Advanced Deanonymization Attacks



Originally published at: https://www.whonix.org/blog/advanced-deanonymization-attacks

A number of advanced deanonymization attacks. These do not just apply to Whonix, but any anonymity system. Some are also general security issues.

Rather than exploiting bugs in the hypervisor to break out, some of these attacks rely on the design of the underlying hardware to bypass privilege separation boundaries and extract (or leak) sensitive information to the network. No need for alarm, there are many qualifications to this and details in the listed tickets on proposed countermeasures. We are interested in cooperation to better assess the performance impact of the planned fixes.

  • Keystroke Deanonymization: T542
  • Advanced Attacks Meta ticket: T540
    • CPU-induced latency Covert Channel: T530
    • Cross-VM cache attacks countermeasures: T539
    • DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks: T541
    • TCP ISNs and Temperature induced clock skews: T543


A wiki page has been created by @HulaHoop. Last revision by @HulaHoop:


Separated the Fix Stage per Whonix platform in latest revision to make it easier to see the fix status per platform:


I have also added a row “requires local compromise”.

Please check if my changes are correct.


Looks good.