6 ms·

Sounds like, if you're going to do something very sensitive on tor, you need to: - always have an update to date version of tor bundle! - compile the bundle y

Sounds like, if you're going to do something very sensitive on tor, you need to: - always have an update to date version of tor bundle! - compile the bundle yourself from source - run it virtually, and always roll back to a clean snapshot (before installing it tor) when done - if possible use from a network that is not your own (open wifi, public wifi, etc.) - spoof your mac address - do not run JS, Java applets, etc.! I know this seems extreme, but from what I read, it's the best you can do to protect yourself.

bryze 13y ago
Yeah, I was wondering if a virtual machine is safe from malicious attacks, though. Can anyone comment on the feasibility of this method as fail-safe?
- shabble 13y ago
  Ideally you'd want to be running Tor with transparent proxying of all traffic on a physically separate (and locked down) host. I believe there are guides on how to do all that on a raspberry pi out there. On your primary browsing/whatever machine, I believe (but have not exhaustively researched) that it would still make sense to run inside a VM/container, because that would provide a much more 'generic' set of system characteristics (MAC address, clock jitter stats, CPUinfo, etc) than your actual hardware. It does provide a greater attack surface, so you'd have to weigh up the value of potentially masking physical identity vs likelihood of gaining root due to VM exploits. There's also the risk of overconfidence because of these measures, which might lead you to overlook important details in the host OS, or in your communication habits.
  - sirsar 13y ago
    Another option is to run an amnesiac OS on a material that is not re-writable (CD-R). Note this would replace the VM, not the separate Tor machine.
- sitkack 13y ago
  There are plenty of ways to breakout of a VM. What if the VM has a filesystem that is readonly by the host? Drive by download, cookie fs drop, etc. Attack the indexing server, file previews, etc. You really want to run the VM on an external host like a raspberry pi and the VM should different than the host running Tor. Tor should really be rewritten in a Coq proven Haskell program.
pyre 13y ago
It's probably the best you can do, but it still doesn't prevent your anonymity from being compromised. As soon as the malware is installed, it can phone home, even if you end up wiping it after you are done.
- sitkack 13y ago
  The malware would have to escape the virtual machine. The VM needs to be firewalled off from the host and NOT have the host <=> guest tools installed.
  - pyre 13y ago
    Ok. So what you're talking about is a VM that is only able to route to the internet via Tor, so it would be impossible for it to make a non-Tor connection (thereby compromising anonymity). - If the host <=> guest tools are installed on the guest host, then it would be possible for the malware to install them itself. - If the host <=> guest tools can't be enabled/disabled on a per-VM basis, then that could be an issue, as you would probably have VMs that you wish to use in a less convert capacity. - The malware would have access to your browser for the duration of that session. Presumably any information that you accessed during that session is compromised. If they are consistently able to compromise you during every session, then any slip-up with PII during any session could compromise you.
    - sitkack 13y ago
      I meant specifically that the VM should have low privs when it comes to the host, it shouldn't be able to port scan, map drives, the host MAC can be found via ARP. Just thinking about what happens when the NSA p0wns the OS running the Tor browser. (vm-tor-net (vm-tor-browser)) Even if the gui VM that is used for running Tor has been compromised it should still be impossible to determine where the Tor client node is running. That is goal right?
    - wizardishungry 13y ago
      Here's an openbsd VM with tor and a bunch of web browsers preinstalled. There's packet filter rules so even if the vagrant user gets owned, it cannot transmit traffic on the outboard network interface. https://github.com/WIZARDISHUNGRY/openbsd-hiddenfortress https://github.com/WIZARDISHUNGRY/openbsd-hiddenfortress
chakalakasp 13y ago
If you are doing something that would make the NSA interested in you (and I would highly highly discourage that), you'd need to focus more on tradecraft. Get the laptop from a source that can't be traced to you, like a thrift store in a city where you don't live or normally frequent. Disguise yourself, pay in cash, and either make sure there are no security cameras or wait a good year before you do whatever you are going to do (nobody keeps camera data longer than that). When you do whatever you are doing, use a Live CD like tails. Disguise yourself. Wear gloves. Go to a city you don't live in or frequent regularly, and only use cash during the trip. Park a long distance from your wifi source where there are no cameras and walk to where you will access the wifi. Use a cantenna to hit an open wifi some distance away, preferably a public connection like a busy coffee shop. Do whatever you are going to do. Walk back to your car, drive to a nearby town, smash the laptop and dispose of in a dumpster. Drive home.
- blake8086 13y ago
  This is such random advice. What threats are you defending against here? "Wear gloves": Why? Are you thinking someone will pierce the veil of all these other precautions but then be stymied when they find a smashed laptop with no fingerprints on it? "Sir, we followed him for a year, watched him buy a laptop and use it in a park, but when we recovered the laptop from the dumpster, there were no fingerprints on it!" "Curses, our plan is foiled!"
  - chakalakasp 13y ago
    They find your smashed lappy in the dumpster. "Oh, look, his fingerprints are all over it". There is no national DNA database outside of the penal system (yet) so your dandruff won't do you in. But a print will, if you've ever done something that got you into NCIC. The idea is not to foil people who suspect you, it's to to keep them from suspecting you in the first place. If you are a NSA targeted suspect and you did something naughty, you've already lost the game.
    - blake8086 13y ago
      Who is "they", why do "they" even suspect the dumpster? "They" find fingerprints on it, and no hard drive (you used Tails, remember?) So after all that work, you link a guy to touching a smashed laptop. Not very helpful.

