Let me introduce you to Whonix.
Whonix is a free open source operating system
that's focused specifically on anonymity, privacy, and security.
It uses the TOR anonymity network
which we cover in detail in its own section,
and it's based on Debian GNU Linux,
one of the operating systems I highly recommend,
as you should know already by now.
Whonix implements security through isolation,
which is why it's here in the section on isolation.
It's an operating system that specifically
uses the principle of isolation to enable security
for privacy and anonymity.
What does Whonix help you do?
Well, it will help you hide your
internet service provider assigned IP address,
it will prevent your ISP from spying on you,
it can prevent websites from identifying you,
it can prevent malware from identifying you,
and it can help you circumvent censorship.
Whonix isn't like the other operating systems
and live operating systems we have gone through,
in that it is focused on the principle of isolation.
The Whonix developers provide a nice summary of what
Whonix is and this is what they have to say.
Whonix consists of two parts.
One solely runs TOR and acts as a gateway,
which they call the Whonix Gateway,
and which you can see here in VirtualBox.
The other, which they call the Whonix Workstation,
is on a completely isolated network,
only connections through TOR are possible.
With Whonix you can use applications
and run servers anonymously over the internet.
DNS leaks for all intents and purposes are impossible
and not even malware with root privileges
can find out the user's real internet assigned IP address.
So as you can see here, the workstation
and the gateway are virtual machines
available for download in the OVA format,
which is an open standard for packaging
and distributing virtual applications.
We went through how to use these already
in setting up a testing environment.
This is where you would download the OVA virtual machines,
the workstation and the gateway.
So you would need to download
and import into VirtualBox
and you're good to go for testing out Whonix.
You can also download the scripts
and install Whonix from source.
As you can see here, Whonix works in VirtualBox, KVM and Qubes.
Qubes we haven't discussed yet, Qubes we're going to discuss later.
For the best security you would use Whonix with Qubes,
and then a step down would be to use it with KVM,
and a step down further would be to use it with VirtualBox.
But there's no reason why you can't use it with VirtualBox for testing it out
and having a play with it.
VirtualBox is not inherently insecure,
it's just that KVM and particularly Qubes
are a much more secure solution to put Whonix on.
But as I said, we're going to cover Qubes a little bit later on.
But no matter what hypervisor you use,
it is two virtual machines, it is the gateway here,
and it is a workstation here.
Let me show you the network configuration,
and all of the settings and configurations
work straight out of the box because it's an OVA file,
so you don't have to change
these network settings that I'm about to show you.
So if you look here, you can see adapter one is on NAT
and adapter two is on internal network
and the network name is Whonix.
So two network adapters,
this one is going on to my local network
and therefore will go to the internet because it's assigned DHCP
from my router and firewall.
And then here is the internal network
that is created, called the Whonix network,
there is no other network.
Now, if we go to the workstation,
look at its network settings,
and you can see its network adapter is set to be on the Whonix network,
the internal network,
so the workstation is only connected to the gateway,
it is not connected to my local LAN in any way.
So as the Whonix gateway name suggests,
a gateway is a gateway for the workstation.
So let me start the gateway and show you what this looks like.
The gateway has to be started first
because that creates the TOR connection.
So there it's starting.
And this is a KDE desktop and it starts to do its initial checks.
I’ll install the workstation.
And you can see the workstation is also doing its initial checks.
I'll show you how that network isolation
is configured here on the workstation
and there you can see the IP address,
10.152.152.11 for the workstation.
And for eth1, which is the local VM only network,
is the 10.152.152.10 IP address for the gateway,
they both have slash 18 subnets.
Then if we look at the root,
we can see that the workstation has
10.152.152.10 as its default gateway,
so all traffic is being sent to the gateway.
The workstation here is used for your tasks
like email, browsing the web,
and the gateway's role is to enforce the TOR connection,
this is the network isolation.
The workstation cannot tell what it's real IP address is,
so neither can an adversary
who may have happened to hack
the workstation via say a browser hack or a phishing attack.
Which is why they say leaks are impossible in Whonix
and malware with even root privileges
cannot find out the user's real IP address,
this is the isolation principle.
