2

While I was reading an article about proxy chaining

https://resources.infosecinstitute.com/proxy-chaining/

I've stumbled upon this paragraph

Even if you use proxy chaining you can’t be 100% anonymous. You could be traced on the basis of each proxy used to establish a connection. It just makes it a lot harder to track. If you use foreign proxies, then it will be more complicated to find someone. Tracking could be done only by collecting the logs of each proxies used from the administrator. This could take a lot of time if we use a foreign proxy.

I'm not sure if i understand that correctly but from what I know about the workings of SOCKS proxies, they are raw TCP connections that relay the TCP stream to the specified address. With that in mind, consider this example:

I want to connect to someserver.com but lets say due to censorship I cannot do that openly because the ISP will give me trouble, now I want to connect to that server through a proxy chain (consisting of 3 socks5 proxies)

This will look something like this

ME -> (ISP) -> P1 -> P2 -> P3 -> someserver.com

In this situation someserver.com sees me (my IP) as P3 which is expected, but my ISP should see me connect to P1, P2 and P3 due to SOCKS5 being raw TCP so in theory they can clearly see where I am connecting because all the plain TCP connections are made through them and are unencrypted.

Why would the ISP had a need to get logs from all the proxies to know where I'm connecting if according to what I wrote above they should already know that?

| improve this question | | | | |
0

SOCKS protocol does not prevent the ISP from spying the traffic. It prevents the receiver server from detecting who is connecting to it.

The qouted passage talks about someserver.com or its ISP. If someone in the network of someserver.com wants to identify who connected to it, he needs somehow also to eavesdrop the traffic between all proxy servers, or get their logs.

Your ISP will see your identity on the first connection. SOCKS5 Packets will contain the final destination IP and the source IP and can be eavesdroped via deep package inspection.

The content of this packages can be encrypted. However, as you stated, the ip headers are passed in clear text. In order to prevent your ISP from knowing where you connect - VPN or Tor can be used.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.