One leak will sink a ship: WebRTC IP address leaks

Abstract

The introduction of the WebRTC API to modern browsers has brought about a new threat to user privacy. WebRTC is a set of communications protocols and APIs that provides browsers and mobile applications with Real-Time Communications (RTC) capabilities over peer-to-peer connections. The WebRTC API causes a range of client IP addresses to become available to a visited website via JavaScript, even if a VPN is in use. This is informally known as a WebRTC Leak, and is a potentially serious problem for users using VPN services for anonymity. The IP addresses that could leak include the client public IPv6 address and the private (or local) IP address. The disclosure of such IP addresses, despite the use of a VPN connection, could reveal the identity of the client as well as enable client tracking across websites. To better understand the magnitude of this issue, we performed experiments with the five most widely used WebRTC-enabled browsers, i.e. Chrome, Firefox, Opera, Edge and Safari. We tested each of them with five widely used commercial VPN services in order to discover which client IP addresses can be revealed. Our experiments employed a specially established website which downloaded a slightly modified version of publicly available JavaScript to the client under test. The script fetches IP addresses made available via the browser WebRTC functionality. In most cases, at least one of the client IP addresses is leaked. Edge was the most seriously affected by WebRTC leaks, whereas Safari leaked no addresses at all. Our experiments revealed that the number and type of leaked IP addresses are affected by the choice of browser as well as the VPN service and program settings. We conclude the paper by proposing countermeasures that can be used to help mitigate this problem.