Theoretically, wouldn't it be impossible to be traced using Tor + Virtual Machine? Assuming you connect to a website trying to track your personal location.

Your IP address is completely hidden by Tor, then using a virtual machine, your browser and other computer settings completely change, so shouldn't you be completely untraceable? I'm not seeing how it's possible.

  • Do you log in to any accounts? Fresh VM? – mhr Aug 6 '19 at 6:56
  • @mhr Completely fresh – JobHunter69 Aug 6 '19 at 7:09
  • are you talking about location tracking or feds getting to you? – yeah_well Aug 6 '19 at 7:14
  • @VipulNair feds for example. – JobHunter69 Aug 6 '19 at 22:59

You are conflating a lot of concepts together, so let me try to separate them.

Virtual machines are a convenience of many purposes but enhancing anonymity is not one of them. Yes using a browser in a VM will give different indicators such as User-Agent and Fingerprint, but that’s just another set of tracking variables. It’s extremely difficult to configure your own browser for privacy. When browsing with Tor, you should be using the Tor Browser Bundle (TBB). TBB has all of the security levels configured for you as well as some privacy capabilities completely lacking in other browsers. It’s designed to look like the same TBB everyone else is using.

Theoretically Tor is indeed traceable and the Tor project will confirm that. The details however make it very very difficult. In general it requires monitoring or control of multiple nodes in multiple countries that are themselves changing. Tor is designed to resist a nation state level of effort. Multiple nation states working together can at least partially defeat Tor, but that is a high bar.

Last but not least, Tor doesn’t protect you from giving away your identity. If you login to an account both with and without Tor, you’ve correlated the two.

Tor is an anonymity transport mechanism. It will transport anything, including identifying information if that’s what you feed it. TBB is a browser configured to protect privacy and use Tor transport, use them together!

Also, you (or TBB) define and setup the multihop Tor circuit. Your machine knows the full path to a web page (not an .onion). Any sufficiently privileged code or trojan on your machine can see it as well.

Tor is not perfect, but it’s very good if used carefully.

  • I see, so with the Tor bundle the VM is not even necessary. Couldn’t it give away any other characteristics of your computer without using a full VM? – JobHunter69 Aug 6 '19 at 23:01
  • If you're just browsing websites then an anonymizing VM is not really necessary, at best the VM may help as a second layer of defense in case there's an unknown vulnerability on TBB though. However if you do anything else other than browsing, for example if you use native apps to open files or use native email clients, then a whole VM Torification like with Tails or Whonix would be needed to prevent leaks. – Lie Ryan Aug 7 '19 at 4:32

Traced by whom? If you mean traced by the evil maid then perhaps a VM running purely in memory would mean that your activity wasn't recoverable. A Linux boot CD springs to mind. You'd have to ensure that you flushed your memory of course.

If you mean traced by your ISP in the sense that your ISP knows in general what you are doing then your ISP will record your exit IP address and they will know which IP address you connect to. They will also know the protocol. In the UK the ISPs store connection meta data (and possibly more, who knows) for a year and hand that over to the authorities. So if now the fact that you have been to a Tor gateway is known by your ISP and the intelligence services.

Obviously the countermeasure to that is to use someone else's ISP. There are plenty of free wifi networks you can use. Your activity can still be logged, but your identity is hidden. If you do that and you use a VM then check that your MAC address isn't being disclosed, or change the MAC address of your host first.

Once you are on Tor, if you are unlucky you'll get onto a Tor exit node run by a researcher or worse, an agency. The owner of the exit node can potentially access your network traffic. One of many many articles about this from Sophos https://nakedsecurity.sophos.com/2015/06/25/can-you-trust-tors-exit-nodes/

If you want to hide your personal location then Tor will change the IP address that the target website sees making IP-based geolocation harder. You can do the same thing with a VPN or rent a VM in AWS. Your location may still be partially disclosed though if your browser exposes regionalisation settings. Sites can also attempt reflection of your presence, eg by looking for social media tokens in your browser. I imagine Facebook spends a lot of effort tracking people who do not have Facebook accounts via Facebook callbacks.

  • 1
    "... your ISP will record your exit IP address and they will know which IP address you connect to. ..." That is absolutely incorrect! – user10216038 Aug 6 '19 at 19:10
  • "... check that your MAC address isn't being disclosed, or change the MAC address of your host first ..." MAC addresses are not present as part of Internet Protocol. The ISP will see your router MAC only, and changing that will likely drop your connection. – user10216038 Aug 6 '19 at 19:15
  • "... You can do the same thing with a VPN ...". You incorrectly suggest a parity with Tor. No single Tor node can tie both ends of a connection together, that is not the case with a VPN. – user10216038 Aug 6 '19 at 19:19
  • Correct. The ISP will see your router MAC address or the MAC address. You are correct that the ISP will record the IP address that they give me (the exit address from my home, not the Tor exit address obviously) and you are correct that they know the destination of my IP packet because that's how they route it. They might only know that it goes off into TOR land but they know it goes . You are absolutely correct that a VPN is not parity with TOR, but if you merely want to obfuscate your geographic location then a VPN that puts you out in, somewhere distant will confound most web sites – Unicorn Tears Aug 6 '19 at 20:01
  • -1 This is completely incorrect. Your ISP is completely incapable of knowing your exit IP... – forest Aug 6 '19 at 23:33

Are you accessing this website via Tor with an account you only registered in your tor browser on your VM? If not then you have already exposed your identity which is unfortunate. I'm not saying StackExchange would roll over and give up your info, but your ISP knows who you are and when you accessed stack exchange - matching this up with your question is child splay.

Tor, the network and infrastructure when used correctly does provide protection, but you absolutely MUST isolate your tor environment from any other you use, and never ever use any shared credentials. Read the Tor documentation, understand technically how it works and how by using multiple relays it can prevent backtracking and most importantly learn where its weak.

  • Of course the scenario would assume I don’t do anything obvious like that. – JobHunter69 Aug 6 '19 at 23:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.