Ars tests ExoNet, the personal VPN that takes you home

[Reefa]

A hardware-based two-factor VPN that connects to your home LAN for Web privacy.

There has been a lot of interest—and a lot of skepticism—generated by privacy-oriented Internet gadgets recently. Many of them have focused on using Tor to anonymize network traffic completely, using inexpensive pocket routers and open-source software. But some of these projects have failed to launch or (like Anonabox and Torfi) have been outright pulled by the crowdfunding sites they were offered on, for a number of reasons—including serious doubts about whether they actually were secure, or if they were even products.

One hardware-based approach to privacy currently in development takes a different tack. Rather than relying on Tor's anonymizing network, ExoNet and ExoKey—a pair of devices from a four-year-old Santa Barbara-based startup called x.o.ware—create an encrypted personal virtual private network back to the user's home network to evade eavesdropping on untrusted Wi-Fi networks and secure traffic all the way back to a trusted exit. The result is, in theory, a fully private connection that provides the same level of security and privacy as you'd have working from your own home or business LAN—or, possibly, from one set up somewhere you're less likely to be packet-sniffed. And at just over $100 for the pair (the ExoNet will be $65, and the ExoKey will be $39), they will be price-competitive with some commercial VPN services and probably well worth the time you'd save by not having to configure and administer your own home office VPN.

Ars received a prototype of x.o.ware's hardware and beta software to determine whether the technology at the heart of the product, which is expected to start shipping some time this year, lived up to its promise. While the system is still in development, and there are still some fit and finish issues that need to be addressed before the products ship, I found that ExoNet and ExoKey were (in the most recent iteration of the early release software and firmware) fairly painless to set up and use. And they did a good job of protecting Web browsing sessions without the performance overhead of anonymizing networks. I did find some bugs along the way, which x.o.net is addressing and should be resolved in the shipping product.

There's no place like home

There are a number of reasons to use VPNs, and not all of them are a good fit for the ExoNet and ExoKey. You're not going to get the speed of a commercial VPN service for file downloads and the like. And traffic is still going to be visible when it leaves whatever "trusted" network the ExoNet is hosted on, so it will still be associated with your ISP account. On the other hand, if you're concerned about the privacy of using an Internet connection at a coffee shop, a hotel, an airport, or from work, x.o.ware's hardware could be what you need. And if you're running a small or midsized business' network and want a dead-simple way to support remote users' access to intranet and software-as-a-service sites that can only be reached from the work LAN, ExoNet and ExoKey could be the answer.

The technology behind ExoNet and ExoKey is called VPEx, or "Virtual Private Exonetwork." It creates a direct tunnel back to a local LAN, with the ExoNet acting as a gateway on the local network and the ExoKey as a remote client. While it's a little larger than a quarter, the ExoKey is more than just a hardware token—it's a full system-on-a-chip that handles encryption and key management.

When the ExoKey's software is installed (which currently supports Windows and Mac OS X), it is treated as a network adapter through which all network traffic bound to addresses outside the local physical network the PC is attached to is routed, and it performs all encryption and authentication of data before it's forwarded to the gateway over the Internet. The ExoNet decrypts the traffic and forwards it along as normal LAN and Internet traffic.

The ExoNet gateway can be plugged in to your network in a number of ways. The easiest way is to just plug it into your LAN and have it obtain an IP address dynamically—this just requires a single Ethernet connection and minimal configuration. However, if you'd rather not have the device inside your LAN for any particular reason—for security reasons, you might block IP traffic on the ports used by ExoNet's VPN, for example—it can be plugged in in-line between a broadband modem and a home or office router (if, and only if, your ISP dynamically assigns your network's IP address).

When an ExoNet is configured, it registers itself by default with x.o.ware's dynamic DNS service to obtain an Internet host name. If you've already got a dynamic DNS service, you can choose to register it with your own provider; alternatively, if you have a static IP address, you can use your own DNS service.

ExoNets and ExoKeys are "paired" before use via a physical USB connection. This allows a direct exchange of AES encryption keys, so there's no over-network key exchange required. Instead, when connecting over the Internet, the devices verify each other through an Encapsulated Security Payload protocol, exchange and verify certificates, and then establish a direct 256-bit AES encrypted virtual private network connection. Multiple ExoKeys can be paired with each ExoNet, and vice-versa—which means you can support multiple remote users from your home network via an ExoNet or keep multiple ExoNets set up on various trusted networks.

