I know that a website's javascript application can open direct connections with my computer, outside the onion network, and that way the real ip of the Tor Browser user ends up being revealed. How can I evaluate if a particular site is actually "seeing" my real ip or if it is seeing just the tor exit node's ip?

  • Bypassing Tor would require a security vulnerability in Tor Browser. – CodesInChaos May 8 '17 at 14:52
  • If you're paranoid, go with Whonix over the Tor Browser Bundle. That way no application running on the workstation VM can bypass Tor without a vulnerability in the gateway VM, reducing the attack surface. – CodesInChaos May 8 '17 at 14:53
  • But can't I check it? I understand that I can see all connections made by my computer right now with netstat, for example. Maybe a "tor netstat" has been developed? Is "arm" something like that? – André Carvalho May 8 '17 at 17:31
  • Connections to the remote end-point of are through Tor. You can use netstat or wireshark for that. But netstat won't show you DNS or UDP based leaks and with wireshark it's annoying to restrict the connections to those originating from Tor Browser (at least that's what I remember, I'm hardly a wireshark expert) – CodesInChaos May 8 '17 at 17:42

JavaScript cannot bypass proxy settings in Firefox. The only way it can is by exploiting a new bug in the JavaScript engine which allows complete control over Firefox, allowing the proxy settings to be ignored. Features that are able to bypass the proxy settings at will include Flash and Java (unrelated to JavaScript), and those are not included in Tor Browser for that reason.

Detecting a bypass attempt can generally only be successfully done if you are detecting a successful bypass attempt. Assuming you are using Linux, this can be done safely by using iptables, which is the frontend for the system's firewall. If you make Tor run as its own user (for example, by using Tor in a distro's repository), you can set iptables to deny all network connections which are not coming from the dedicated Tor user. Violations can then be logged.

The Tails live operating system does this. All applications on Tails are configured to only go over Tor, and any applications which try to connect to the internet directly (whether due to being misconfigured, or having been compromised) will be blocked, with logs sent to the system log.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.