Slashdot Mirror
Many VPN Providers Leak Customer's IP Address via WebRTC Bug (bleepingcomputer.com)
An anonymous reader shares a report: Around 20% of today's top VPN solutions are leaking the customer's IP address via a WebRTC bug known since January 2015, and which apparently some VPN providers have never heard of. The discovery belongs to Paolo Stagno, a security researcher who goes by the pseudonym of VoidSec, and who recently audited 83 VPN apps on this old WebRTC IP leak. Stagno says he found that 17 VPN clients were leaking the user's IP address while surfing the web via a browser. The researcher published his results in a Google Docs spreadsheet. The audit list is incomplete because Stagno didn't have the financial resources to test all commercial VPN clients.
Disable WebRTC, you dumb shits.
The browsers did. WebRTC is a browser security issue. This is like blaming your VPN for leaking your home address because you posted it on Facebook. If you want to be secure and private online then take the time to learn how.
I just discovered this bug today myself by chance, but AFAIK if you're using NAT (which most of us do) this will only reveal your 'local' IP addres, usually something like 192.168.0.x. Still nasty, but it won't immediately identify you.
Also, there's an ad blocker plugin for most popular browsers (uBlock Origin) that has an optional setting that blocks this.
Test for the vulnerability here:
https://www.whatismybrowser.co...
The page will reveal your local IP if your browser is vulnerable (no VPN needed).
You are trusting the VPN provider to... * Not keep log info beyond your payment details. * Keep their systems secure in data centers located in many countries. * Not get hacked for a man-in-the-middle attack. and stay in business.
https://torrentfreak.com/huge-security-flaw-leaks-vpn-users-real-ip-addresses-150130/
Sounds like the same thing to me.
The google doc suggests it's vulnerable but visiting https://ip.voidsec.com/ myself everything looked fine. The google doc references https://www.vpncompare.co.uk.
There's nothing about WebRTC in the review of PIA (https://www.vpncompare.co.uk/private-internet-access-review/)
This article about it going open source only mentions WebRTC in the context of a chrome extension blocking IP discovery (https://www.vpncompare.co.uk/private-internet-access-vpn-taking-to-the-open-source-road/)
I just tried https://ipx.ac/run however and it's clear that Flash is leaking my IP address. I'm using Firefox so it was as easy as going into Add-ons and changing activation from Always to Ask.
Moral of the story? Get on your VPN and try https://ipx.ac/run
I started looking at VPN providers and stumbled across this guys site. Talk about information overload! I don't know anything other than what he has posted but by the looks of it he has way more free time than I do. So if your VPN is "leaking" this might be a good source for deciding who your next VPN provider will be.
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Let's be a little bit more specific. The bug works with Chrome, Firefox and Opera. Both IE and Seamonkey are not affected. Not sure about Edge....
I sometimes find a site that knows where I'm located. I'm using PIA (Private Internet Access).
I chose PIA based on multiple favorable reviews.
You're leaking your IP address by using a browser with Javascript and WebRTC enabled, you dummy.
As always (see the Facebook discussion), the browser mutated from a hypertext viewing application into a spyware executing monster, a thing picking up random executables off the 'net and colluding with everyone out there against the user.
The sad part is that even Mozillians have been carried away by "oh, shiny!" and "ours is the fastest javascript engine" instead of throwing some weight into keeping the javascript-free web viable.
DNS query leaks are worse, where a badly configured VPN client uses the DNS server of the ISP. Always ensure your VPN provider offers their own DNS servers or point at 8.8.8.8 or opendns or something other than your ISP.
I only use Internet Explorer 11. So, have fun with that Chrome users!
not software running on the pc you're actually using.
Multiple browsers began leaking WebRTC through VPN starting in iOS 11. It's a big, glaring security hole that Apple let through.
Yes, a good deal of issues rest upon that grotesque wriggling mass of protocols people call the Web.
I've given some thought to the browser problem. It seems like an impossible convoluted insecure mess that can only be solved by doing away with the whole platform completely, but we all know that won't happen.
So, instead I've thought about a way of altering the concept of the ALL IN ONE web browsers as a standard in relation to IT and netsec folks (with the long con of having an eventual trickle down effect to general users) Create a class of browser that is designed to be only used in place of a standard browser to perform sys admin and security tasks on local network resources.
Now, this wouldn't succeed if introduced as a stand alone package, but if it were introduced as a sub package to current open source platforms that have a web server.... well you can see where I am going with it. Meanwhile, stop supporting web config on generic browsers for 'security reasons'. Now do this over and over again.
Nobody cooperating? Target new forks. They are usually eager to differentiate themselves from the original package.
Eventually release a stand alone package that supports all of those platforms. That ought to shake shit up!
The solution is to
1. Never ever use a browser in there! Their attack surface is vast. E.g. you can use JS to just do a network scan and port scan, etc.
2. Use a firewall with deep packet inspection that only allows a fixed sets of protocols it understands completely, and anonymizes or blocks all packers containing your IP addresses.
3. Have your system trust the firewall's certificate, so the firewall can look into and modify encrypted connections too. In fact, don't let anything pass that couldn't fully be verified before going out!
Or TL;DR: Use a whitelist.
Because blacklisting will always leak at some point. It will never be 100%.
Nothing to do with the VPN.
For a start, they shouldn't be opening packets and inspecting protocols, so they can't "fix" this for you in any way, shape or form, if they're doing their job.
This is the browser talking to an outside STUN server deliberately saying "My internal IP is X.X.X.X". The VPN shouldn't be interfering with that. No VPN (hardware or software) should be combatting that.
If you're worried about it, don't use browsers that do that.
VPNs are NOT there to provide protection from data-escape. They are there to provide a secure unmonitorable connection to a device that may then connect to the Internet. EVERYTHING on the other end is monitorable anyway. And if you're literally sending your IP address via STUN, or in an email, or by telling people it on the web, a VPN is not even supposed to know, let alone try to stop you (which it can't).
This is a case of people culminating "VPN" and "web proxy", and then using a piece of software that talks entirely different protocols out anyway, and does so at your request, and expecting the VPN provider to "just take care of my own stupidity".
I mean, I'm quite glad. Stupid criminals are the ones most easily caught, so they will just think they are safe because they bought some $5/month VPN and they can't possibly be found when planning their acts of terrorism, illegal acts, software piracy, whatever it may be. But if you're using a VPN like this to just bypass a content restriction, or to enable you to browse without people casually snooping on you, and not for 100% anonymity, then you're pretty much unaffected.
However, if I demanded secure anonymous access to a resource, a commercial web browser of any kind probably wouldn't figure very highly at all. There's just too much junk in there from javascript and cookies to WebRTC (a lovely useful technology), extensions, automatic-updates, history recording, etc. etc. etc.
Honestly, if you're doing something critical for which you don't want to ever be identified, then... this is not the answer. It's not even close to the answer. For a start, paying a VPN provider is a really dumb idea, even if you do it with Bitcoin. Let alone "hoping" that they aren't secretly complying with FBI etc. orders to open their logs etc. (I'm sure if I was an intelligence agency, I'd find a way to own at least one major VPN provider claiming to provide anonymity myself, even if it meant setting it up from scratch and operating it like any other business without any formal contact).
If you want to be "private", then asking a bunch of computers along the way, all belonging to different people, corporations and nations, to keep your secret is really stupid.
Pale Moon intentionally does not support WebRTC:
"..One hosts to look them up, one DNS to find them, and in the darkness BIND them."