Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Abusing WebRTC to reveal coarse location data in Signal

medium.com

Post reply on HN
Print view View original

31–40 of 64 posts

Re: Abusing WebRTC to reveal coarse location data in Signal

#31

Post by toast0 »

stagas wrote: post #4
verdverm wrote: post #2

I recall seeing a paper where they showed how close you can geolocate with various numbers of peers to the target, by using network latency alone

That's funny, I was just working on a POC like this today[0] - it's accurate most of the time for my location but I haven't tested from other locations. You'd need to tweak the 'known' servers on and off to find the optimal arrangement because you'd need to be somehow inside the polygon. I was planning to find a way to discover these itself and other tweaks (like trying multiple times then averaging out) Edit: the pa…

I think the key thing to keep in mind with this approach is that physical distance and network distance are only loosely related.

You can easily be next door to someone, and your packets go all the way across the country to get there.

I've definitely seen cases where my latency to two servers in the same building were wildly different, depending on the paths my ISP and their ISP(s) routed the traffic.

I'm about 22 ms roundtrip away from ISPs facility at the local internet exchange in Seattle. If a server is connected to that exchange, and traffic flows through the exchange both ways, I see ping times of about 22 ms. Sometimes, my ISP will send traffic through San Jose instead, but the server returns the traffic in Seattle, and that adds about 26ms, so I get a 48 ms ping. If both sides route through San Jose for whatever reason, I'll get 74 ms, which is close to what I'd get if the routing was sensible and the server was in the Washington, DC area. (You normally can't see the routing back from the server, but sometimes you control the server, too).

If I were building something like this, I'd want to try to determine how much of the latency was the user getting to where their ISP interconnects with other networks (or with multiple routes within their own network), and then where that interconnection location is. I'd guess you can get a pretty good idea of the interconnection location, based on reasonable network paths from there, but distance from the interconnection point is going to be tricky, most residential networking technologies add much more latency than the speed of light, so your upper bound of distance is going to be pretty far off. Of the roughly 22 ms I see to Seattle, about 20 ms is just coming from the DSL termination; when I had AT&T GPON, it added about 4 ms to my pings; that's a lot of distance.

Re: Abusing WebRTC to reveal coarse location data in Signal

#32

Post by jrockway »

DrPhish wrote: post #17

The only universal fix I can think of for this class of attacks is to have routers bound latency to a lower limit (eg. 200ms), with fixed latency buckets (eg. 500ms granularity) when it goes beyond that. That is, no traffic would traverse the router in less than 200ms, and every other flow would be fixed at 700ms, 1200ms, 1700ms, etc amounts of latency. Tweaked correctly that would limit location to continent, unless…

To some extent, this already happens. My cable modem adds about 30ms latency no matter the destination. I think this is a combination of buffer bloat (wait for buffer to fill before talking on the network) and waiting for a transmit time slot (shared access to the physical layer). I haven't looked at it in detail, but it is very surprising to me that I get 60ms RTT to Blizzard's servers in Chicago (a speed of light distance of 4ms one way) and 25-40ms ping to Google (in what they call "lga15", which is somewhere in Manahttan, probably 60 Hudson).

I realize that ping is a very poor benchmark as most routers do not handle ping in their fast path, but it's not adding 40ms of latency. So I suspect my modem.

Re: Abusing WebRTC to reveal coarse location data in Signal

#33

Post by dannyw »

jrockway wrote: post #32
DrPhish wrote: post #17

The only universal fix I can think of for this class of attacks is to have routers bound latency to a lower limit (eg. 200ms), with fixed latency buckets (eg. 500ms granularity) when it goes beyond that. That is, no traffic would traverse the router in less than 200ms, and every other flow would be fixed at 700ms, 1200ms, 1700ms, etc amounts of latency. Tweaked correctly that would limit location to continent, unless…

To some extent, this already happens. My cable modem adds about 30ms latency no matter the destination. I think this is a combination of buffer bloat (wait for buffer to fill before talking on the network) and waiting for a transmit time slot (shared access to the physical layer). I haven't looked at it in detail, but it is very surprising to me that I get 60ms RTT to Blizzard's servers in Chicago (a speed of light d…

This is extremely unusual to me. Personally I notice it when my ping to local game servers go from 5 to 25.

I’d recommended you look into it, and potentially get another modem. If all my requests started taking another 30ms, I’d consider my network degraded.

Re: Abusing WebRTC to reveal coarse location data in Signal

#34

Post by cortesoft »

DrPhish wrote: post #17

The only universal fix I can think of for this class of attacks is to have routers bound latency to a lower limit (eg. 200ms), with fixed latency buckets (eg. 500ms granularity) when it goes beyond that. That is, no traffic would traverse the router in less than 200ms, and every other flow would be fixed at 700ms, 1200ms, 1700ms, etc amounts of latency. Tweaked correctly that would limit location to continent, unless…

I am confused... this attack doesn't seem to be doing anything with latency?

