Anonymity, Tor and Your Browser
I often use Tor for anonymous web browsing; mostly when investigating malware distribution sites. Most people configure their browser so that it proxies HTTP via Privoxy to the Tor network. At that point, Tor is doing your DNS resolutions and also hides your TCP connections from preying eyes. Or at least, so one would think. There are many ways in which an adversary can trivially circumvent this setup. For example, if we configure the browser to proxy only HTTP, a malicious web page can easily open an HTTPS connection and reveal your IP address. Things get much worse when scripting languages such as Javascript, Flash or Java come into play. Flash can open raw sockets and learn a lot about your local environment.
To prevent information leakage, we ideally would run a virtual machine that tunnels all traffic via Tor, such as the VirtualPrivacyMachine. However, if you do not want to go through all that trouble, Systrace can come to the rescue. For investigations, I run Firefox under Systrace with a systrace policy that allows connections only to Privoxy. All other connections attempts are denied and logged. It is interesting to see how many connections Firefox tries to do all by itself that do not go via the proxy. There are update pings, and all kinds of other connections.
In this case, Systrace is not being used against an adversary but rather against an untrusted application. It works quite nicely at that, too.
To prevent information leakage, we ideally would run a virtual machine that tunnels all traffic via Tor, such as the VirtualPrivacyMachine. However, if you do not want to go through all that trouble, Systrace can come to the rescue. For investigations, I run Firefox under Systrace with a systrace policy that allows connections only to Privoxy. All other connections attempts are denied and logged. It is interesting to see how many connections Firefox tries to do all by itself that do not go via the proxy. There are update pings, and all kinds of other connections.
In this case, Systrace is not being used against an adversary but rather against an untrusted application. It works quite nicely at that, too.
The Name of the Wind by Patrick Rothfuss is one of the best fantasy books that I have read lately. I literally spent a whole weekend reading the book from start to finish. The book tells the story of Kvothe, a musician and arcanist, who has achieved almost legendary status and mysteriously vanished. Kvothe is now a bar keeper in a little town of no particular importance. His story is being told as a biography. It is superbly written and I am really looking forward to the next two books!
