Excuse Me Sir, Your WebRTC Is Leaking

#1

Post by Golgi_SDK » Thu, Feb 26, 2015, 2:43 PM UTC

Excuse Me Sir, Your WebRTC Is Leaking
blog.golgi.io

Re: Excuse Me Sir, Your WebRTC Is Leaking

#2

Post by 0x0 » Thu, Feb 26, 2015, 3:23 PM UTC

Interesting, maybe browsers should add a permission prompt like they do for web camera access before allowing a webrtc stun request?

Re: Excuse Me Sir, Your WebRTC Is Leaking

#3

Post by jjbiotech » Thu, Feb 26, 2015, 3:32 PM UTC

Vulnerability doesn't seem like the correct word to describe this issue. It's more of an exposure of potentially sensitive information (your local IP address if you're using a VPN) as a result of WebRTC's protocol design.

Re: Excuse Me Sir, Your WebRTC Is Leaking

#4

Post by echeese » Thu, Feb 26, 2015, 3:55 PM UTC

Flash has been able to do this for years: https://tools.ietf.org/html/draft-thornburgh-rtmfp-flash-02#...

The "setPeerInfo" command is sent by the client to the server over the NetConnection control flow to inform the server of candidate socket addresses through which the client might be reachable. This list SHOULD include all directly connected interface addresses and proxy addresses except as provided below. The list MAY be empty. The list need not include the address of the server, even if the server is to act as an introducer for the client. The list SHOULD NOT include link-local or loopback addresses.

Re: Excuse Me Sir, Your WebRTC Is Leaking

#5

Post by AdrianRossouw » Thu, Feb 26, 2015, 4:05 PM UTC

0x0 wrote: post #2

Interesting, maybe browsers should add a permission prompt like they do for web camera access before allowing a webrtc stun request?

i was under the impression it already does.

Re: Excuse Me Sir, Your WebRTC Is Leaking

#6

Post by algorithm_dk » Thu, Feb 26, 2015, 4:08 PM UTC

I made a LAN scanner based on this in JS: http://algorithm.dk/lanscan

Re: Excuse Me Sir, Your WebRTC Is Leaking

#7

Post by softdev12 » Thu, Feb 26, 2015, 4:09 PM UTC

jjbiotech wrote: post #3

Vulnerability doesn't seem like the correct word to describe this issue. It's more of an exposure of potentially sensitive information (your local IP address if you're using a VPN) as a result of WebRTC's protocol design.

I agree. For the vast majority of use cases, this doesn't seem to be an exceptionally big issue. Almost all major websites collect IP addresses and don't explicitly prompt the user that this is happening. It seems the OP is really highlighting the edge case for users who want quasi-absolute security.

Re: Excuse Me Sir, Your WebRTC Is Leaking

#8

Post by softdev12 » Thu, Feb 26, 2015, 4:15 PM UTC

This is interesting and seems to indicate that there is a small edge case for people who want as much privacy as possible.

The larger topic for me is that webRTC has to make tradeoff for developers. And, I for one, love what it does. If you look at legacy comms development in the peer to peer space (e.g. Skype) the process was orders of magnitude more difficult than using a webRTC implementation. So, as a developer, sacrificing a prompt that grants an IP detection notice seems like a worthwhile tradeoff.

Also, I think webRTC is still in draft form and is still being modified in working sessions (although I'm not 100% sure of this). It would be great if Apple would get on board with webRTC for ios.

Re: Excuse Me Sir, Your WebRTC Is Leaking

#9

Post by jmartinpetersen » Thu, Feb 26, 2015, 4:30 PM UTC

algorithm_dk wrote: post #6

I made a LAN scanner based on this in JS: http://algorithm.dk/lanscan

Very cool! But your subnet "detection" seems based on a broken assumption.

Re: Excuse Me Sir, Your WebRTC Is Leaking

#10

Post by Golgi_SDK » Thu, Feb 26, 2015, 4:40 PM UTC

0x0 wrote: post #2

Interesting, maybe browsers should add a permission prompt like they do for web camera access before allowing a webrtc stun request?

There is a permission request to access the camera but this is triggered by a call to getUserMedia(). This would be done if setting up a peer connection to transmit voice and/or video. However, if you want to set up a WebRTC data channel no such prompt occurs.