Just a few days after learning that the Canadian Government is tracking visitors of popular file-sharing sites security researchers have discovered a major security flaw that reveals Windows VPN users real IP address through WebRTC. Linux and Mac OS X users are not affected by this vulnerability as it is specific to Windows users running Google Chrome and Firefox.
With a few lines of code websites can make requests to STUN servers and log users’ VPN IP address and their true IP address, as well as local network addresses.
A demo published on GitHub by developer Daniel Roesler allows people to check if they are affected by the security flaw.
How to block?
Chrome users can install the WebRTC block extension or ScriptSafe, which both reportedly block the vulnerability.
Firefox users should be able to block the request with the NoScript addon. Alternatively, they can type “about:config” in the address bar and set the “media.peerconnection.enabled” setting to false. The Tor Browser Bundle includes the NoScript addon with Firefox but Windows users will want to verify that NoScript is configured properly.
Information source: http://www.deepdotweb.com/2015/02/01/major-windows-security-flaw-leaks-vpn-users-real-ip-address/
With a few lines of code websites can make requests to STUN servers and log users’ VPN IP address and their true IP address, as well as local network addresses.
A demo published on GitHub by developer Daniel Roesler allows people to check if they are affected by the security flaw.
How to block?
Chrome users can install the WebRTC block extension or ScriptSafe, which both reportedly block the vulnerability.
Firefox users should be able to block the request with the NoScript addon. Alternatively, they can type “about:config” in the address bar and set the “media.peerconnection.enabled” setting to false. The Tor Browser Bundle includes the NoScript addon with Firefox but Windows users will want to verify that NoScript is configured properly.
Information source: http://www.deepdotweb.com/2015/02/01/major-windows-security-flaw-leaks-vpn-users-real-ip-address/