bryze 13y ago

Yeah, I was wondering if a virtual machine is safe from malicious attacks, though. Can anyone comment on the feasibility of this method as fail-safe?

shabble 13y ago
Ideally you'd want to be running Tor with transparent proxying of all traffic on a physically separate (and locked down) host. I believe there are guides on how to do all that on a raspberry pi out there. On your primary browsing/whatever machine, I believe (but have not exhaustively researched) that it would still make sense to run inside a VM/container, because that would provide a much more 'generic' set of system characteristics (MAC address, clock jitter stats, CPUinfo, etc) than your actual hardware. It does provide a greater attack surface, so you'd have to weigh up the value of potentially masking physical identity vs likelihood of gaining root due to VM exploits. There's also the risk of overconfidence because of these measures, which might lead you to overlook important details in the host OS, or in your communication habits.
- sirsar 13y ago
  Another option is to run an amnesiac OS on a material that is not re-writable (CD-R). Note this would replace the VM, not the separate Tor machine.
sitkack 13y ago
There are plenty of ways to breakout of a VM. What if the VM has a filesystem that is readonly by the host? Drive by download, cookie fs drop, etc. Attack the indexing server, file previews, etc. You really want to run the VM on an external host like a raspberry pi and the VM should different than the host running Tor. Tor should really be rewritten in a Coq proven Haskell program.

pyre 13y ago

It's probably the best you can do, but it still doesn't prevent your anonymity from being compromised. As soon as the malware is installed, it can phone home, even if you end up wiping it after you are done.

sitkack 13y ago
The malware would have to escape the virtual machine. The VM needs to be firewalled off from the host and NOT have the host <=> guest tools installed.
- pyre 13y ago
  Ok. So what you're talking about is a VM that is only able to route to the internet via Tor, so it would be impossible for it to make a non-Tor connection (thereby compromising anonymity). - If the host <=> guest tools are installed on the guest host, then it would be possible for the malware to install them itself. - If the host <=> guest tools can't be enabled/disabled on a per-VM basis, then that could be an issue, as you would probably have VMs that you wish to use in a less convert capacity. - The malware would have access to your browser for the duration of that session. Presumably any information that you accessed during that session is compromised. If they are consistently able to compromise you during every session, then any slip-up with PII during any session could compromise you.
  - sitkack 13y ago
    I meant specifically that the VM should have low privs when it comes to the host, it shouldn't be able to port scan, map drives, the host MAC can be found via ARP. Just thinking about what happens when the NSA p0wns the OS running the Tor browser. (vm-tor-net (vm-tor-browser)) Even if the gui VM that is used for running Tor has been compromised it should still be impossible to determine where the Tor client node is running. That is goal right?
  - wizardishungry 13y ago
    Here's an openbsd VM with tor and a bunch of web browsers preinstalled. There's packet filter rules so even if the vagrant user gets owned, it cannot transmit traffic on the outboard network interface. https://github.com/WIZARDISHUNGRY/openbsd-hiddenfortress https://github.com/WIZARDISHUNGRY/openbsd-hiddenfortress

chakalakasp 13y ago

If you are doing something that would make the NSA interested in you (and I would highly highly discourage that), you'd need to focus more on tradecraft. Get the laptop from a source that can't be traced to you, like a thrift store in a city where you don't live or normally frequent. Disguise yourself, pay in cash, and either make sure there are no security cameras or wait a good year before you do whatever you are going to do (nobody keeps camera data longer than that). When you do whatever you are doing, use a Live CD like tails. Disguise yourself. Wear gloves. Go to a city you don't live in or frequent regularly, and only use cash during the trip. Park a long distance from your wifi source where there are no cameras and walk to where you will access the wifi. Use a cantenna to hit an open wifi some distance away, preferably a public connection like a busy coffee shop. Do whatever you are going to do. Walk back to your car, drive to a nearby town, smash the laptop and dispose of in a dumpster. Drive home.

blake8086 13y ago
This is such random advice. What threats are you defending against here? "Wear gloves": Why? Are you thinking someone will pierce the veil of all these other precautions but then be stymied when they find a smashed laptop with no fingerprints on it? "Sir, we followed him for a year, watched him buy a laptop and use it in a park, but when we recovered the laptop from the dumpster, there were no fingerprints on it!" "Curses, our plan is foiled!"
- chakalakasp 13y ago
  They find your smashed lappy in the dumpster. "Oh, look, his fingerprints are all over it". There is no national DNA database outside of the penal system (yet) so your dandruff won't do you in. But a print will, if you've ever done something that got you into NCIC. The idea is not to foil people who suspect you, it's to to keep them from suspecting you in the first place. If you are a NSA targeted suspect and you did something naughty, you've already lost the game.
  - blake8086 13y ago
    Who is "they", why do "they" even suspect the dumpster? "They" find fingerprints on it, and no hard drive (you used Tails, remember?) So after all that work, you link a guy to touching a smashed laptop. Not very helpful.