Infosecurity.US

Security and the Net has published a superb write-up of the newly updated Metasploit decloaking engine, utilized to determine the original (supposedly anonymized)  IP of a connecting machine (when that computer is  tunneling its’ network communications through an anonymous proxy).  More information regarding the capabilities of the Metasploit Decloaker, and how to find the original IP, even with an anonymous proxy server running) appears after the jump.

From Security And The Net: “As more people are becoming concerned about their online privacy, the use of tools to protect that privacy such as Tor and Privoxy is getting more common. One of the main features that these offer are “hiding” your IP address; privoxy by offering the option to send all your traffic through a proxy server, and Tor by even more advanced routing…”

“Metasploit has just published an updated version of their decloaking engine that shows how easy it is to bypass these tools. Most of them depend on configuring a proxy server in all your applications, forcing them to send all traffic through the anonymizing software. But security is only as strong as the weakest link; your webbrowser has the ability to start all kinds of external programs automatically. Decloak.net uses that fact to bypass popular anonymizing software…”