The VPN is created using the ExoKey client software, which currently supports Windows (Vista, 7, and 8.x) and Mac OS X (10.5 and after). The software recognizes the ExoKey and prompts for a password specific to the key itself; then it presents a list of paired ExoNet gateways to connect to, each also protected by their own passwords. If you lose your ExoKey, it can be unpaired from the ExoNet's administrative interface—ensuring that it can't be used if it has fallen into someone else's hands, regardless of whether they have the pair of passwords required.

The strengths of the ExoKey and ExoNet are fairly straightforward—they separate the whole business of key management from the computers they connect, keeping them out of user space and out of the hands of attackers. And they provide a two-factor authentication system for VPN connections that is much more cost-effective than, say, installing RSA SecurID on your home or small office network.

Theory and practice

I encountered some minor issues during configuration with the prototype ExoKey and ExoNet that x.o.ware's team says will be ironed out before launch. One required a simple workaround: antivirus software on our Windows 8.1 test machine prevented installation of the ExoKey software driver because it was quarantined as malware. Briefly disabling the antivirus during installation fixed that, and subsequent scans didn't flag the drivers; that said, it's something that obviously has to be addressed at some point.

ExoKey's network driver software is supposed to route all HTTP and other Internet requests through the encrypted VPN once it's established. Local physical LAN traffic (to things like shared printers, network file shares, and the like) are passed untouched to the Wi-Fi or Ethernet adapter providing the physical network connection.

During testing, however, I found that there were some issues with the OS X version of ExoKey when running on OS X 10.10 (Yosemite). Because of the way OS X handles networking, DNS requests for websites were being passed in the clear over the host network instead of being routed through the VPN (even though HTTP requests were being encrypted).

As a result, someone monitoring local Wi-Fi traffic would see the DNS requests for websites and Internet services being connected to by the user—which while not exposing the content of those connections, could pose a privacy issue. This problem didn't occur on the Windows version. I shared a packet capture of the traffic with x.o.ware's engineering team, and it's being addressed.

In theory, given a fast enough broadband connection on both ends, the ExoNet and ExoKey can provide up to 9 megabits per second of throughput. I conducted a number of tests in the lab and remotely, using different local Wi-Fi networks for initial tests, as well as a remote ExoNet gateway in x.o.ware's office. Then I took the ExoKey on the road for some real-world testing.

In the lab, I came fairly close to the advertised cap, hitting about 8 megabits per second in direct downloads. Internet download speeds, however, were a bit slower via the VPN, as expected. Connecting from a nearby Wi-Fi network on the same ISP to my Comcast Business-connected ExoNet yielded a SpeedTest result of 2 megabits per second upstream and 3.02 megabits per second down; a connection to an ExoNet on a network connected via Cox Internet in Los Angeles actually performed slightly better. The worst was connecting home via a hotel Wi-Fi connection in Albany, New York: 0.9 megabits/second down, 0.4 up.

These speeds, however, were considerably faster than Tor connections from the same networks. And they also provided access to local resources on the LANs they were connected to—I was able to send documents to my networked printer on my lab network from a remote ExoKey connection, as well as some other HTTP resources on the lab network—as long as the local network I was connected to had a different private IP address range than the one I was connecting to. When they were the same, the traffic got routed locally instead—and went nowhere.

If x.o.ware is able to address some of the problems that remain before the release of ExoKey and ExoNet, I believe they'll be a very attractive security solution for small businesses who are concerned about employees inadvertently sharing secrets while working from public networks. The price of the pair of devices might also attract some more privacy-minded consumers, and the relatively low cost of ExoKeys could make them an interesting way for people to provide very personalized privacy to friends and family. I'm looking forward to kicking the tires on the final products when they ship, alongside other privacy-focused network gadgets like PORTAL and InvizBox.

http://arstechnica.com/information-technology/2015/03/ars-tests-exonet-the-personal-vpn-that-takes-you-home/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+arstechnica/index+%28Ars+Technica+-+All+content%29