You use a VPN for better safety; A researcher () tested 70 different VPN and found that 16 of these revealed the actual IP over WebRTC. The leakage rate reaches 23%.
The full list of VPN providers tested by the researcher is as follows:
What is WebRTC?
WebRTC is a free, open project that provides real-time (RTC) communication capabilities to browsers and mobile applications through simple APIs.
It includes fundamental tools for high-quality communications on the web, as well as network, audio, and video tools used in chat and video applications. When all of the above can be accessed through one JavaScript API in the browser, allowing developers to easily implement them into their own RTC application.
STUN - ICE
It is a tool that allows calls to use the STUN and ICE mechanisms to create connections between different types of networks. The STUN server sends a ping back that contains the IP address and client port.
These STNs (Utilities Traversal Session for NAT) are used by VPNs to translate a local IP address into a new public IP address and vice versa.
To do this, the STUN server maintains a table of both the public IP VPN and the actual IP that you have during the connection.
Your home router has a similar function for translating private IP addresses into public and vice versa.
WebRTC allows requests to STUN servers that return the "hidden" IP address (yes your real IP) as well as the local network addresses of the system used by the user.
The results of the requests can be made visible using JavaScript, but because they are out of the normal XML / HTTP request process, they are not seen by the developer console.
The only requirement for this de-anonymizing technique to work is to support WebRTC and JavaScript from the browser.
VPN and WebRTC
The technique can be used for de-anonymize and trace users behind: VPN, SOCKS Proxy, HTTP Proxy and older TOR versions.
The following list contains browsers that have WebRTC enabled
23% of VPNs and Proxies services tested by the researcher were found to reveal the real IPs.
Protection
Follow these steps to protect your true IP:
- Disable WebRTC
- Disable JavaScript (or at least some features, use NoScript)
- Disable Canvas Rendering (Web API)
- Always set a DNS fallback for each connection / network adapter
- Always close browsers before and after using a VPN connection
- Clean the cache browser, history, and cookies
- Exclude all outgoing connections outside the VPN provider
PoC:
Check if your VPN reveals your real IP