It's not technically impossible, but it is more difficult,
because as you can see, any malware that's on here
would have to hack this gateway via the network,
or find some other way to determine the real IP address,
so it's much more difficult.
Also because we're using VMs, hardware IDs
and Mac addresses are also protected
as virtual machines act as isolation
from the host and other VMs.
So there you are, you can see browsing the web using Tor.
Let's have a look at the gateway first,
so let's start at the top here.
What we're looking at here is something called ARM.
It's the anonymizing relay monitor,
so it's like a status monitor for TOR and for this gateway.
It shows things like resource usage, bandwidth, CPU.
It's a little bit like Top but for TOR.
So you can see there
some data being downloaded from the workstation.
If I press M
you'll see similar sort of functionality as you do in the TOR browser.
So I can create a new identity, I can stop TOR, restart,
I can go through the setup wizard
and set the gateway up as a relay or bridge or client,
that's not going to mean much to you yet unless you understand TOR,
but we do cover all this in the section on TOR,
so don't worry about that for now.
Then you can view the connections,
various circuits there that set up,
the current configurations,
the talk file, talk file is used to configure TOR,
again we're going to talk through this later in section on TOR.
So that's arm, you can think of it as top for TOR.
Next is time sync.
TOR requires an accurate time or it will fail to work.
Establishing the correct time using standard methods
such as an unauthenticated NTP is a potential deanonymizer,
so Whonix has to use another method.
Whonix uses something called SDW date
and this is it now running in order to try and establish the time.
When Whonix starts, if it doesn't believe it has the correct time,
it will automatically start time sync
and as it says here, don't use the internet
until time sync has been successful.
While waiting for that, there's also Whonix check,
this checks the VM, it looks for TOR browser updates,
OS updates, Whonix versions, Whonix news,
plus a long list of other checks that it does.
So we can see there the time sync was good.
And this is the Whonix check
and you can see here this is warning me
that you need to do an app-get update and an app-get dist upgrade
in order to get the latest packages from Debian and Whonix.
That check happens every time you start the virtual machines.
You can make configurations to the talk file using this link here.
We cover the talk file in the section on TOR.
I've got an extra setting here, Sandbox 1.
You can make user firewall setting changes,
these are the global settings,
and this is where a lot of the gateway’s configuration
is as to what it does,
whether it's a transparent proxy, on what port,
and so on.
One of the best things about Whonix
is the Whonix gateway itself.
Any VM, not just a Whonix workstation,
as long as it's configured correctly,
could use the Whonix gateway
to take advantage of its security features
and the torrification of that internet connection.
In fact, you don't technically have to be a VM either.
If the gateway is configured in a certain way,
a physical machine could also use the gateway.
If you want to connect your own workstation
to the Whonix gateway,
then you will need to connect it to the Whonix network,
as we saw here.
Once it's on the Whonix network,
it needs to have the right IP addresses set up.
You can use the IP address of the workstation
if you're not using the workstation 10.152.152.11,
but I believe you can use any IP address that's in that subnet.
So for example I've got a workstation with dot 50,
it'll need a subnet mask which is slash 18.
which translates into 255.255.192.0,
your default gateway should be settled obviously as the Whonix gateway
which always has this address 10.152.152.10
and preferred DNR should also be the same,
and then your own custom workstations should work
with the Whonix gateway.
Your own custom workstation is inferior
if you're not using socks proxy.
So that's something you're going to have to look into
setting up if you want to use your own work station,
but that's a more advanced usage of Whonix.
And there’s a useful link here for setting up your own workstation,
so check that out.
What you can see here is a representation
of the Whonix workstation here,
the Whonix gateway here
and then the three hop circuit of the TOR network,
first node, second node, third node, and then the destination.
The Whonix gateway here
acts as both a transparent TOR proxy and a socks proxy.
Transparent means that even if downloaded applications
aren't configure to use TOR,
they will still go through the Whonix gateway
and be transparently torrified,
transparent as in transparent TOR proxy.
This is a good feature,
it means you can download and install things that you need
and they don't need to be specifically configured to use TOR,
they can go through the transparent proxy.
But note, all trans proxied apps use the same TOR circuit.
As you can see illustrated here,
it goes through the same nodes,
they'll have the same exit IP address
and be seen as the same to the destination.