Re: Abusing WebRTC to reveal coarse location data in Signal

#35

Post by aesh2Xa1 »

cjbprime wrote: post #30
upofadown wrote: post #11

>Even Edward Snowden, the well known American Whistleblower, claims “I use Signal every day.” Well, 5 years ago...

Presumably he's been using Signal over Tor, defeating all such attacks as a side-effect.

How does Edward Snowden acquire a laptop or phone in a way that he can trust it? I don't think it matters what protocols and applications he uses: he does not enjoy privacy.

Re: Abusing WebRTC to reveal coarse location data in Signal

#36

Post by thephyber »

aesh2Xa1 wrote: post #35
cjbprime wrote: post #30

Earlier quoted context omitted.

Presumably he's been using Signal over Tor, defeating all such attacks as a side-effect.

How does Edward Snowden acquire a laptop or phone in a way that he can trust it? I don't think it matters what protocols and applications he uses: he does not enjoy privacy.

s/Edward Snowden/anyone/

Two key words in your comment are both spectrums: trust and privacy.

Most people implicitly trust their hardware more than Snowden does now -- they overestimate the security from the factory and he probably has better expectations of the likelihood of hardware compromise.

On the privacy spectrum, one point is how much privacy you think you have, and the other (unknown) point is how much you actually have. Similarly, I think Snowden's situation and prior experience helps him more accurately understand where those points are; the rest of us are up on the first peak of the Dunning-Kreuger chart.

Re: Abusing WebRTC to reveal coarse location data in Signal

#37

Post by sadfklsjlkjwt »

aesh2Xa1 wrote: post #35
cjbprime wrote: post #30

Earlier quoted context omitted.

Presumably he's been using Signal over Tor, defeating all such attacks as a side-effect.

How does Edward Snowden acquire a laptop or phone in a way that he can trust it? I don't think it matters what protocols and applications he uses: he does not enjoy privacy.

I order to get a device that is not explicitly compromised with custom targeted malware one could: take a walk, enter a random shop, buy a device. Now you only have the standard malware that everyone gets preinstalled on their devices.

How to keep it free of custom targeted malware? That is another question!

Re: Abusing WebRTC to reveal coarse location data in Signal

#38

Post by jrockway »

dannyw wrote: post #33
jrockway wrote: post #32

Earlier quoted context omitted.

To some extent, this already happens. My cable modem adds about 30ms latency no matter the destination. I think this is a combination of buffer bloat (wait for buffer to fill before talking on the network) and waiting for a transmit time slot (shared access to the physical layer). I haven't looked at it in detail, but it is very surprising to me that I get 60ms RTT to Blizzard's servers in Chicago (a speed of light d…

This is extremely unusual to me. Personally I notice it when my ping to local game servers go from 5 to 25. I’d recommended you look into it, and potentially get another modem. If all my requests started taking another 30ms, I’d consider my network degraded.

Seems like everyone with any cable ISP has this problem. It could be a modem problem, but it's happened with a variety of modems. It could be an ISP problem, but both Comcast and Spectrum users see the same thing in my experience.

I'd be interested in hearing counterexamples, but I imagine that people with good experiences are on DSL or Fiber.

Re: Abusing WebRTC to reveal coarse location data in Signal

#39

Post by stagas »

cortesoft wrote: post #34
DrPhish wrote: post #17

The only universal fix I can think of for this class of attacks is to have routers bound latency to a lower limit (eg. 200ms), with fixed latency buckets (eg. 500ms granularity) when it goes beyond that. That is, no traffic would traverse the router in less than 200ms, and every other flow would be fixed at 700ms, 1200ms, 1700ms, etc amounts of latency. Tweaked correctly that would limit location to continent, unless…

I am confused... this attack doesn't seem to be doing anything with latency?

You are right, it is only pinpointing the DNS server of the client, which usually resides in the same city, so you can find where the victim lives. It is inferred from the conversation here though that one could potentially exploit this even further to perform ping trilateration and get a better accuracy on one's location using the method described in the article. I think this spawned the comment about the timing attacks.

Re: Abusing WebRTC to reveal coarse location data in Signal

#40

Post by Daniel_sk »

aesh2Xa1 wrote: post #35
cjbprime wrote: post #30

Earlier quoted context omitted.

Presumably he's been using Signal over Tor, defeating all such attacks as a side-effect.

How does Edward Snowden acquire a laptop or phone in a way that he can trust it? I don't think it matters what protocols and applications he uses: he does not enjoy privacy.

Go in random store and pick random notebook / phone.
Post reply on HN