Table of content

Downloading the TWS installer and update patches

The TWS installers available in the download areas of ibkr.com or IBKR regional web sites are sealed and digitally signed using all the safety procedures required by the industry standards and do not contain any malicious code or process. The same industry standard practices have been used for the TWS update patches, which are automatically downloaded and installed when launching the TWS (if and only if there is an update available). Nevertheless, if you have received an alert, we recommend you to be cautious. Should you intend to keep the TWS installation file on your machine for future use, you should make sure that the same precautions for the protection of data from viruses and malware are applied to it.

Why do I receive a warning when I install the TWS or when the TWS automatic update runs?

You might see an alert (similar to Figure 1 but not limited to) and your security system would wait for your input on how to process the suspicious file. You usually have the option to quarantine the file, delete it, ignore it once or create a permanent exception for it.

Please note that your antivirus might autonomously quarantine or delete the TWS installer file or some of his components without asking for your confirmation and without showing you any warning. Nevertheless, this should only happen if you have preset your antivirus to specifically react in this way.

Figure 1.

What should I do when I receive a warning?

In case you receive a warning during the TWS installation or update, we recommend the following steps:

1. Delete the TWS installer and download it again from the IBKR main or regional web site

a) Delete the TWS installer file already present on your computer and then delete it as well from your Trash (empty your Trash)

b) From the table below, click on the TWS download area correspondent to your location

c) Check the website certificate. Most Internet browsers will immediately alert you in case the site certificate is invalid, compromised or expired. Nevertheless, if you want to check manually the validity of the site certificate, click on the padlock close to the address (URL) and make sure the Connection is reported as secure and no security warning are present (see Figure 2 below).

Figure 2.

d) Click on the button labeled with the TWS version you wish to use and download again the TWS installer

2. Check the digital signature of the TWS installer file you have downloaded

Normally you will immediately receive a security warning in case the digital signature of a file is compromised. Nevertheless, if you wish to perform a manual check, proceed as follows, according to your Operating System:

For Windows

a) From the Windows file explorer, access your Downloads folder or the folder where you placed the TWS installer

b) Right click on the TWS installer file, select Properties and then click on the tab "Digital Signatures"

c) Click on "Details" and on "View Certificate" to check the certificate status and signer. The legitimate signer is "IB Exchange Corp." (See Figure 3 below)

Figure 3.

For Mac OS X

a) Click on the magnifier glass (Spotlight Search) on the top right of your screen and type Terminal. From the search results, launch the Terminal app

b) Type cd Downloads and press Enter

c) Type codesign -dv --verbose=4 tws-latest-macosx-x64.dmg and press Enter. Please notice that the name of the file (tws-latest-macosx-x64.dmg) may differ according to the TWS version you decided to download. If needed, replace the file name in the command with the appropriate one

d) Check the command output and make sure the "Developer ID Application" is "IB Exchange Corp." (see Figure 4 below)

Figure 4.

3. Run the TWS installer file you have downloaded

Once you have downloaded again the TWS installer and after you made sure the file is original (points 1. and 2. above), you can proceed with the installation. Should you still receive a warning from your antivirus, you can reasonably consider it as a false positive and ignore it.  Should you need guidance on this step, please proceed directly to the next section.

How can I signal an Alert as false positive?

All modern security systems allow the creation of exceptions, precisely in order to address false positive cases.  An exception is a rule forcing the antivirus engine not to scan a specific file or process. That specific file or process will hence be deemed safe and no further alerts will be raised for it.

The procedure for creating an exception may vary, according to the security software you are using. You may be able to create a temporary or permanent exception directly from the alert pop-up or you may have to create one manually from a specific section in the main configuration panel.

If you are unsure of the procedure, we recommend you to consult your antivirus documentation.

Once you have set an exception for the TWS installer file or for the TWS updater process, those will be no longer blocked and will be able to complete their respective tasks successfully.

What else can I do if I have doubts or if my system behaves abnormally?

If you have reasons to believe your machine may be compromised or infected, we recommend performing a full system scan. Usually you can right click on the antivirus icon present on the bottom taskbar (for Windows) or on the upper menu bar (for MacOS) and you will find the option to launch a full system scan. Alternatively, you may start that task from the main antivirus window. If you are unsure of the procedure, we recommend you to consult your antivirus documentation.

Technical Background

How does my security system scan the files I download from the Internet?

Modern antivirus and anti-malware engines base their threats recognition on:

Signature-based scanning: the antivirus scanner searches for a specific pattern of bytes that was previously catalogued as malicious or at least suspicious. The antivirus may check as well file signatures (called hash) against a database of known threats (called virus definitions).

Analysis of behavior: the antivirus engine detects specific actions which individually may not represent a threat but, when correlated together, resemble the usual activity of a malicious software (e.g. the ability of a code to replicate or hide itself, download additional files from the Internet, contact external hosts over the Internet, modify the Operating System registry) This type of scan is designed to detect previously unknown computer threats.

Heuristic detection: the scanner de-compiles the code or runs it within a virtual, restricted environment. It then classifies and weights the actions performed by the code against a predefined, behavior based, rule set.

