SocksTrace: A Proxy Leak Detector for Anonymity-Focused Network Applications
summary
SocksTrace intercepts network syscalls using seccomp user space notifications to flag and optionally block connections that bypass Tor, and it can perform socksification by completing a SOCKS5 handshake and handing a proxied socket back to the application. It finds subtle cases like a Firefox WebRTC UDP connect that never sent packets, enforces stream isolation by rotating among 10 Tor circuits, speeds 50,000-block sync worst-case from 3.5 to 2 minutes, and remains a research-stage prototype with DNS handling missing.
AI-written summary · about
chapters (15)
- 0:00Socktrace introduction
- 0:48Network anonymity in Monero
- 2:32Proxy leaks with seccomp
- 4:37Socktrace leak modes
- 5:41Seccomp vs ptrace
- 7:06Demo Monero leaks
- 8:10Firefox WebRTC leaks
- 9:53Tor stream isolation
- 11:38Performance with isolation
- 12:42Auditing isolation
- 13:44CI testing with Socktrace
- 15:26Socktrace vs Onyx
- 16:09Socktrace status
- 17:10Q&A LXC containers
- 18:33Q&A TEEs and Tor
related talks
12mHTTPT: A Probe-Resistant Proxy
11mTurbo Tunnel, a good way to design censorship circumvention protocols
44mNetsec is Dead(?): Modern Network Fingerprinting for...
24mTales From the Trenches: Fingerprints on the Web
20mDemystifying the Darknet in 30mns or Less
06mNetwork-level Anonymity and Transaction Privacy
23mTowards Predicting Efficient and Anonymous Tor Circuits
42mPrivacy Toolkit: Privacy Awareness In The Digital Age