5 ms·

Reminder: WebRTC data channels can silently leak your internal and (if behind a VPN) real IP address. https://diafygi.github.io/webrtc-ips/ https://diafygi.git

by diafygi 11y ago

Reminder: WebRTC data channels can silently leak your internal and (if behind a VPN) real IP address. https://diafygi.github.io/webrtc-ips/ https://diafygi.github.io/webrtc-ips/ https://bugzilla.mozilla.org/show_bug.cgi?id=959893 https://bugzilla.mozilla.org/show_bug.cgi?id=959893

upofadown 11y ago
The important issue is that some WebRTC capable browsers can leak your internal address to a random page you are visiting even if you are not using WebRTC. If you are actually using WebRTC then you probably don't care if they know what your internal IP address is. ... that is of course if you ever care...
Someone1234 11y ago
That's why site-based VPNing is considered the gold standard. Instead of using a VPN client on a PC, you use a network appliance, that way the PC never has a concept of what your "true" IP is. Thus cannot leak it. Some people have been toying with doing the same but using Virtual Machines. The VM wouldn't have a concept of what the true IP is and since everything goes through the virtual router it acts like a site-to-site VPN connection hiding your true address.
- SCHiM 11y ago
  Yes. This is very easy to install using PFsense inside a virtual machine. Here's a guide that is recent and I can confirm that it works: http://www.malwaretech.com/2015/08/creating-ultimate-tor-virtual-network.html http://www.malwaretech.com/2015/08/creating-ultimate-tor-vir...
  - aaren 11y ago
    Is this basically the same as what Whonix does (routing through a dedicated gateway VM)? http://whonix.org http://whonix.org
    - SCHiM 11y ago
      It looks like it, but with pfsense you get more control I think. I have several more segments (read: virtual adapters) that route through a VPN or just from my home ip. So then I can go to mange>adapter settings>lan segments in my vmware settings and change my upstream gateway. This is all 100% transparent to the programs running inside the VM (only problem is that not all protocols support being routed in this sense). But tcp works, as does DNS over tcp, so most programs you use will work.
- athenot 11y ago
  Which is great on a desktop or a home office situation. That's what I have. But for mobile situation where it's just your phone and the telco, that is not an option (unless you're in the habit of carrying a suitcase with your appliance).
  - kobayashi 11y ago
    What's the setup for a site-based VPN? This is the first I'm ever hearing about it
    - athenot 11y ago
      Basically you have a router such as the Cisco [880] take care of the encryption and extends the corporate private network into the home office. [880] http://www.cisco.com/c/en/us/support/routers/880-integrated-services-routers-isr/model.html http://www.cisco.com/c/en/us/support/routers/880-integrated-...
      - reitanqild 11y ago
        Just FTR, you can (almost?) just as easily use VyOS. It is open source and supports IPSEC site-to-site.
    - Someone1234 11y ago
      Consumer or business grade router that has a built in VPN client. On the consumer side you can often flash OpenWRT/DD WRT/PfSense to add a VPN client. But for a more reliable setup you want a business-grade router which supports it natively.
- vox_mollis 11y ago
  The problem with this is that the VAST majority of endpoint appliances don't support OpenVPN. You're limited to PPTP, L2TP, or IPSec with pretty much every single vendor.
api 11y ago
If internal IPS are critical security info, something is very wrong.
- biggerfisch 11y ago
  Well, imagine you're in a controlled environment (eg, China) and having your non-vpn IP leaked could compromise your identity. Having an easy way for a site to reveal you is therefore a security issue.
  - cptskippy 11y ago
    Ah, that makes more sense. I assumed he was referring to the private address assigned to your machine on your LAN.
    - biggerfisch 11y ago
      Even if he is, it's still information that doesn't need to be revealed. It's not a security issue in and of itself, but if combined with another exploit, it could help an attacker. Good security is all about layers and protecting information. LAN IPs are also useful for distinguishing computers from the same external IP which could help compromise your identity or privacy.
- cptskippy 11y ago
  Yeah, I'm struggling to understand why that's an issue.
  - cpeterso 11y ago
    Browser fingerprinting. If a site knows your Internet-facing IP address and your local IP address, then they can uniquely identify you, even if you delete your cookies or use private browsing mode.
- tezza 11y ago
  ? I browse from work. And I'm fairly sure my Sys Admin won't want random websites knowing my internal IP address. Network shares etc. would likely be somewhere on the same range and they could launch subsequent attacks to try to sniff confidential documents and resources.
danjoc 11y ago
>This demo secretly makes requests to STUN servers that can log your request. These requests do not show up in developer consoles and cannot be blocked by browser plugins (AdBlock, Ghostery, etc.). That's a bit of an overstatement. Running NoScript. No scripts, no WebRTC.
stcredzero 11y ago
Reminder: WebRTC data channels can silently leak your internal and (if behind a VPN) real IP address. I have been writing an MMO server, and I would be glad to use WebRTC datachannels, but only for client-server communications. I am far more interested in UDP-like semantics than peer to peer.
JoeAltmaier 11y ago
Isn't this a non-issue? Security by obscurity is weak. Not just a WebRTC issue: any p2p communication will do this. With IPV6 its a non-issue as well?

by diafygi 11y ago

upofadown 11y ago

The important issue is that some WebRTC capable browsers can leak your internal address to a random page you are visiting even if you are not using WebRTC. If you are actually using WebRTC then you probably don't care if they know what your internal IP address is. ... that is of course if you ever care...