Cloud-based protection and machine learning: those are relatively new techniques. The file that needs to be analyzed is sent to the antivirus / security system vendor cloud where sophisticated algorithms perform a deep analysis of the code authenticity and behavior.

Are those scan methods infallible?

Modern threats are very sophisticated and, like biological viruses, can mutate their code and their signatures. Moreover, new malwares and exploits are created every day and spread rapidly over the Internet. The threat recognition methods mentioned above are therefore not infallible but can guarantee a high percentage of malware recognition when combined together.

While signature based techniques are very successful in recognizing known threats and less prone to false positives, they are not so efficient in recognizing unknown malware or mutations of existing ones. In this area, the behavioral and heuristic methods perform much better although they are more prone to false positives since their detection is not based on bare code matching but on a certain degree of interpretation and hence uncertainty.

The term "false positive" is used when a security system classifies an innocuous file or process as malware.

Reference:

• Click here to find out more about Security Best Practices at IBKR

Table of contents

Configuration instructions

1. Can the TWS / IB Gateway operate through a Proxy server and how?
   
2. If I use a SOCKS Proxy server, do I need to configure the TWS / IB Gateway?
3. If I use a SOCKS Proxy server, do I need to configure the client machines where TWS / IB Gateway runs?
4. If I use a Web (HTTP) Proxy server, do I need to configure the TWS / IB Gateway?
   
5. What alternatives do I have in case I cannot implement a proxy solution on my network?

Common issues

6. Your computer is set up to use a Proxy but there is no actual Proxy running on the network

7. You are using Public proxies and proxy chains to hide your presence or identity

Technical Background

8. What is a Proxy server?
9. Which types of Proxy servers are commonly used and where?

Configuration instructions

1. Can the TWS / IB Gateway operate through a Proxy?

Upon start-up and as well during the run-time The TWS / IB Gateway needs to establish and maintain direct network connections to our gateways and market data servers¹. Such connections are created from random local TCP ports (above 1024) and are directed to TCP ports 4000 (or TCP 4001 if you tick the "Use SSL checkbox" within the TWS login screen).  Since those are not HTTP connections, they cannot be serviced by a Web (HTTP) Proxy. They can only be serviced by a SOCKS Proxy.

From within the TWS interface, you can access several external services, such as IBKR Client Portal, Statements, Contract details, Bond Search... Those services, being Web based, can be accessed through a Web (HTTP) Proxy (see section 6 for details and configuration) or through a SOCKS Proxy (see sections 4. and 5. for details and configuration). 

2. If I use a SOCKS Proxy server, do I need to configure the TWS / IB Gateway?

The TWS / IB Gateway does not contemplate an option for SOCKS proxy forwarding and hence does not have a place where an explicit SOCKS Proxy host/port can be configured. This does not mean that the TWS / IB Gateway cannot work with a Proxy. It simply means that the TWS / IB Gateway is unaware of the underlying SOCKS proxy set up (proxy-agnostic).

Important Note: While it is impossible for us to determine whether a Proxy is enabled on your network, we assure you that all IBKR platforms, including the TWS, do not impact nor influence your network configuration.

3. If I use a SOCKS Proxy server, do I need to configure the client machines where TWS / IB Gateway runs?

The connections started by the TWS / IB Gateway can be redirected to a SOCKS (Application) Proxy through a specific client machine setup. We mention some of them below. Please note, that the final decision is yours and none of the below suggestions can be recommended by us as best adapted to your setup and requirements.

3a. Using a Proxy Client software installed on the client machine where TWS / IB Gateway is running

With this setup the Proxy client will intercept the connections (not only HTTP but for other ports as well) initiated by the TWS / IB Gateway and redirect them to a SOCKS proxy server. . The typical benefits of a transparent proxy include a standard enterprise
configuration where all clients routed to the internet will always be filtered and protected no matter what the end users do, or change, on their machines and the added benefit of reduction in typical user’s client-proxy configuration troubleshooting.

3b. Using a so-called Proxifier

This configuration is very similar to the one at point 5a with the only difference that the Proxifier software can be set to redirect to a Proxy all the request started by a specific process (e.g. C:\Jts\tws.exe ; C:\JTS\ibgateway\XYZ\ibgateway.exe), hence instating a process level packet
forwarding instead of a port level forwarding. This set up allows handling environments where different proxy servers are used for different applications or where you would like to address a specific application requirement without modifying/disrupting the connectivity schema for other software installed. The advantage of this solution is a minimal maintenance since the connectivity schema is bound to the process and not to the hosts/ports.

3c. Using specific network routing on client machine

With this setup you can modify the client machine standard network routes, adding new ones in order to forward packets with specific destinations (e.g. Order routing and Market Data servers¹) to a different gateway.
This gateway will then be in charge of routing those request to the destination hosts. This solution has as well the benefit of not modifying/disrupting the connectivity schema for other software installed but usually require more maintenance on the gateway and on the client machined in case the IP of the destination servers are changed or in case new servers are added.

4. If I use a Web (HTTP) Proxy server, do I need to configure the TWS / IB Gateway?

If the Workstations on your local network access the Web content through a Web (HTTP) Proxy, you need to specify the Web Proxy IP Address and port. To do this, click on More Options at the bottom of the TWS Login Screen, and enter your Proxy server details in the fields Host and Port (see Figure 1 below). The same fields are present in the IB Gateway Login Screen.

Figure 1.

The Web Proxy you set there will ONLY be used to fetch the web content accessible from within the TWS (e.g. Client Portal, Statements, Product Details, etc.)

5. What alternatives do I have in case I cannot implement a proxy solution on my network?
In this case you might orient yourself towards a different type of access to the IBKR infrastructure, which includes a special connection type and a FIX/CTCI engine setup. This setup would, on the other hand, have different requirements as well in terms of commissions².  

Common Issues

6. What happens if the proxy configuration on your computer is wrong or outdated?

Occasionally, a third-party software, even if already uninstalled, may left behind a SOCKS proxy configuration on your computer. This may also happen if your computer has been infected with malware. In such cases, the proxy server, although configured, is actually non-existent or not accessible on the network. In such scenarios, the TWS will show an error message (e.g. No Internet Connectivity) and/or start the "Connection attempt #" loop upon login. The same will happen if the Proxy server exists but it has not been correctly configured on the client machines.

6a. How can I correct the proxy configuration if wrong?

When applicable, we recommend you to always consult the IT / Networking team of your company first and ask for guidance.

If you are autonomously managing your network, please follow the instructions below according to the Operating System of your machine/s:

Windows

W.1 Press CTRL+S to open the Windows search

W.2 Type Proxy Settings and press Enter

W.3 If no Proxy is present on your network, make sure the switch "Use a proxy server" is deactivated (see Figure 2 below). If a Proxy server is active on your network, make sure the Address (or hostname) and Port are correctly defined.

Figure 2.

Mac

M.1 Click on the Apple icon at the top left corner of the screen and select System Preferences

M.2 Click on Network

M.3 Select the Network connection you are using to access the Internet (e.g. Wi-Fi) and click on it

M.4 Click on the Advanced button and then on the Proxies tab

5. If no Proxy is present on your network, make sure all the checkboxes (SOCKS Proxy, Web Proxy, Secure Web Proxy) are deactivated (see Figure 3 below). If a Proxy is present on your network, make sure the Protocol, Address (or hostname) and Port are correct.

Figure 3.

7. You are using Public proxies and proxy chains to hide your presence or identity

There are public proxy and proxy chains services purposed to disguise or hide the identity and the activity of the subscriber or to bypass regional restrictions. One of the most famous of such services is the "Tor" network.

While those services may not necessarily be used for criminal purposes, they render the subscriber traceability very difficult when not impossible. Since IBKR is obliged by the financial industry regulators to maintain records of trading activities and trade initiators, we do not allow our clients to reach our systems while using an anonymizing service. If you are using such service, your TWS connection attempts will be automatically rejected by our gateways.

Technical Background

8. What is a Proxy Server?

A Proxy Server usually acts as a gateway and as a barrier between your local network and the Internet. The Proxy listens for outgoing connection requests from the internal workstation/s and forwards them to the desired target host or service on the Internet. When the target replies to such requests, the Proxy takes care of routing the incoming responses back to the internal workstation/s that initiated the process.

Being the Proxy the only machine of your network actually accessing the Internet, it prevents the other machines and the internal segment of your network (LAN) from being accessible by external actors and hence from being exposed to threats and intrusion attempts.

Additionally, a Proxy server can offer a variety of other services such as web content caching and filtering.

9. Which types of Proxy servers are commonly used and where?

Proxy server are commonly found within enterprise-grade networks. In the vast majority of cases proxies are not used by individuals since private broadband connections are established through consumer-grade routers that already offer built-in proxy/firewall solutions. An exception is represented by public proxy or proxy chains discussed in details in the section You are using Public proxies and proxy chains to hide your presence or identity

There are two main types of Proxy servers:

9a. Web (HTTP) Proxies

The HTTP (Hypertext Transfer Protocol) defines the rules and the standards for fetching Web content from a Web server and rendering such content on your Web Browser.

A Web Proxy handles only the routing of HTTP requests and HTTP responses. Those requests are transparently generated and sent by your browser whenever you access a Web page.  Such requests are normally sent using specific ports (TCP 80 and TCP 443), hence a Web Proxy usually listens for outgoing HTTP requests coming from your internal network (LAN) only on the TCP ports mentioned above.

9b. SOCKS Proxies

SOCKS (Socket Secure) Proxies are designed to handle any type of traffic (not only HTTP/S traffic), generated by any protocol or program (including Trader Workstation).

Notes

1. More information about the servers accessed by the TWS are available in IBKB2816.

2. For an overview of the different special connection options and related requirements, please click here.
For an overview of the FIX infrastructure, please click here

Procedure:

 

7. Once the installation has completed successfully, repeat the previous steps from 1. to 5. setting back the permissions of “everyone” to “Read Only” to revert your changes to the initial status