XeroBank Launches Anonymizing Tool Suite

XeroBank this weekend at DefCon gave users a first peek at the newest version of xB Machine -- a broad suite of tools designed to let users do a wide range of tasks anonymously over the Web.

The xB Machine is a portable, secure computing environment, with browser, email, and chat functions, coupled with access to any anonymized Web service the user desires. The details and transactions inside each xB Machine account are protected with 256-bit AES encryption. The software also has a self-destruct sequence for nuking user data or just refreshing the system, according to Steve Topletz, a XeroBank administrator.

"This is the end of personal firewalls and antivirus software -- you no longer need to worry about which computing environment you're in." Topletz claimed. "You can put this on a flash drive and run it on virtually any operating system, without worry of compromising your IP address, or reconfiguring your software to maintain protection against viruses and bugs."

The xB Machine software is available as a free download. Topletz also offered free, one-month trials of XeroBank Plus accounts to the first 1,000 Dark Reading readers to email the company with "Dark Reading" in the subject line.

XeroBank Plus normally costs $8 a month, which includes 200 Kbit/s connectivity, anonymous Web browsing, and email. Its Pro and Premium services are more expensive at $30 and $400 a month, respectively, but offer more capabilities -- including anonymous instant messaging, voice over IP, FTP, and P2P applications. All XeroBank service users get an encrypted, offshore email account.

Applications and networks that offer anonymous, untraceable usage might be viewed as a mixed blessing. For secretive users, they are a godsend. For IT managers and security professionals tasked with monitoring end users, they may be a gigantic nightmare. Regardless, many security experts anticipate it's only a matter of time before privacy advocates, law enforcement, and legislators lock horns over the sale and use of anonymized tools.

XeroBank's Topletz doesn't see it that way. In fact, he says such products are a boon to users who are prone to sloppy computing hygiene -- and to justifiably-paranoid IT managers, who cringe each time a mobile user returns from a long trip and re-attaches to the enterprise network.

"XB Machine allows users to dirty up an OS without resetting any configurations, or bringing in viruses -- it's a disposable rubber glove for computing," Topletz told Dark Reading. "Many enterprises are looking to implement this in their IT infrastructure because it brings in so many capabilities, and it protects against Trojans and worms, which cost them both revenue and time."

Security consultant Robert Hansen, CEO of SecTheory LLC, likes the idea of having multiple browsers, emails, and/or virtual machines. "But separation of critical assets is a lot more work than people are willing to do, and it doesn't change the security model for those individual applications. It just compartmentalizes them."

Hansen also points out a potential drawback with any commercial security service. "If people have to pay for this, it isn't exactly anonymous now, is it?"

But on its Website, XeroBank says it protects the user's identity, even from XeroBank itself. "Payments made to XeroBank are anonymized from us. When an order is placed, it is assigned a transaction ID number. That transaction ID number does not have any personally identifying information attached to it. Accounts are then paid for by using a third party payment processor, who cannot share the information with XeroBank" the company says.

"When the account is paid for with our third party processor, it tells XeroBank to activate the account that has that transaction ID number, and the transaction ID number is then destroyed," the company states.

XeroBank is planning to add further capabilities to xB Machine. Topletz said the company's adding an auto updater in the next month; the company will also add financial cryptography, which enables secure anonymous banking transactions from anywhere in the world, sometime in the next three to six months.

The launch of xB Machine coincides with some recent re-branding at XeroBank. The company, formerly known as Torrify, renamed one of its flagship products to xB Browser, which many know better as Torpark, and is a modified version of Mozilla's Firefox browser. The moves were made to avoid confusion with the Tor Project, a separate entity.

"Tor" refers to "the onion router," a toolset that underpins a wide range of anonymous applications.

— Terry Sweeney, Special to Dark Reading