Skip to main content

Security Audit of Safeplug "Tor in a Box"

Author(s): Edmundson, Anne; Simpson, Anna K; Kroll, Joshua A; Felten, Edward W

To refer to this page use:
Abstract: We present the first public third-party security audit of Pogoplug’s Safeplug device, which markets “complete security and anonymity online” by using Tor technology to protect users’ IP addresses. We examine the hardware, software, and network behavior of the Safeplug device, as well as the user experience in comparison to other forms of web browsing. Although the Safeplug appears to use Tor as advertised, users may still be identified in ways they may not expect. Furthermore, an engineering vulnerability in how the Safeplug accepts settings changes would allow an adversary internal or external to a user’s home network to silently disable Tor or modify other Safeplug settings, which completely invalidates the security claims of the device. Beyond this problem, the user experience challenges of this type of device make it inferior to the existing gold standard for anonymous browsing: the Tor Browser Bundle.
Publication Date: 2014
Citation: Edmundson, Anne, Anna Kornfeld Simpson, Joshua A. Kroll, and Edward W. Felten. "Security Audit of Safeplug 'Tor in a Box.'" In 4th USENIX Workshop on Free and Open Communications on the Internet (2014).
Type of Material: Conference Article
Journal/Proceeding Title: 4th USENIX Workshop on Free and Open Communications on the Internet
Version: Final published version. This is an open access article.

Items in OAR@Princeton are protected by copyright, with all rights reserved, unless otherwise indicated.