Many VPN Providers Leak Customer's IP Address via WebRTC Bug (bleepingcomputer.com)

An anonymous reader shares a report: Around 20% of today's top VPN solutions are leaking the customer's IP address via a WebRTC bug known since January 2015, and which apparently some VPN providers have never heard of. The discovery belongs to Paolo Stagno, a security researcher who goes by the pseudonym of VoidSec, and who recently audited 83 VPN apps on this old WebRTC IP leak. Stagno says he found that 17 VPN clients were leaking the user's IP address while surfing the web via a browser. The researcher published his results in a Google Docs spreadsheet. The audit list is incomplete because Stagno didn't have the financial resources to test all commercial VPN clients.

Comments

Re:How are VPN providers supposed to stop this?

[barc0001]

Not everyone can be expected to be an expert in security. That's like saying if you get on a plane that hasn't had its maintenance done and it crashes, it was your fault for getting on the plane without knowing what its maintenance status was.

The elephant in the room is the browser.

[Anonymous Coward]

As always (see the Facebook discussion), the browser mutated from a hypertext viewing application into a spyware executing monster, a thing picking up random executables off the 'net and colluding with everyone out there against the user.

The sad part is that even Mozillians have been carried away by "oh, shiny!" and "ours is the fastest javascript engine" instead of throwing some weight into keeping the javascript-free web viable.

Re:The bug and the way around it

[Bruce Perens]

You discovered this just now? I made that conclusion years ago while surfing to a porn site.

I must confess to being that boring sort of individual who doesn't really have anything to hide. At least yet, the way things are going it could get to the point that every civil person will need to hide.

Thus, I haven't been using any sort of concealment technology and haven't concerned myself with the fact that my IP address can be identified.

At the moment it's still legal for you to look at that porn site. Although if those people who take Cosmo off the shelves in stores have anything to say about it, it won't be. FYI, they have nothing to do with #metoo and are just a prudish religious organization. And their behavior concerns me.