6 ms·

Local IP discovery with HTML5 WebRTC: Security and privacy risk?

24 points by einaros 13y ago

kzahel 13y ago
This is really scary that it can be used as a very reliable fingerprinting technique. http://tools.ietf.org/html/draft-ietf-rtcweb-security-05#section-4.2.4 http://tools.ietf.org/html/draft-ietf-rtcweb-security-05#sec... It doesn't seem like the issue is addressed in the webrtc draft.
- adrr 13y ago
  I am under the assumption that most APs/Routers use 192.168.1.0/24 as the default network? I think it wouldn't be unique enough for use in fingerprinting.
  - cynwoody 13y ago
    Actually, the block in question is 192.168.0.0/16. But, yes, in my experience, the router is almost always at 192.168.0.1. So, your observation about fingerprinting usefulness is correct. However, if a rogue script can exploit an XSS vulnerability, it's likely in a lot of cases the user has not set a password on the router's LAN admin interface. So, the script can run through a short list of guesses, get lucky, and poke a hole in the user's firewall from the inside. This vulnerability exists independent of WebRTC. WebRTC just makes it easier to scope out more unusual LAN setups, such as the article's example involving a 10.0.0.0/8 network. Bottom line: use passwords on your LAN even if it's just you and two or three computers. And, for good measure, pick an unusual subnet out of the 10.0.0.0/8 net.
    - simcop2387 13y ago
      Or don't even go for 10/8 or 192.168.0.0/16, go straight to 172.16.0.0/12.
Goranek 13y ago
is it possible to get a hostname(computer name)?
- stuartd 13y ago
  Mo
  - Goranek 13y ago
    by mo you mean no? :)
    - justin_vanw 13y ago
      Yope
codezero 13y ago
I'm not getting anything on the page linked to in this article: http://net.ipcalf.com/ http://net.ipcalf.com/ On Chrome I get nothing, on Firefox, I get a printed out shell command.
pfraze 13y ago
It might be a good idea to prompt for rights to use that feature, same as with the webcam or fullscreen.
zurn 13y ago
NAT-is-a-security-feature is such a zombie meme...
lallysingh 13y ago
Well, it's a complicated answer, I think. Generally, it's not an additional risk over how screwed you generally are. If you're taking precautions against existing attacks, then yeah. Question is, can it be fixed? The WebRTC SDP's for getting a peer-to-peer connection, so the general case seems to need to share IP addresses.. But that's not really needed, if you're normally behind a NAT, you're going to be behind a NAT this time, and don't need to share your real IPs -- just STUN/ICE data. If you're not behind a NAT, they already have your IP address.
- computer 13y ago
  It can be fixed for general cases (like advertisers or drive-by-exploits): make WebRTC click-to-play. This also fixes the issue where any random site can use WebRTC to make your computer distribute peer to peer content of its choice (like bittorrent).
pdfcollect 13y ago
How can one disable WebRTC on chrome/firefox? (Apart from using an older browser of course)
- einaros 13y ago
  Firefox: "about:config" and "media.peerconnection.enabled = false"

24 points by einaros 13y ago

This is really scary that it can be used as a very reliable fingerprinting technique. http://tools.ietf.org/html/draft-ietf-rtcweb-security-05#section-4.2.4 http://tools.ietf.org/html/draft-ietf-rtcweb-security-05#sec... It doesn't seem like the issue is addressed in the webrtc draft.

adrr 13y ago
I am under the assumption that most APs/Routers use 192.168.1.0/24 as the default network? I think it wouldn't be unique enough for use in fingerprinting.
- cynwoody 13y ago
  Actually, the block in question is 192.168.0.0/16. But, yes, in my experience, the router is almost always at 192.168.0.1. So, your observation about fingerprinting usefulness is correct. However, if a rogue script can exploit an XSS vulnerability, it's likely in a lot of cases the user has not set a password on the router's LAN admin interface. So, the script can run through a short list of guesses, get lucky, and poke a hole in the user's firewall from the inside. This vulnerability exists independent of WebRTC. WebRTC just makes it easier to scope out more unusual LAN setups, such as the article's example involving a 10.0.0.0/8 network. Bottom line: use passwords on your LAN even if it's just you and two or three computers. And, for good measure, pick an unusual subnet out of the 10.0.0.0/8 net.
  - simcop2387 13y ago
    Or don't even go for 10/8 or 192.168.0.0/16, go straight to 172.16.0.0/12.

Goranek 13y ago

is it possible to get a hostname(computer name)?

stuartd 13y ago
Mo
- Goranek 13y ago
  by mo you mean no? :)
  - justin_vanw 13y ago
    Yope

codezero 13y ago

I'm not getting anything on the page linked to in this article: http://net.ipcalf.com/ http://net.ipcalf.com/ On Chrome I get nothing, on Firefox, I get a printed out shell command.

pfraze 13y ago

It might be a good idea to prompt for rights to use that feature, same as with the webcam or fullscreen.

zurn 13y ago

NAT-is-a-security-feature is such a zombie meme...

lallysingh 13y ago

Well, it's a complicated answer, I think. Generally, it's not an additional risk over how screwed you generally are. If you're taking precautions against existing attacks, then yeah. Question is, can it be fixed? The WebRTC SDP's for getting a peer-to-peer connection, so the general case seems to need to share IP addresses.. But that's not really needed, if you're normally behind a NAT, you're going to be behind a NAT this time, and don't need to share your real IPs -- just STUN/ICE data. If you're not behind a NAT, they already have your IP address.

computer 13y ago
It can be fixed for general cases (like advertisers or drive-by-exploits): make WebRTC click-to-play. This also fixes the issue where any random site can use WebRTC to make your computer distribute peer to peer content of its choice (like bittorrent).

pdfcollect 13y ago

How can one disable WebRTC on chrome/firefox? (Apart from using an older browser of course)

einaros 13y ago
Firefox: "about:config" and "media.peerconnection.enabled = false"