-
-
Notifications
You must be signed in to change notification settings - Fork 48
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
whonix-gw-15 allows leaking of ip #5629
Comments
on each one individually. My uneducated guess would be that whonix-gw passed the UDP traffic directly. I was today able to replicate this. |
FYI @adrelanos |
|
I wonder if it isn't because of some template property - some unique id there (/etc/machine-id?). But then in the last test you'd get the same ID too. Can you confirm the last test was using the samoe whonix-ws template? |
straussmaus:
But @adrelanos, assuming you installed `teamviewer_amd64.deb` on each DispVM, not the ws template,
Not installed in template. Installed in DispVM only.
why would "raw sockets" make a difference?
Because these can circumvent firewalls. If two VMs behind same gateway
are opening a port or using raw sockets these might be able to
communicate over virtual LAN. It shouldn't be possible because different
VMs are assigned different vif+ interfaces on the gateway. Not sure
https://phabricator.whonix.org/T466 is required. Still need to test.
A useful test would be to:
- run two non-Whonix VMs
- behind non-Whonix sys-firewall
- unload firewall rules as per
https://www.whonix.org/wiki/Dev/Firewall_Unload
- try to connect the two VMs
A separate useful test would be to unplug / disable on's sys-net (or
home router power plug) and see if team viewer still can get same IDs.
> Does two VMs connected to the same sys-whonix have guarantee to use different exit nodes? Or only different circuits? Or maybe not even that?
Exit nodes for sure no. Circuits. Wouldn't call it guaranteed. It's up
to Tor.
|
I've seen this claim before and I think it's bogus. I dont think it has anything to do with "leaking IP" address, or "raw sockets", although I do think that TeamViewer is a security risk I wouldn't touch. Take a look at the actual interchange involved in a TeamViewer session and (amongst other stuff) you see this:
Well, some of that looks familiar ( in format, if not detail): If I change those can I get a different ID? Yes, change both MAC and blkid, and I get a new ID on the same qube. @adrelanos There's not enough detail in your test descriptions. Check the hardware characteristics for the whonix-ws instances where they got same ID and where they got different ID. |
Used a debian-10-minimal appvm behind sys-whonix + whonix-ws-15 based DispVM behind the same sys-whonix. Got a different teamviewer ID. Therefore team viewer ID is probably based something /etc/machine-id alike as unman previously pointed out. It's not /etc/machine-id specifically (tested to modify it in one VM) but must be some other shared identifier in root image. Therefore I suggest to close this issue as invalid. |
Qubes OS version:
R4.0
Affected component(s) or functionality:
whonix-gw in default configuration and every vm connected to it.
Steps to reproduce the behavior:
1.create 2 vm's one connected to sys-whonix and the other connected to sys-firewall
2.install and run teamviewer on both.
3.get the same ID on both despite having different ip adresses.
Expected or desired behavior:
1.create 2 vm's one connected to sys-whonix and the other connected to sys-firewall
2.install and run teamviewer on both.
3.get the different id's or have teamviewer not work because tor dont like udp and have your packets dropped because of this.
Actual behavior:
1.create 2 vm's one connected to sys-whonix and the other connected to sys-firewall
2.install and run teamviewer on both.
3.get the same ID on both despite having different ip adresses.
General notes:
whonix-gw-15 should ether torify or drop in default connection.
I have consulted the following relevant documentation:
https://www.qubes-os.org/doc/whonix/
https://www.whonix.org/wiki/Corridor
https://www.whonix.org/wiki/Multiple_Whonix-Workstation#Qubes-Whonix
I am aware of the following related, non-duplicate issues:
I dont know what exactly this section is for.
The text was updated successfully, but these errors were encountered: