4 ms·

There's an easy way to fix the Web RTC Leak issue network wide: Use a VPN on your Router so your network clients literally don't know their "real" ip and theref

by dtx1 6y ago

There's an easy way to fix the Web RTC Leak issue network wide: Use a VPN on your Router so your network clients literally don't know their "real" ip and therefore can't leak it. Same thing works for TOR. In my experience OpenWRT and an Wireguard VPN Provider works best

alex_duf 6y ago
I don't think it was a WebRTC issue, I think they crafted a video such that the decoder would end up executing code. Similar to what happen to Jeff Bezos.
- mikece 6y ago
  Even so, wouldn't running Tails on a VPN have only exposed the IP address of the VPN connection?
- stefan_ 6y ago
  The point is that you can't have the Tails machine decide what connections are proxied through Tor and which are not. If you have an external device like a router or a Raspberry that transparently tunnels the data, a compromise of the Tails machine can't trivially expose your real network connection.
  - schoen 6y ago
    One thing that I've thought about this is that whether you do the firewalling on the end-user device or on another device, the firewall will normally permit connections to every Tor guard. That means that if an attacker can make the device make a "special" TCP connection of any kind (e.g. just an HTTP request) to an arbitrary IP address and port number, it could make that connection to an actual Tor guard node run by an affiliate of the attacker. Then the attacker can distinguish that connection from other Tor activity because it isn't Tor traffic. The point of that is to say that "only allowing the machine to talk to Tor nodes" wouldn't stop an exploit from effectively bypassing Tor—by talking in a slightly unusual way to an adversary-controlled Tor node! If they're not already doing it, it might be safer for Tails to learn the specific guard that its copy of Tor is using at a particular time, and only allow outbound traffic to that guard rather than to any Tor node. (Another precaution which they might already be taking: only the Tor daemon process should be able to open remote sockets at all.)
novok 6y ago
In that case you are swapping one ISP for another. You would need a small botnet to act as your proxy provider set to make it harder to find you.
- _emacsomancer_ 6y ago
  Depending on where you live and who you use for a VPN, you're at least swapping a known bad-agent ISP for a potentially non-bad-agent ISP.
- dtx1 6y ago
  Thats always the, excuse my french, bullshit reaction i see here and is ignoring several important facts: 1. Since you share your vpn exit IP with several users, sometimes hundreds, it becomes harder for any website or service you use to track you by IP alone. 2. My ISP is mandated by law to save all my browsing data (germany here, this law changes every two month but you can assume they all log anyway). My VPN Provider is not mandated and has at least some incentive to not log any data. Cost and Reputation beeing the main ones. 3. I can for example have all my torrents exit in a country where filesharing is not illegal, making any persecution much less likely, same for other laws that are not the same everywhere.
  - novok 6y ago
    Yes it increases the $$$ barrier to get you, but when your this level of criminal where they make custom 0days just for you, it's doubtful they would find subpoenaing the VPN providers to find out which customer they are much of a barrier too. Many paid VPN providers in the past have also shown no problem secretly selling out their customers too. That is why I say rotating botnet, because there is nobody to subpoena and it would require even more $$$. When your that level of criminal, might as well go all the way.
resfirestar 6y ago
Ideally Tor users should use something like the Whonix approach: two VMs are set up, a gateway for connecting to the internet and a workstation the user browses from. The gateway sets up the Tor connection, and the workstation is on a restricted virtual network that can only connect to the gateway.
eeZah7Ux 6y ago
A VPN does not provide better protection than Tor. If anything, is far less. In both cases you need the tor daemon or the VPN software to be outside of the host running Tails.
zemnmez 6y ago
if you're dealing with a major corporation paying six figures for a novel exploit to be developed specifically so a national intelligence agency can catch you, i think going to all the effort of preventing disclosure of your IP address by this method is somewhat plugging a hole in a sieve

by dtx1 6y ago

alex_duf 6y ago

I don't think it was a WebRTC issue, I think they crafted a video such that the decoder would end up executing code. Similar to what happen to Jeff Bezos.

mikece 6y ago
Even so, wouldn't running Tails on a VPN have only exposed the IP address of the VPN connection?
stefan_ 6y ago
The point is that you can't have the Tails machine decide what connections are proxied through Tor and which are not. If you have an external device like a router or a Raspberry that transparently tunnels the data, a compromise of the Tails machine can't trivially expose your real network connection.
- schoen 6y ago
  One thing that I've thought about this is that whether you do the firewalling on the end-user device or on another device, the firewall will normally permit connections to every Tor guard. That means that if an attacker can make the device make a "special" TCP connection of any kind (e.g. just an HTTP request) to an arbitrary IP address and port number, it could make that connection to an actual Tor guard node run by an affiliate of the attacker. Then the attacker can distinguish that connection from other Tor activity because it isn't Tor traffic. The point of that is to say that "only allowing the machine to talk to Tor nodes" wouldn't stop an exploit from effectively bypassing Tor—by talking in a slightly unusual way to an adversary-controlled Tor node! If they're not already doing it, it might be safer for Tails to learn the specific guard that its copy of Tor is using at a particular time, and only allow outbound traffic to that guard rather than to any Tor node. (Another precaution which they might already be taking: only the Tor daemon process should be able to open remote sockets at all.)

novok 6y ago

In that case you are swapping one ISP for another. You would need a small botnet to act as your proxy provider set to make it harder to find you.

_emacsomancer_ 6y ago
Depending on where you live and who you use for a VPN, you're at least swapping a known bad-agent ISP for a potentially non-bad-agent ISP.
dtx1 6y ago
Thats always the, excuse my french, bullshit reaction i see here and is ignoring several important facts: 1. Since you share your vpn exit IP with several users, sometimes hundreds, it becomes harder for any website or service you use to track you by IP alone. 2. My ISP is mandated by law to save all my browsing data (germany here, this law changes every two month but you can assume they all log anyway). My VPN Provider is not mandated and has at least some incentive to not log any data. Cost and Reputation beeing the main ones. 3. I can for example have all my torrents exit in a country where filesharing is not illegal, making any persecution much less likely, same for other laws that are not the same everywhere.
- novok 6y ago
  Yes it increases the $$$ barrier to get you, but when your this level of criminal where they make custom 0days just for you, it's doubtful they would find subpoenaing the VPN providers to find out which customer they are much of a barrier too. Many paid VPN providers in the past have also shown no problem secretly selling out their customers too. That is why I say rotating botnet, because there is nobody to subpoena and it would require even more $$$. When your that level of criminal, might as well go all the way.

resfirestar 6y ago

Ideally Tor users should use something like the Whonix approach: two VMs are set up, a gateway for connecting to the internet and a workstation the user browses from. The gateway sets up the Tor connection, and the workstation is on a restricted virtual network that can only connect to the gateway.

eeZah7Ux 6y ago

A VPN does not provide better protection than Tor. If anything, is far less. In both cases you need the tor daemon or the VPN software to be outside of the host running Tails.

zemnmez 6y ago

if you're dealing with a major corporation paying six figures for a novel exploit to be developed specifically so a national intelligence agency can catch you, i think going to all the effort of preventing disclosure of your IP address by this method is somewhat plugging a hole in a sieve