3

let's assume that I've used proxies and anonymizing tools as much as I want.
How to be sure that I'm totally anonymous?

I'm not talking only about IP spoofing and identity hiding, but other and advanced tracking techs including ISP recordings and so.

P.S: this is for CEH exam purpose only!

2
  • You yourself mentioned ISP recordings. In that case (or equivalently when someone manages to tap at the entrance point of ISP) your email contains your IP address and thus it is surely revealed that you have sent out the message in question. IMHO there is nothing you can do to avoid that sort of risk, if you send the message from your own computer. That is, to be anonymous in case of really mighty adversaries, you have to employ a neutral IP address somehow (cf. some humble suggestions I posted in the Epilogue section of s13.zetaboards.com/Crypto/topic/7234475/1/) Apr 11, 2016 at 10:27
  • A sufficiently mighty adversary may tap at the entrance points of all nodes of a remailer network, so that assuming anonymity via use of remailers is an Illusion in our post-Snowden era IMHO. Apr 12, 2016 at 8:04

2 Answers 2

5

There were several facts which can be used for testing anonymity.

In general you could check it out by the following

  • Set two email accounts send the email to another account ,verify the ip address.

  • Your Browser might reveal some sensitive info,check it out here

  • Use network analysis tools like wireshark and you could analyze the packets for anonymity

  • If you are running VPN from wikibooks :

If you are running a VPN and browser, it is simple to check if the VPN is working by checking your IP address at whatismyip.com for example. If you are running a proxy chain, you can enable and check each stage individually. Any malfunctioning will halt the http traffic.

For other applications such as instant messaging, it is not so straightforward. Also, when you run another proxy client on top of a VPN, your IP will becomes that of the proxy server, independent on the working state of the VPN.

When you look at the list of interfaces via WireShark, you can see your original Ethernet Controller, plus a virtual VPN adapter, with packets traveling in both interfaces. Any application packets will now go through the VPN adapter, instead of the Ethernet Controller. The VPN client will reformat and encrypt/decrypt these packets, for transport across your Ethernet Controller and the VPN server. For more efficient transport, VPNs use the UDP protocol exclusively. To check if there are any packets that leaks directly into the internet, the filter is:

not host 192.168.0.1 and not udp

Any packets for the VPN tunnel and for the local firewall are rejected. So there should be no captured packets if the VPN is fully functional. TCP protocol can also be used with SSL encryption for example, as in OpenVPN.

If two VPN's can be chained by the use of a virtual machine, the external destination of the packets at the host should be the IP address of a single VPN server only, while the guest communicates with the other VPN server

  • Also check for possible 'DNS leaks' by using the DNS service from your proxy rather than the one from your ISP or what is coded into your router

Apart from the above general facts you could run a anonymity tests from onion router sites

For advanced analysis of wireshark you can refer over here

0
5

I'm going to answer just one aspect of this problem: browser identification.

Your browser is a great source to identify you. You can test and see how unique your browser is using EFF anopticlick. I just did that test, and while my browser is pretty good at fighting off trackers, it can be uniquely identified:

your browser has a unique fingerprint

Your browser can see which fonts you have, which plugins are installed, the OS, the browser version, the language, timezone and more. You only need one font that nobody uses - et voila! Or you delete a font(set) that everybody uses. Browser version (Firefox 44 vs 45) is discutable, as it changes. But some people never update their browser, and then it is significant. So I guess the relevance grows the older the browser is. Your screen is another indicator. If you have a rather unique screensize or color settings, it might make your computer a lot more unique.

This all combines in a unique fingerprint. Google for "browser fingerprint". Another test is Am I unique.

You should find a browser that is as general as possible.

One way to get there is to install a VM with an Ubuntu guest, and don't change anything in the default install: plugins, fonts, etc. Then do this test again. Maybe Ubuntu is not such a great OS for this. Windows 7 is probably better, with Chrome or IE. Don't install fonts, except maybe for those that come with MS Office.

If you use VPN coming from Brasil, and there nobody uses Firefox, don't use Firefox in that case. Better - switch browsers (Firefox vs IE vs Safari, or browser profile (different plugins or addons) regularly or for different purposes. Make a spreadsheet from what VPN/country, and in what cases you use what setup. I'm not sure what the best strategy is here, but mixing it all up doesn't seem a good idea. Look at Qubes OS, a Linux distro that can have different profiles for different situations.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .