TCP linux-hardened fingerprinting

[Patrick]

@HulaHoop

@anon12802191

Some tight dictatorship countries, especially during times of unrest will arrest you incase they suspect even slightest of “above average technical ability” e.g. running Linux host and running virtual machines on it.

I hate to be the bearer of bad news, but our security choices and improvements do have a unique fingerprint on the network for those who want to look. The fact we disable TCP timestamps and remove TCP ISNs is readily apparent. Rather than stick to the less secure defaults that can endanger users in other ways, we have chosen to move ahead and adopt these improvements.
.
If having a firewall solves this - which I think Patrick said, then the solution is easy enough to apply and I hope satisfactory

@anon12802191

The TCP timestamps being disabled is only inside of the VM, however the dnsmasq is on the host so it should still be considered. Just because Whonix has some obvious fingerprint able properties in exchange for security, does not mean you should allow more fingerprints, […]

And what’s the point of this?

@anon12802191

This is interesting because AFAIK Whonix disables these in linux-harden kernel which I thought is in use only in Workstation and not Gateway and I assumed that means no fingerprint (at least outside of tor) or does Gateway and workstation both use same kernel with same options?

Network, Browser and Website Fingerprint chapter ISP or Local Network Administrators in Whonix wiki

@anon12802191

if so that could be an improvement to disable some hardening kernel features in Gateway, no?

No.

---

It’s an optimization conflict.

• A) Either the main goal can be to emulate being a Windows 10 / 11 or whatever the currently most popular Windows version is network fingerprint. And this is very most likely impossible without using the actual Windows code which we stay away from for many reasons.
• B) Optimize security, anonymity at the expense of ISP level network fingerprinting, which is already a lost cause.

You cannot be anonymous without being secure. Project decision was made to prefer security over ISP level network fingerprinting obfuscation attempts.

The related wiki page is this one:

Hide Tor use from the Internet Service Provider

There are at least two categories of projects.

• A) Anonymity: Projects that prioritize to anonymize internet traffic.
• B) Circumvention: Projects that prioritize to hide internet traffic, circumvent ISP level censorship, resist ISP level network fingerprinting.

Whonix is primarily in category A).

A) is already a hard problem to tackle
B) is even harder if not impossible.

I am not even aware of any projects in category B). Such a software could even be developed independently from Whonix, Tor.

@anon12802191

@HulaHoop

@Patrick

Even the information “port 53 tcpwrapped” should not be leaked over the LAN or internet. Could even be deducted “Maybe it’s a Whonix KVM user”.
[/quote]

Note this is not specific to Whonix and could be interpreted as Linux host running libvirt, This is already discoverable and hard to hide the type of OS running on a network because of the different ways they react.

I see your point of view but I agree with @Patrick on this one.
Your point heavily assumes “Linux machine running a KVM machine is not that suspicious” is entirely in context of specific countries in specific times.

Some tight dictatorship countries, especially during times of unrest will arrest you incase they suspect even slightest of “above average technical ability” e.g. running Linux host and running virtual machines on it.

Their mindset would be “this person or group is running Linux, people run Linux because they have something to hide! oh and on top of that he is running a virtual machine! what is he scared of so much”

This sounds comical but There are countless arrests or interrogations based solely on this “logic” and I should mention that “arrests” in those countries means torture to death

A more tangible issue for other countries is fingerprinting. They don’t have to be sure that a Whonix VM was started or is installed, they just have to know that a VM is there and it is enough to narrow down the search considerably

Do not undermine value of metadata, a lot of people die every day because of it. We kill people based on metadata

So, optimally the host should not leak information on whether or not they have VMs/dnsmasq or anything out of ordinary

I am not aware of any software solutions provided for such extreme threat models. The sad hard truth is that at some point non-technical issues cannot be worked around with technical products.

I’ve seen it being discussed a few times to use Tor in such threat models and I can understand why anyone would get the idea but it’s conjecture. If you have a look at the following ticket, you’ll see that neither The Tor Project is prioritizing to work under such a threat model:

Adapt Tor installer to allow users to avoid connecting to the public tor...