How can an attacker track someone using Whonix like tor-gateway?

  • 1
    "Whonix is a Debian GNU/Linux based security-focused Linux distribution. It aims to provide privacy, security and anonymity on the internet. The operating system consists of two virtual machines, a "Workstation" and a Tor "Gateway", running Debian GNU/Linux. All communications are forced through the Tor network to accomplish this." --Wikipedia Dec 22, 2016 at 20:28
  • You should try escaping the question to a 3rd party attacker rather than generic attackers because that would put the attacker list to the ones in the same network zone. It's already answered in the doc section of tor Dec 22, 2016 at 20:42

2 Answers 2


From the tor homepage:

"Tor does not provide protection against end-to-end timing attacks: If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your chosen destination, he can use statistical analysis to discover that they are part of the same circuit." https://www.torproject.org/about/overview

Also, tor & other tools, such as a browser used while on the tor network, can have vulnerabilities which can de-anonymize you. These have been actively exploited by government agencies. Recent example: http://arstechnica.co.uk/security/2016/12/tor-releases-urgent-update-for-firefox-0day-thats-under-active-attack/

Older, similar example: http://arstechnica.com/security/2013/08/attackers-wield-firefox-exploit-to-uncloak-anonymous-tor-users/

  • The attacker would be able to do so, if at all he's in the same network as the user. The origination & destination packets are therefore deduced to the same network zone. I'm entirely sure that it answers the question but it doesn't answer how does a 3rd party attacker other than the same network guys end up compromising the set-up? Dec 22, 2016 at 20:35
  • 1
    Nation state actors can intercept at the backhaul - they don't need to be on your home network.
    – Frederik
    Dec 23, 2016 at 8:42
  • That's eventually true for most ISP's. Yes. I agree. Dec 23, 2016 at 21:00

Traffic correlation attack should be relatively easy to avoid if you don't post, and just browse multiple different websites simultaneously.

However there are other means, based on user activity. Generally if you generate any content - such as post something - and not just consume the content, using Tor/Whoenix alone is not enough.

A few things to consider:

  1. The language use. For example, in a well-published case an administrator of darknet website, who used Tor, was tracked down and eventually arrested because he used unusual greeting. A search for this greeting provided few results, and following up on those was easy enough. Note that this kind of attack doesn't require significant resources or state powers.

  2. People have been deanonymized by posting photos with geo-tagging enabled, reusing their identities (such as creating unusual user accounts), sharing extra information about themselves in private with "trusted" people, and so on.

    Generally if you post anything at all, it makes it much easier to track you down. The more content you post, and the more unique it is, the easier you make it to track you down.

  3. A browser exploit could be triggered against the "Workstation", and reveal all browsing sessions, which could be then correlated. For example, if the user is browsing the monitored site while logged into their gmail in another tab, such exploit might reveal both browser tabs. Generally, if a screenshot taken during any moment of your Tor session would reveal your identity, you're vulnerable.

But of course there are many other attacks. Even a simple timing attack - if a user A connects to Tor network at certain time each day, and a certain web site gets updated at the same certain time, one can correlate those activities even without monitoring the exit node traffic.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .