4

I've seen some threads on Reddit that say true hackers, when attacking, go through a public WiFi network, use a VM, proxy through a zombie computer, use a VPN, then proxychain through Tor, use another VPN, etc.... My question is, what makes this anymore secure than just proxychaining through Tor? Doing so routes all connections through Tor nodes, therefore hiding your ip everywhere. Some common answers to this are "JavaScript sections on a website" or "html sometimes leaks your ip" are not true. So again: why don't real hackers just proxy through Tor as their only step?

4
  • 10
    Anyone who uses the phrase "true hackers" probably isn't someone worth listening to. Feb 18 '20 at 17:03
  • @Evan So you mean 1337 hackers then? Remember that Tor is software, and like most software it probably has bugs in it. By using multiple layers to hide your tracks you can (potentially) reduce the chances of some exploit against any one of them being used to identify you.
    – user
    Feb 18 '20 at 17:07
  • public WiFi would be similar to using a payphone. It's not your connection to the internet... VPN would help against man-in-the-middle, and VM would help guard against attacks from man-in-the-middle or web sites. Not familiar with "proxy through a zombie computer". Tor only hides your IP from endpoint.
    – pcalkins
    Feb 18 '20 at 20:19
  • It depends on the objective. Tor nodes are public information. It's very simple to block Tor node connections, most Banks or Financial Institutions block Tor by default. Feb 20 '20 at 17:49
2

The short answer is NO (nothing hides all tracks)!

Here is the longer answer:

There are some researches on Tor on how to break the anonimity (track users); anonimity is the main goal of Tor.

To simplify it, let's take a look at the architecture of Tor. It has an entry point by connecting to a node in the Tor network, it will be passed to at least 3 different nodes in the Tor network before it gets out from the exit node.

enter image description here

Now, if someone monitors all or some entry and exit nodes, it doesn't matter how the data was gone through which called "Traffic-analysis attack". It is possible to find who requested what kind of the accesses. There are more kinds of the attacks; here you can find a short review on other attacks where I got the photo from.

So, to answer your question it is better to say "it depends". What do you mean by "hiding tracks"? from "who"? If you do not want stop hackers not to see you, that would be a good try but if you care about huge organizations or governments, it is better to find another solution for hiding yourself and your stuff.

List of some articles about attacking Tor:

0

Here I let a you a link to an explanation of all attacks that you can suffer if you use Tor.
Tor can't hide all tracks. That's why crackers(black hat hackers) use MV, VPN(like Tor) and zombie computers, to make them more difficult to track. They will never be safe, they only earn enough time just, not to be discovered. That's why Tor recommend you to change your rely node every hour, to make you more difficult to track and earn more time until you are discovered.

0

There are different kind of traces that can allow to identify what you do/have done. First, there are the traces at the target. Here once you have gone through TOR, it is hard to identify you, except from fingerprints from your system. And even in that case, the target will identify that different connections come from the same system, but still be unable to say where that system is.

But there are also traces on your internet provider. Legal investigations can compare the traces at your provider and at the target no matter happened between. If the beginning and and of the session are close, with timestamp for each packet also close it is a serious hint that your connection is involved

Last are traces on your own machine. Here again the target has no mean to access them, but the police has if they have other reasons to suspect you (undeclared money incomes, traces on social medias, real life activity). This is not only my thoughts. A student used to send illegal anonymous message to a fellow. He was suspected because of his real life activity and the police went at him and could find evidences on his machine.

Said differently, anonymity on internet is a grey zone. If your foe is your little sister or a friend of your, you may not even need TOR. But if governmental agencies enter the game, even TOR is far from a magic bullet. And depending on who they really are, rubber hose enquiries might also be on the way...

4
  • I forgot about fingerprinting.... VPN and/or using a VM would also protect against this, no?
    – pcalkins
    Feb 19 '20 at 21:57
  • @pcalkins A VPN cannot protect againt fingerprinting, because it uses the headers in the request that are tranparently transported. And a VM will indeed hide the host machine but will leave its own fingerprints ... Feb 20 '20 at 6:44
  • thanks for clarifying... so a clean VM is best.
    – pcalkins
    Feb 20 '20 at 19:01
  • @pcalkins The best would be to fully erase the VM and all of its data after use to remove any possible traces... Feb 20 '20 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy