If I have an application that supports a SOCKS proxy, and I point it at a running Tor instance, how can I be sure that all traffic the application sends (including DNS requests) are sent through the proxy?
One technique is to firewall your computer off so it can only communicate through Tor, and then use the application, watching your firewall logs.
Set up a Tor bridge on another host in your network/on the internet.
Boot your client/testing machine from a LiveCD.
Install Tor on your client, have it point to the bridge.
Use a firewall such as shorewall or iptables to block access to the internet except for your bridge. This should prevent anything from leaving your machine that doesn't go to that single port on that single IP over TCP.
Tail your firewall logs, and let your machine quiet down. Stop any ntp services, system updates, etc. Get it so your machine is sending no traffic.
Start up the application, use every single feature and make sure it's all being correctly proxied through Tor. Anything that shows up in your logs is a leak. Investigate it.
Shorewall Firewall configuration:
/etc/shorewall/zones
fw firewall net ipv4
/etc/shorewall/interfaces
net eth0 detect dhcp
/etc/shorewall/policy
fw net DROP warn
net fw DROP info
/etc/shorewall/rules
ACCEPT $FW bridgeip tcp bridgeport
-
I also run
tcpdump dst port 53to see if any DNS is leaking out. But firewalling off is safer. – zkilnbqi Sep 25 '13 at 19:52
Watching syscalls
Alternative to detecting unwanted traffic on a network level (by firewall or a packet sniffer like tcpdump) is to watch system calls of the application. For example on Linux you can run the application under control of strace:
strace -e trace=socket,getsockopt,setsockopt,getsockname,connect,bind,send,sendto,sendmsg,recv,recvfrom,recvmsg your_application
The network traffic level has advantages that it does not depend on the operating system and kernel interventions to the communication. You see the real communication.
The system calls watching method has advantage that you are closer to what is happening inside the application.
Other possibility is to watch library calls but unfortunately ltrace on Linux does not make many library call parameters accessible.
Tor Project suggest two ways to use Tor :
- Tor Browser if you want just to browse webpages (https://www.torproject.org/projects/torbrowser.html.en)
- Tails Live Linux to have a better experience with an operating system. (https://tails.boum.org)
If you're able to run your application in Tails which is based on Debian GNU/Linux perhaps it's the safer path to take. Tails makes sure that every connection is made through Tor.
A bunch of applications was not designed with anonymity in mind so they might try hard to determine you real external IP, e.g a BitTorrent client.
Nevertheless if you want to check the connections your application makes, you'd better try an isolated environment e.g a virtual machine with VirtualBox. A virtual machine gives you the opportunity to have Windows or Linux.
As long as you prepare you virtual machine, install your appplication and make sure you shutdown as many as you can of the rest applications in the virtual instance. Install and run Tor and point your application to it.
Finally install Wireshark, a network analyzer. Wireshark can capture network traffic from the (virtual) interface. Run and use your torified application and watch in Wireshark for packets coming and going. To help yourself you can make use of the various filters of Wireshark, e.g filtering DNS requests.
Finally be aware that some applications might leak other sensitive informations of yours, apart from your real IP address. Such information can be your username, hardware information, timezone etc.