Now, socks proxies on the other hand,
is used when an application is specifically
configured to use TOR as a proxy.
So for example, the proxy settings within the browser.
If you look here, these are the socks proxied applications
within Whonix and the ports that they use
and whether they are preinstalled and preconfigured to use socks.
So you can see the TOR browser here
is connecting locally on the workstation
on port 9150 and is using the socks proxy.
If you install Thunderbird,
then this will also use a socks proxy.
There's also command line apps
that you do need to go through TOR,
and of course these also go through the socks proxy,
so you've got things like wget, curl,
aptitude and app get for downloading your apps from the repository,
so plenty of preconfigured
applications to use as socks proxy.
And that's good, because using the socks proxy
is better for security
because it provides what is called stream isolation, i.e.
each application uses a different TOR circuit, as illustrated here.
So you can see this one's going that way,
this one's going that way,
this one's going that way.
Therefore, each application going through the socks proxy
potentially has a different IP address.
Not always, they may have a different circuit,
but their exit may be the same.
Even so, this protects against identity correlation attacks
because of TOR circuit sharing.
It is recommended you use a different workstation
per alias to prevent correlation attacks.
I talk more on correlation attacks in the section on TOR.
If you want to get a little bit more advanced with Whonix,
it is possible to run Whonix on a physical machine
to provide physical isolation,
which has its security pros and cons.
The Whonix gateway is best to be physically isolated
and if you want to know more about that,
read here and understand the various options,
and the pros and cons if you want to
consider going down the physical isolation route.
Let's have a look at the workstation now.
As I said, this is where you use the internet
and you find the TOR browser.
You'll find the workstation to be very sparse on applications,
this is by design to reduce the possible attack surface.
So if you're looking at applications here,
you can go through and have a look what they've got.
As I said, not too much,
but that's by design.
But you're able to install any applications that you want,
and after installing, it will use the trans proxy
unless you specifically configure it to use a socks proxy.
You download apps in just the same way as on any other Debian distribution.
So for example that's how you install
Icedove, Enigmail and Torbirdy,
just the same app get or aptitude, there's no restrictions.
Check here for what socks proxies might be available
for any apps that you might want to install.
What's great is that whatever you install,
will go through the gateway and it will be torrified,
so there's no chance of leaks.
With any operating system where TOR
isn't happening on a gateway,
newly installed applications could leak.
This is why it's not advisable to install applications on Tails
because the torrification happens within Tails,
so you need to specifically configure applications
to go through TOR socks proxies
or TOR transparent proxies.
Let's look at its features list here.
So obviously you got a lot of anonymous services,
you can do IRC, you can do email,
as we said it's based on Debian, which is great.
It's also based on TOR, you can use it with VirtualBox,
although VirtualBox is not recommended
for the most secure configuration.
As it says here, you can torrify almost any application,
that's one of its major major bonuses,
and you can potentially torify any operating system as well.
If you set up your own workstation DNSSEC over TOR,
encrypted DNS.
It's free open source
and you have the IP DNS leak protection,
which is so important, and the list goes on.
Oh yes, it also includes JonDonym
and it can also be used for torring anonymizing services
through other anonymizing services.
We talk about that in its own section.
And here it's got some advantages of Whonix,
what do we think of these.
Install any software package, that's a great feature.
That’s a great advantage over live operating systems
where you cannot do that.
And then all the rest of this is about preventing leaks
which again is its main benefit really because of the isolation.
Let me read a couple of recommendations
from the Whonix site
which I think are important for you to know about.
So it's recommended that you keep a master copy
of Whonix workstation, keep it updated,
make regular clean snapshots, but do not edit any settings
or install additional software, or use it directly for any activity.
Instead, make a clone
or use snapshotting,
but never mix up clean and unclean states
for activities that require anonymity.
After importing the VMs,
do a first run of the Whonix gateway
and workstation virtual machines, securely update it,
after that stop and do not browse anywhere
or open any unauthenticated
communication channel to the internet.
Shut down the virtual machines and create snapshots
of their clean state before browsing
or initiating any connections with the outside world.
Note, the only exception to this is running APT
which has a guaranteed way
of securely downloading and verifying packages.
So some important steps there that you should follow.