Anonymous in the Internet?

  • May 5, 2008
  • 9 min read

This guest article by Frank Richter (www.security-dome.eu German) deals with questions such as “Is it possible to navigate the Internet anonymously?” and “What anonymization methods can be used to leave fewer traces without endangering my own security?”.

Technical basics:

When Internet pages are called up, particular technical processes occur that provide larger or smaller amounts of data. These are briefly described below.

Creating the connection:

When an address is entered into a browser, a connection is created between your computer and a DNS server, which converts the address into an IP address. This IP address is sent back to the browser, which then calls up this address. This process is called “name resolution”. If the specified address of the web server actually exists, then a connection to this web server is then created. When doing this, the web server is informed of your IP address, since the web server needs to know where it is to send the response.

Page creation:

After a connection is created using the so-called 3-way handshake, the web server then sends the page you requested. However, further data is sent before this occurs:

If you did not manually enter the address into the browser but clicked on a link, then the web server also receives information on the page from which you came (Referrer). However, these are not the only methods of acquiring data.

Cookies:

If Cookies are accepted and stored by your Browser then the page operator can read more information:

If the site requires a login, then the user name and password are sometimes stored here (sometimes even in PLAIN TEXT).

Scripts:

If you allow scripts to run (e.g. ActiveX, Java etc.) then the possibilities are almost unlimited! Everything can now be read out and discovered. Programs and damaging routines can also be executed. The limits here are defined by the possibilities of the scripting language and the access rights under which you have started the Browser (using administrative rights or limited user rights).

Prerequisites:

As you can see from the abovementioned basics, anonymization requires important prerequisites to be carried out by the user!

If you allow Cookies or Scripts then anonymity is not longer possible, since the page operators can use both of these techniques to read out important individual information and can thus bypass any anonymization service you may be using!

For example, an embedded Script in a web page can be used to find your true IP address.

Cookies can be used to assign unique identification numbers to a user and recognize them when they return to the website.

Anonymization:

The various anonymization techniques are implemented at different communication points. Some of these simply hide your true IP address. Others swap Referrer or Cookie information to make them no longer usable.

Other techniques rely on complete encryption of all communication and even direct end-to-end connections.

Important:

Whatever technique you use, they all have a decisive disadvantage! You must always rely on a third party! I.e. you are dependent on the trust / trustworthiness of this third party!

For this reason, anonymization programs should not be used for any type of Internet business! For example:

In the case of other services requiring a login, e.g. email retrieval, forum logins, etc., the use of anonymization programs should be very carefully considered!!

Anonymization techniques:

There are a number of different anonymization techniques available. These are described below:

Anonymization of single pages:

Anonymization of single Internet pages is the simplest way of attempting to hide your true origins. This is done using a simple website that has at least one data entry field where you can enter the address of the desired web page. The service then requests the page on your behalf.

Please note that only the first page is anonymized, if at all. As soon as you navigate within this page, the page is then requested directly by your browser and not via the anonymization service.

Functions:

Some of the web anonymization services offer additional functions, but only when scripting is allowed:

Proxy solutions:

There are various different proxy solutions offering different advantages and disadvantages:

Both solutions use Proxy lists that are more or less regularly updated. Many solutions of this type are free of charge. The Proxy servers in the proxy lists are distributed worldwide. In some cases a “Security rating” is provided for the Proxy servers – the user must decide how reliable this rating is.

Proxy as a Browser Plugin:

Plugins are especially available for the Firefox Browser that promise anonymization without modifying the system. One of these is (e.g.) “FoxyProxy”. Anonymized surfing via a proxy can be directly activated from within Firefox. No further settings need to be made. However, setting this up cannot be described as trivial because the functions are distributed over several windows.

Proxy solution as an independent program:

There are uncountable numbers of independent proxy programs that must be installed as normal applications. With most of them, comprehensive changes to the Browser connection parameters are necessary:

Some solutions offer automatic configuration of the necessary settings for the most common Browsers. If you wish to then again surf without a proxy, the settings must be reset or direct connections with the Browser are not longer possible.

Some examples of these programs are:

Note:

Local or Browser-integrated installation of Proxy solutions always carries the danger of user information being transferred (I mean this in a general sense, and not in relation to any specific program).

For this reason, you should always choose a trustworthy manufacturer.

When using Proxy servers, the danger of analysis of the data cannot be ruled out. Since encryption is not used, the data can always be read while it is underway.

Cascaded proxy solutions:

Cascaded, Mix, and Mix Cascaded Proxies are networks with several Proxy servers connected in series. The requests from a computer are then sent through several Proxy servers. Each respective Proxy server sends the request to the next Proxy server under its own name. This means that only the first Proxy server after the requesting client (your computer) knows the true origin of the request. The response follows the same path as the request.

