You use vpn για ασφάλεια; Ένας ερευνητής () tested 70 different VPN and found that 16 of these revealed the actual IP over WebRTC. The leakage rate reaches 23%.
The full list of VPN providers tested by the researcher is as follows:
What is WebRTC?
WebRTC is a free, open project that provides real-time (RTC) communication capabilities to browsers and mobile applications through simple APIs.
It includes fundamental tools for high quality web communications, as well as network, audio and video tools used in chat and video applications. When all of the above can be accessed through a JavaScript API in the browser, allowing developers to easily apply them to their RTC application.
STUN - ICE
It is a tool that allows calls to use the STUN and ICE mechanisms to create connections between different types of networks. The STUN server sends a ping back that contains the IP address and client port.
These STNs (Utilities Traversal Session for NAT) are used by VPNs to translate a local IP address into a new public IP address and vice versa.
To do this, the STUN server maintains a table of both the public IP VPN and the actual IP that you have during the connection.
The router στο σπίτι σας διαθέτουν μια παρόμοια λειτουργία για τη μετάφραση ιδιωτικών διευθύνσεων IP σε δημόσιες και αντίστροφα.
WebRTC allows requests to STUN servers that return the "hidden" IP address (yes your real IP) as well as the local network addresses of the system used by the user.
The results of the requests can be viewed using JavaScript, but because they are made outside of the normal XML/HTTP request process, they are not visible from the console programmer.
The only requirement for this de-anonymizing technique to work is to support WebRTC and JavaScript from the browser.
VPN and WebRTC
The technique can be used for de-anonymize and trace users behind: VPN, SOCKS Proxy, HTTP Proxy and older TOR versions.
The following list contains browsers that have WebRTC enabled
Το 23% από τα VPNs και τα Proxies services που δοκίμασε ο ερευνητής βρέθηκαν να αποκαλύπτουν τις πραγματικές IP.
Protection
Follow these steps to protect your true IP:
- Amactivation of WebRTC
- Disable JavaScript (or at least some features, use NoScript)
- Disable Canvas Rendering (Web API)
- Always set a DNS fallback for each connection / network adapter
- Always close browsers before and after using a VPN connection
- Clean the cache browser, history, and cookies
- Exclude all outgoing connections outside the VPN provider
PoC:
Check if your VPN reveals your real IP
