1

Sorry for the long title.

I've been following this online course on ethical hacking and there was a part on how to set up VirtualBox and installing Kali Linux, as well as creating a USB Passthrough for the usb adapter so that Kali can use it. I have successfully followed on this tutorial however, the tutorial recommended that I use a network adapter whose chipset fell under the categories of aircrack-ng (I think it was for sending special/custom packets or something to that effect). Seeing that I might not need to perform operations on packets yet, I figured that I might be able to make do with a realtek rtl8188cus usb adapter we had lying around, then I'll just get the real thing when the lecture calls for it.

However, the next lesson on the lecture was browsing tor and I found the realtek usb adapter to be a bit inconsistent with it's performance. I'd get varying download speeds (and I'm the only one using the WiFi in our house) and sometimes it would disconnect, and I wouldn't see our WiFi network in the list of available networks. However my laptop - Macbook Pro - did NOT disconnect and can see our home network just fine. Kindly note that I didn't change the position of the usb adapter, and I even placed it on a usb extension cable so it can be closer to the router (note that I'm just 7-10ft away from our router).

I wrote this off as an inconsistency of the usb adapter and decided to change the network setting of the virtual machine to use NAT for the moment instead of "Not Attached" in order to download the tor browser.

Now, my question is, is it safe to browse tor on a virtual machine that uses the host device's network adapter? Kindly note that I made another non-root user for tor browsing purposes.

I feel like it's supposed to be safe and I'm just letting my caution/paranoia get to me.

Any help is very much appreciated.

Improve this question
2
  • What do you mean by "is it safe"? Don't you think that this depends at least partly on what you are planning to do with Tor and your network adapter? Also, getting varying download speeds with Tor is completely normal and inherent in how Tor works. I'd suggest you learn a bit more about Tor before you start worrying about whether sharing the host system's network adapter is an opsec risk.
    – Out of Band
    Nov 7, 2016 at 8:57
  • What I meant by "safety" is will I be given the same anonymity level given that I'm using the host device's network adapter instead of letting the virtual Kali machine use its own usb adapter/dongle. And what I meant during the varying download speed was during my tor download using Firefox, I was getting inconsistencies. I understand that once I operate through tor, I'd get varying speeds.
    – Razgriz
    Nov 7, 2016 at 9:02

2 Answers 2

Reset to default
1

When someone compromises your virtual machine and you're using the host's network adapter, he might learn the host machine's mac address. This might compromise your anonymity. I think the FBI used an attack against Tor users using Tor for illegal purposes a few years ago that recorded the MAC address of the user's computer, so it's not just a theoretical danger.

You could change your MAC address using software on the kali installation. However, this is just a first line of defense; the hardwired MAC address can always be recovered if the attacker gains root access to your virtual machine. Virtualbox might support spoofing of the MAC address, but again, this is just another layer of defense.

An attacker might also be able to listen to your host's traffic and, depending on the network adapter, to all the wireless traffic in your vincinity (but this is also possible using a dedicated network adapter).

Then again, he might also break out of the virtual machine alltogether. There are a few working attacks that break out of VMWare on Youtube; I'm sure there are some for virtualbox too.

But I'm not sure I understand your fears: Ethical hacking is, by definition, ethical, so why would your anonymity matter?

Improve this answer
4
  • Okay. I won't go much into tor as long as I haven't acquired the proper network adapter. Thanks for the thorough explanation! One last thing though, I should still be anonymous given that all I did with tor was to look up the hiddenwki (I didn't really interact with anyone or downloaded anything yet)
    – Razgriz
    Nov 7, 2016 at 9:24
  • 1
    Look, with Tor, no one can really tell. There are various attacks against the anonymity of Tor users, some theoretical, some feasible under lab conditions and some seen in the wild. Tor gives you "pretty good anonymity if used right", but not "anonymity, period". There are news reports about several people who thought that Tor gave them license to do what they wanted who are now serving prison sentences for the various crimes they commited. So my suggestion would be to stick to the "ethical" part of your hacker course.
    – Out of Band
    Nov 7, 2016 at 9:35
  • Another follow up question: Up to what extent can I browse tor with my set up right now (no usb adapter for the virtual machine) and not worry about anyone compromising my host device? As long as I don't touch or download anything malicious then no one can compromise my virtual machine, right? I'm basing this hypothesis from how normal internet browsing works but I'm doubting this cuz tor is different from normal. I get that I have to stick to the "ethical" part of the course but that doesn't stop anyone from making me fair game.
    – Razgriz
    Nov 7, 2016 at 9:44
  • It really depends what you do. You can pick up malicious software pretty much everywhere, knowing when you did so is a hard problem. That's why we have a booming virus scanner industry. You're a bit safer than the average because much malware still targets Windows, but with Android gaining so much traction, the times where linux users didn't have to worry are fast coming to an end. And if you actually get on the bad side of someone with state resources, chances are that won't protect you.
    – Out of Band
    Nov 7, 2016 at 9:55
0

There are known vulnerabilities in Tor, like the use-after-free Javascript 0-day in Firefox

You shouldn't need to worry if all you've done is searched for the hidden wiki through a search engine using Tor. If you're clicking on links once inside the hidden wiki that are redirecting you to other sites then I can't say for certain without access to your machine. However as user Pascal mentioned you should perform the same level of safety whether inside or outside of Tor.

Just because you're using Tor doesn't mean your anonymous. If you're new to Tor you should definitely read the manual.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .