Whonix Track Record against Real Cyber Attacks

Whonix ®

Download

Windows Linux Mac VirtualBox KVM Qubes USB ISO (coming soon) More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

• System Audit
• Security Reviews
• Media Mentions
• Certification
• Track Record against Real Cyber Attacks
• Reliable IP Hiding
• IP Hiding is an Outdated Threat Model
• Leak Tests
• Leaks and Compromise Indicators

Whonix helps to protect users against various deanonymization attacks. This chapter lists many notable "in the wild" attacks that deanonymized users who did not rely on the Whonix platform, but which failed against Whonix due to its fundamental design.

Introduction

The threats posed by "zero day (0-day) exploits" are not just a hypothetical concern, but a very real one. Since 2014, the Google Project Zero initiative has discovered a new exploit every 17 days, with the majority (68 per cent) related to memory corruption bugs. There has been a large increase in the number of "in-the-wild" 0-day attacks in 2021, with 33 publicly disclosed already halfway through the year; this is 11 more than all of 2020. The spike in zero-day attacks is attributed to an overall rise in the total number of exploits being used, as well as greater detection and disclosure by researchers.

Zero-day exploits (also "0-day" or "0day" attacks) refer to previously unknown vulnerabilities in software. "Day zero" refers to the hypothetical day before "day one" on which the vendor of the software realizes the vulnerability. In other words: "Zero day exploits" are sudden and unexpected attacks that use a newly found out vulnerability BEFORE the software vendor even knows this vulnerability exists.

In one sense the proliferation of 0-days is a positive sign, because it indicates improved overall security now requires attackers to rely more on them for successful exploits. On the downside, there is a significant increase in the number of vendors providing 0-days, particularly for mobile devices due to their popularity.

A widespread and highly profitable industry has also developed around 0-days, illustrating that all sectors of society are potential targets of the hack-for-hire market, including those involved in politics, advocacy, global commerce and government. Hundreds of commercialized hacking entities have emerged to trade in offensive security, posing threats to individuals and groups who do not have sophisticated cybersecurity resources. In the past, 0-day capabilities were solely developed and used by a handful of nation states to operationalize exploits, but now it is more common for commercial providers to develop exploits and sell them to government-backed actors.

This reality explains why government regulation is sorely lacking in this area -- government is one of the largest clients of offensive security companies in order to bolster their surveillance and espionage capabilities. Government tolerance and perceived normalization for these types of services reinforces the notion that private individuals and organizations must utilize all available measures to better protect themselves.

On this page there are many examples how Whonix prevented even "Zero-day" attacks that were successful against other software but ineffective against Whonix due to its fundamental security and anonymity design.

Real Cyber Attacks

Below there is a list of examples of real cyber attacks - many of them zero-day exploits - which affected thousands of users but did not affect Whonix users due to its design advantages. In its more than 10 year history Whonix has a strong track record even against software vulnerabilities that have not been known previously.

BitTorrent (2010)

In 2010 IP leaks have been reported when using ordinary proxification methods. Since Whonix prevents information leaks however, using BitTorrent in Whonix did not leak a user's real external IP address (see File Sharing). The reason is Whonix-Workstation^™ (anon-whonix) has no knowledge of the external, ISP-facing IP address and therefore cannot leak it.

Browser Plugins: Flash, Java etc (2011 - currently)

Whonix prevents information leaks from browser plugins since it has no knowledge of the real external IP address. This protection also applies to Flash-based applications used by advanced adversaries. Nevertheless, it is NOT recommended to install browser plugins such as Flash when anonymity is the goal. See Browser Plugins for further details.

Everyday Trackers (currently)

Browser fingerprinting can be used to track the user similar to an IP address. This is common practice on the internet. The fingerprint.com tracking software alone is used by 12% of the largest 500 websites use fingerprint.com.

When using a normal browser such as Mozilla Firefox or Google Chrome, the browser fingerprint of the user will always be the same and therefore trackable. No matter what IP the user is using, any website using one of the easily accessible and popular browser fingerprinting services can always link each visit by the user to the same pseudonym.

Whonix comes with Tor Browser installed by default. Each time Tor Browser is restarted (or its new identity function used), the fingerprint.com browser test fails to detect the same browser fingerprint, fails to assign the same unique identifier for the user. In other words, at time of writing even fingerprint.com fails to track users of Tor Browser using its browser fingerprinting techniques.

Nautilus and other file managers (2017)

A security bug was reported in Nautilus file manager that allows an attacker to disguise a malicious script as a .desktop file. This vulnerability was later reported to affect other file managers too. In this attack, an adversary tricks the user into downloading the .desktop file from a website or sends the file in an email. Once the file is on the target's computer, the file (PDF, ODT) only has to be opened by the user for the script to execute.

This security bug was used to craft an exploit which was able to break the Subgraph OS security model. Since Subgraph does not contain Nautilus in an Oz sandbox, once the malicious script was executed, it would have enabled access to much of the user's data; PGP keys, SSH keys, stored email, documents, password databases, MAC addresses and nearby Wi-Fi access points.

This sensitive information could be used by attackers to deanonymize the user, but Whonix defeats this attack and others like it. Since Whonix-Workstation (anon-whonix) is isolated from the host and Whonix-Gateway^™ (sys-whonix), even if a malicious .desktop script is executed, no information can be gathered about the external IP address, hardware serials or sensitive data outside of Whonix-Workstation (anon-whonix). Once Subgraph developers were informed of the vulnerability, the Nautilus package was patched on the platform.

P2P (2011)

In 2011 an attack was published that targets P2P applications in order to trace and profile Tor users. Whonix defeats this attack and others like it because Whonix-Workstation (anon-whonix) has no knowledge of the external IP address. Furthermore, Whonix provides extended protection by using Stream Isolation.

Pidgin (2012)

A bug was found in Pidgin that would have leaked the real IP address. Whonix did not exist when this bug was discovered. Nevertheless, the security by isolation model adopted by Whonix prevents this kind of leak from occurring. Notably, this bug only existed in the developmental source code and it was patched before the release date.

Skype / VoIP (currently)

Whonix will not leak a user's IP address / location while using Skype or other VoIP protocols, although it is fairly difficult to anonymize voice over these channels.

Targeted Clock Skew Correlation (currently)

This type of correlation allows an adversary to acquire the time stamp of an Onion Service http header and measure the clock skew. The adversary then compares the acquired time stamp against Tor relays or other publicly reachable web servers. If the time skew of the Onion Service server matches any publicly reachable servers or Tor relays, it is very likely the Onion Service is hosted on the same server.

Whonix defeats this and other time attacks since it uses Boot Clock Randomization and sdwdate. This program connects to a variety of servers (likely to be hosted on different hardware) at random intervals and extracts time stamps from the http headers.

It is not recommended to run Tor relays on a publicly reachable server along with an Onion Service on the same server. This configuration aids traffic correlation and fingerprinting.

Thunderbird (2009)

Tails reported that Thunderbird leaked the real external IP address. Although Whonix did not exist when this bug was discovered, it would have been impossible for the real external IP address to leak, since Whonix-Workstation (anon-whonix) has no knowledge of it. In fairness to Tails, this kind of leak is now considered unlikely since they no longer use transparent torification.

Tor Browser Bundle (2012, 2013, 2017)

1. A severe bug was discovered in FireFox which related to WebSockets bypassing the SOCKS proxy DNS configuration. Whonix defeats this bug since Whonix-Gateway (sys-whonix) forces all traffic through the Tor network or it is blocked. At worst, a proxy bypass would have emitted traffic through Tor's TransPort. In this scenario, the only information that could leak is the IP address of another Tor Exit Relay, which would not affect anonymity.
2. An old attack was observed in the wild that exploited a JavaScript vulnerability in Firefox. The observed version of the attack collected the hostname and MAC address of the victims' computers, and sent that information to a remote web server. This threat is partially mitigated nowadays by the development of a security slider in the Tor Browser Bundle, which prevents the execution of JavaScript code completely with the correct settings. Nevertheless, Whonix would have protected against a MAC address leak and at worst leaked a hostname which is common to all Whonix users.
3. TorMoil: A security bug was reported in version 7.0.2 that allowed systems with GVfs/GIO support to bypass Firefox proxy settings using a specially crafted URL, leading to an IP address leak. Since Whonix-Gateway (sys-whonix) forces all traffic through Tor, and information leaks are blocked, Whonix users were not affected by this bug.
4. A defect was discovered which allowed an adversary to use targeted clock skew correlation to identify a user. Since Tor Browser transmits TLS "Hello Client" gmt_unix_time there are two scenarios in which these transmissions could be used to track users.
   • In the first scenario an adversary either compromises NTP servers or uses a man-in-the-middle to intercept NTP server replies and introduces a unique clock skew. Since "Hello Client" transmissions are visible to ISPs that host Tor Exit Relays as well as destination servers, an adversary could use clock skew correlation to track users' movements.
   • In the second scenario, a user visits a clearnet website under adversary control without Tor Browser and the unique clock skew of the TLS "Hello Client" gmt_unix_time is recorded. Afterwards, the user visits the same or a different adversary-controlled website using Tor Browser. If both clock skews match, this could indicate the two visitors were the same person. At the very least this would significantly degrade anonymity. Since Whonix uses Boot Clock Randomization and sdwdate and not NTP to keep time, these instances of targeted clock skew correlation and many like it are defeated.

See Also

• Security Reviews and Feedback
• Leak Tests

Footnotes

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!