Do you use VPN for security? A researcher () tested 70 different VPN and found that 16 of these revealed the actual IP over WebRTC. The leakage rate reaches 23%.
The full list of VPN providers tested by the researcher is as follows:
What is WebRTC?
WebRTC is a free, open project which provides to preletterbrowsing and mobile applications real-time communication (RTC) capabilities through simple APIs.
It includes fundamental tools for high quality web communications, as well as network, audio and video tools used in chat and video applications. When all of the above can be accessed through a JavaScript API in the browser, allowing developers to easily apply them to their RTC application.
STUN - ICE
It is a tool that allows calls to use the STUN and ICE mechanisms to create connections between different types of networks. The STUN server sends a ping back that contains the IP address and client port.
These STNs (Utilities Traversal Session for NAT) are used by VPNs to translate a local IP address into a new public IP address and vice versa.
To do this, the STUN server maintains a table of both the public IP VPN and the actual IP that you have during the connection.
Your home router has a similar function for translating private IP addresses into public and vice versa.
WebRTC allows requests to STUN servers that return the "hidden" IP address (yes your real IP) as well as the local network addresses of the system used by the user.
The results of the requests can be viewed using JavaScript, but because they are made outside of the normal XML/HTTP request process, they are not visible from the console programmer.
The only requirement for this de-anonymizing technique to work is to support WebRTC and JavaScript from the browser.
VPN and WebRTC
The technique can be used for de-anonymize and trace users behind: VPN, SOCKS Proxy, HTTP Proxy and older TOR versions.
The following list contains browsers that have WebRTC enabled
23% of the VPNs and Proxies services tested by the researcher were found to reveal the actual IP.
Protection
Follow these steps to protect your true IP:
- Disable WebRTC
- Disable JavaScript (or at least some features, use NoScript)
- Disable Canvas Rendering (Web API)
- Always set a DNS fallback for each connection / network adapter
- Always close browsers before and after using a VPN connection
- Clean the cache browser, history, and cookies
- Exclude all outgoing connections outside the VPN provider
PoC:
Check if your VPN reveals your real IP
