I think I might have found a leak or something strange.

Whonix ®

Download

Windows Linux Mac VirtualBox KVM Qubes USB ISO (coming soon) More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

• System Audit
• Security Reviews
• Media Mentions
• Certification
• Track Record against Real Cyber Attacks
• Reliable IP Hiding
• IP Hiding is an Outdated Threat Model
• Leak Tests
• Leaks and Compromise Indicators

This is unlikely. Here is why.

Why this is unlikely?

• Summary: When a link to this wiki page is posted by an administrator or moderators in the Whonix forums, then there is likely no evidence your IP was leaked from inside Whonix-Workstation.
• Fact: Whonix provides reliable IP hiding. In over 12 years of history, no leaks have been reported in Whonix.
• Invalid compromise indicator: See also Valid Compromise Indicators versus Invalid Compromise Indicators .
• Lack of required skills: Non-technical users lack the capability to find IP leaks. It requires knowledge of using packet analyzers and understanding their output or using some tool (such as a browser, command line downloader) running inside Whonix-Workstation and showing the user’s real external IP address. This requires being a sysadmin or similar. That’s just the way it is. A normal person cannot perform heart surgery, and even a doctor who does not specialize in it lacks the capability to perform it, and there is no shame in that. See also System Audit.
• Invalid test results: There are many Unsuitable Tests.
• Support Request Policy:

  Whonix developers will normally only respond if they are convinced an actual technical, privacy or security-related problem has been identified. Many issues are unfortunately Out of Scope Issues.

• Policy Rationale: Limited developer time.
• Purpose of this wiki page: Having a wiki page that allows to quickly reply to a similar support request.
• Lack of other reports: If this were an issue, technical users performing Leak Tests (or Security Reviews and Feedback) would have reported this already. Multiple users, among years long users, would report the same issue.
• Research community: It seems rational to assume that there is an active research community. See anonbib for a collection about research papers about Tor and other anonymity networks. The Full Disclosure Mailing List is highly active. Presumably, security researchers would be happy to collect a proverbial trophy by finding a leak in Whonix. Nowadays, security researchers like to create websites for security issues with good descriptions and nice logos. Examples include Milk Sad, Meltdown and Spectre, and many others.
• Trust based:

Realistically, users can only Trust that software works as described and intended, develop skills to undertake audits and/or pay someone to perform that task. System Audit

How to prove that there is a leak?

• A) Use one of the available leak tests.
• B) Create your own test.

1. Determine your external IP address.

2. Host your own leak testing server.

3. Connect to your leak testing server over clearnet (or use a VM that does not use Tor).

4. Confirm the connection time and IP address in the server logs when you connect to your server.

5. Run an application inside Whonix-Workstation that connects to your server.

6. Check the server logs for a new entry with the connection time and your external IP address.

Proper Report

Unless someone can demonstrate to run a command inside Whonix-Workstation that results in showing the user’s real external IP address, there is no anonymity / routing related bug.

User Alternatives

If the user believes there is an IP leak bug in Whonix, there is not much the user can do:

• A) Become a sysadmin: Learn Linux networking.
• B) Paid investigation: Pay a third party to investigate this issue.
• C) Paid full security audit: Pay a third party to perform a full security audit of Whonix.
• D) Paid conceptual review: Pay a third party to review and explain the technical design summary to the user.
• E) Disclose: Disclose your findings publicly and see if any security researcher takes it seriously.

Example Forum Threads

• Chrome acceses IP in search bar!
• IP leak? Workstation connect directly to servers bypassing the gateway?
• google calculated me across whonix
• Possible Tor Browser/Whonix Leak
• Strange behavior of Whonix related to updates.
• SSH tunnel from Whonix Workstation to VPS unreliable
• Whonix not safe traffic decrypted!

Footnotes

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!