Someone1234 11y ago

That's why site-based VPNing is considered the gold standard. Instead of using a VPN client on a PC, you use a network appliance, that way the PC never has a concept of what your "true" IP is. Thus cannot leak it. Some people have been toying with doing the same but using Virtual Machines. The VM wouldn't have a concept of what the true IP is and since everything goes through the virtual router it acts like a site-to-site VPN connection hiding your true address.

SCHiM 11y ago
Yes. This is very easy to install using PFsense inside a virtual machine. Here's a guide that is recent and I can confirm that it works: http://www.malwaretech.com/2015/08/creating-ultimate-tor-virtual-network.html http://www.malwaretech.com/2015/08/creating-ultimate-tor-vir...
- aaren 11y ago
  Is this basically the same as what Whonix does (routing through a dedicated gateway VM)? http://whonix.org http://whonix.org
  - SCHiM 11y ago
    It looks like it, but with pfsense you get more control I think. I have several more segments (read: virtual adapters) that route through a VPN or just from my home ip. So then I can go to mange>adapter settings>lan segments in my vmware settings and change my upstream gateway. This is all 100% transparent to the programs running inside the VM (only problem is that not all protocols support being routed in this sense). But tcp works, as does DNS over tcp, so most programs you use will work.
athenot 11y ago
Which is great on a desktop or a home office situation. That's what I have. But for mobile situation where it's just your phone and the telco, that is not an option (unless you're in the habit of carrying a suitcase with your appliance).
- kobayashi 11y ago
  What's the setup for a site-based VPN? This is the first I'm ever hearing about it
  - athenot 11y ago
    Basically you have a router such as the Cisco [880] take care of the encryption and extends the corporate private network into the home office. [880] http://www.cisco.com/c/en/us/support/routers/880-integrated-services-routers-isr/model.html http://www.cisco.com/c/en/us/support/routers/880-integrated-...
    - reitanqild 11y ago
      Just FTR, you can (almost?) just as easily use VyOS. It is open source and supports IPSEC site-to-site.
  - Someone1234 11y ago
    Consumer or business grade router that has a built in VPN client. On the consumer side you can often flash OpenWRT/DD WRT/PfSense to add a VPN client. But for a more reliable setup you want a business-grade router which supports it natively.
vox_mollis 11y ago
The problem with this is that the VAST majority of endpoint appliances don't support OpenVPN. You're limited to PPTP, L2TP, or IPSec with pretty much every single vendor.

api 11y ago

If internal IPS are critical security info, something is very wrong.

biggerfisch 11y ago
Well, imagine you're in a controlled environment (eg, China) and having your non-vpn IP leaked could compromise your identity. Having an easy way for a site to reveal you is therefore a security issue.
- cptskippy 11y ago
  Ah, that makes more sense. I assumed he was referring to the private address assigned to your machine on your LAN.
  - biggerfisch 11y ago
    Even if he is, it's still information that doesn't need to be revealed. It's not a security issue in and of itself, but if combined with another exploit, it could help an attacker. Good security is all about layers and protecting information. LAN IPs are also useful for distinguishing computers from the same external IP which could help compromise your identity or privacy.
cptskippy 11y ago
Yeah, I'm struggling to understand why that's an issue.
- cpeterso 11y ago
  Browser fingerprinting. If a site knows your Internet-facing IP address and your local IP address, then they can uniquely identify you, even if you delete your cookies or use private browsing mode.
tezza 11y ago
? I browse from work. And I'm fairly sure my Sys Admin won't want random websites knowing my internal IP address. Network shares etc. would likely be somewhere on the same range and they could launch subsequent attacks to try to sniff confidential documents and resources.

danjoc 11y ago

>This demo secretly makes requests to STUN servers that can log your request. These requests do not show up in developer consoles and cannot be blocked by browser plugins (AdBlock, Ghostery, etc.). That's a bit of an overstatement. Running NoScript. No scripts, no WebRTC.

stcredzero 11y ago

Reminder: WebRTC data channels can silently leak your internal and (if behind a VPN) real IP address. I have been writing an MMO server, and I would be glad to use WebRTC datachannels, but only for client-server communications. I am far more interested in UDP-like semantics than peer to peer.

JoeAltmaier 11y ago

Isn't this a non-issue? Security by obscurity is weak. Not just a WebRTC issue: any p2p communication will do this. With IPV6 its a non-issue as well?