.
softwarethatarenotuptodate[5,3,4]. com/opensource, which describes several pieces of
This software executes the proxying through Tor and softwareusedbytheSafeplug;however,thereisnoway
ad-blocking functions via Tor and Privoxy, while the tofindthispagefromtheTermsofServiceortheSafe-
Lighttpd server allows users to modify settings via a plugwebsite.
JavaScript-generated POST request to a shell script,
xspctrl, running via CGI. The CGI handler copies a
3.2 ActivationandSetup
number of environment variables, and then forks and
runs xspctrl via execve (in the constructed envi- First, we activated the device by following simple in-
ronment). xspctrl contains a method for each set- structions. Next, wefollowedtheconfigurationinstruc-
tingschange;thesemethodsexecuteanynecessarySafe- tionsbasedonourspecificplatformandbrowser(theop-
plug binary files (go update, go upgrade, go sshd, or tionsareshowninTable2)tosetuptheSafeplugasour
go updateexceptions)andthenreturnaHTTPresponse. browser’sHTTPproxy. Thelaststepwastomodifythe
settings;thispageisshowninFigure1. WecanturnTor
on/off, turn ad-blocking on/off, and turn Tor relay node
2.2 ConfigurationontheSafeplug
abilityon/off(andifon,anadditionaloptionappearedto
The Safeplug configuration files can be found in allowthedevicetobeanexitrelay).Additionally,wecan
/opt/xce/etcandincludesp.conf,sp_version,and specify“white-listed”domainsthatwillbeconnectedto
sp_torexceptions.Thefirstcontainsalloftheconfig- directly even if Tor is turned on, without going through
urationdetails:whethertouseTor,whethertoblockads, theTornetwork.
andwhethertoactasaTorrelayorexitrelay. Thever- It is important to note that there is no explanation of
sion file is used during the call to check for updates in relay or exit nodes. Using Safeplug as an exit node has
thexspctrlscript,andtheexceptionsfileisusedbythe possible legal repercussions. As an exit relay, all traffic
Privoxyconfiguationtocontrolthewhitelistofsitesnot that exits the node can be traced back to the Safeplug’s
2
Platform Browsers sions;theywerebothnewsessionswithnocookies. One
of the sessions used the ad-block feature of the Safe