I'm wondering whether this is someone running a scam or whether they don't fully understand technology and some evil tech has taken them for a ride. It's that bad.
Some paraphrased/elided highlights from the article:
--
Practicality as a secure mail device:
- The TL;DR of the "unbreakable security" is that the device sends TLS-encrypted email on another nomx device listening on port 26... USING THE DEFAULT "snakeoil" Postfix TLS CERTIFICATES.
- The device sends from port 25. Or rather, it tries to - it worked for the post author, but I can personally say this would not work for me; my ISP blocks port everything outgoing on port 25.
- The device tries to relay mail from a residential IP. Predictably, all commercial email systems shut this down the moment they see it. Hotmail has the decency to actually kick the email back; other providers seem to just silently drop it.
- The device will immediately put your IP on DNS blacklists because you are sending mail that looks 100% like spam. These blacklists are used by a variety of online services so this is likely to catch up with you in a big way eventually (one thing I just wondered is whether Google checks your IP this way when deciding how complicated to make the captchas it sends you).
- When you set up a link to another nomx device (it calls this a "handshake"), you have to do it by IP address. There is no mechanism to autoupdate the remote IP (I do acknowledge such a system would be mildly nontrivial to put together, but I think this is already at the "doing it wrong" stage and this type of solution is not what is needed here).
--
Security considerations:
- The default credentials are "admin@example.com" + "password" and there is no requirement to change this upon login.
- The device is so full of vulnerabilities it's possible to pwn it by simply visiting an arbitrary malicious Web page (from any web site on the Internet) that scans your network to find the device - once that's done the malicious page can fire off a series of form submissions (probably also doable via XHR) to gain a login cookie, create a new admin user that will not be visible because the device is only capable of listing one admin, and then...
- With the device pwned, it's possible to take it over completely, create arbitrary incoming email addresses, and attempt to send mail from the device, from your IP. Your computer doesn't even need to be on for this to work, obviously. I say attempt to send mail because most of it will be blocked, but you could easily take someone down by sending highly offensive mail to a provider that let the email through - bam, your IP is on file as having sent the email.
- Thunderbird required repeated manual verification of the device's TLS certificate (something the device purports not to require!).
--
Software versions:
- Raspbian GNU/Linux 7 (wheezy) - last updated 7th May 2015
- nginx version: nginx/1.2.1 - released 5th June 2012
- PHP 5.4.45-0+deb7u5 - released 3rd September 2015
- OpenSSL 1.0.1t - released 3rd May 2016
- Dovecot 2.1.7 - released 29th May 2012
- Postfix 2.9.6 - released 4th February 2013
- MySQL Ver 14.14 Distrib 5.5.52 - released 6th September 2016
The author received no response to his requests for updated versions of the software.
The device also has no autoupdate mechanism, and there is also no mention of such a mechanism being in development.
--
Other thoughts:
- The device uses GoDaddy for dynamic DNS. I'm curious why this is so bad; is it because GoDaddy DNS doesn't update rapidly?
- This kind of reminds me of http://thedailywtf.com/articles/The-Expert-System