In some cases the traffic is even encrypted.

The most well-known systems are:

JAP:

JAP (Java Anon Proxy) is special client software that uses the AN.ON Mix-Cascaded Proxy network. AN.ON is an initiative of the “Independent Regional Center for Data Protection in Schleswig-Holstein” (“Unabhängiges Landeszentrum für Datenschutz in Schleswig-Holstein”).

The JAP client software was developed by the Dresden Technical University and the University of Regensburg. A commercial service called “Jondos GmbH” now also exists.

JAP uses the “JAVA” programming language and can therefore run on almost every operating system. However, to use JAP you must install the “JAVA” software from “Sun”.

If JAP is locally installed then the Browser settings must be changed to use this. The Proxy server must be set to the “LocalHost” address 127.0.0.1 and the port to “4001”.

A portable version is also available.

In this context it is important to note that all operators of a JAP MIX server must provide a “Self declaration”. This states that Log files are not used and that data is not exchanged with other MIX operators.

TOR:

The MIX Cascade network from TOR is a very similar solution. However, TOR relies on a decentralized network that does not require a specially selected server. TOR is also available as a locally installed version and an independent (portable) version.

Browser Plugin:

Cascaded Mix solutions are also available as Firefox Plugins that support both the JAP and TOR networks.

Independent programs:

In addition to the pure JAP or TOR clients, there are also independent solutions based on this technique.

“Torpark” is a very interesting example. The commercial version is called “XeroBank Browser” or “xB Browser” for short. The solution is based on an independent modified Firefox Browser that automatically connected to the “TOR Network” when started. The following commercial versions of the “XeroBank Browser” are available:

The following interesting advantages are offered:

Warning:

Some of the different versions are classed as “Risk tools”. This means that the user must assess the risks and these cannot be evaluated here.

Anonymization via encryption techniques:

This anonymization technique using encryption can certainly be described as the “ideal solution”. Whereas “normal” Proxy solutions also offer HTTPS encryption and Mix Cascaded Proxys encrypt internal traffic, VPN techniques use encryption for a complete end to end connection.

VPN technique:

VPN (Virtual Private Network) techniques have been developed to implement secure encrypted “Site-to-Site”, “Site-to-End” or “End-to-End” connections.

In the case of anonymization, a “tunneled” connection is created between the client and the VPN server. This connection is basically encrypted. The special possibilities of VPN are used here. This means that, in principle, every protocol can be “tunneled” and encrypted. This allows a public network to be used for transporting private (encrypted) data. The recipient can decrypt the private data and process it as they wish.

VPN is a solution conceived for security from the very beginning. It is based on a number of different protocols:

Anonymization over VPN:

This type of anonymization uses an encrypted connection between the client computer and a VPN server. This VPN server also functions as a Proxy server that requests the desired Internet content and sends it encrypted to the client.

The process works as follows:

This means that the provider has no knowledge of the content or the requested address. The Internet service (e.g. web server) has no knowledge of the true origin of the request.

However, the operator of the VPN and Proxy system knows both the origin and the content of the request.

Software solutions:

A number of suppliers also offer this technique:

CyberGhost VPN is currently the only supplier offering a service free of charge, but with certain limitations. The limitations relate to the volume of the data (currently 10GB/month), limited availability with waiting times, and compulsory disconnection after 6 hours.

Advantages:

At the very least, the Archicrypt Stealth VPN solution supports EVERY protocol (except anonymized email traffic to prevent misuse). This means that every program using the Internet is automatically encrypted. Archicrypt Stealth VPN must be installed on the computer. A quick overview of the advantages:

Important:

When using VPN-based anonymization services, you should note the location of the VPN server. If this lies in another country then checking is very difficult. If the VPN server is located in Germany then the provider is obliged to implement data retention measures.

Connection technologies:

From a technical point of view, a direct connection (i.e. without an anonymizer proxy) is a 3-step connection:

Client (your computer/requesting computer) –> Provider (forwarder incl. DNS name resolution) –> requested server (the requested page)

If a Proxy solution is used then this results in a 4-step connection:

Client (your computer/requesting computer) –> Provider (forwarder incl. DNS name resolution) –> Proxy-server –> requested server (the requested page)

The “Proxy server” step can consist of multiple servers (see –> “Cascaded Proxy solutions”), which are shown as a single step here for the sake of simplicity (so-called network cloud).

Summary:

The following points should always be remembered:

Frank Richter – www.security-dome.eu

Emsisoft Enterprise Security + EDR

Robust and proven endpoint security solution for organizations of all sizes. Start free trial

Have a Great (Malware-Free) Day!

What to read next

Newsletter

Malware never sleeps. Be sure to stay up-to-date on emerging threats.

Emsisoft > Blog > Malware Lab > Anonymous in the Internet?