The New York Times uses WebRTC to gather local IP addresses

Forum post from Dan Kaminsky, co-founder of WhiteOps[1][2]:<p>&quot;Dan Kaminsky here, my apologies for kicking up a ruckus. This is part of a bot detection framework I&#x27;ve built at White Ops; we basically are able to detect browser automation using resources exposed in JavaScript. Nothing dangerous to users -- or we&#x27;d go file bugs on it, which we do from time to time -- but it does provide useful data regarding post-exploitation behavior. Happy to jump on a call with anyone concerned or worried; I&#x27;m over at dan@whiteops.com.&quot;<p>[1] <a href="http:&#x2F;&#x2F;www.whiteops.com&#x2F;company" rel="nofollow">http:&#x2F;&#x2F;www.whiteops.com&#x2F;company</a> [2] <a href="https:&#x2F;&#x2F;isc.sans.edu&#x2F;forums&#x2F;STUN+traffic&#x2F;745&#x2F;2" rel="nofollow">https:&#x2F;&#x2F;isc.sans.edu&#x2F;forums&#x2F;STUN+traffic&#x2F;745&#x2F;2</a>

Just a friendly reminder for anyone using uBlock Origin on Chrome or Firefox that you can now configure it to prevent webRTC from leaking your real IP:<p><a href="http:&#x2F;&#x2F;www.ghacks.net&#x2F;2015&#x2F;07&#x2F;02&#x2F;you-can-block-webrtc-from-leaking-your-ip-now-in-ublock-origin&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.ghacks.net&#x2F;2015&#x2F;07&#x2F;02&#x2F;you-can-block-webrtc-from-l...</a><p>You <i>do</i> need to enable this. After reading the article I immediately checked by dashboard and saw that the option was available, but unchecked.

A whois on the domain serving the offending javascript leads to White Ops[0], who seems to sell tools to protect against Ad Fraud. So I&#x27;m guessing this is part of their fingerprinting system, to determine whether I am a human or a bot.<p>[0] <a href="http:&#x2F;&#x2F;www.whiteops.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.whiteops.com&#x2F;</a>

I believe that WebRTC, just like JavaScript, should be disabled by default and enabled only on sites that you really trust and need it; and in the case of WebRTC, the argument is much stronger since its use-case is so specific.

Here&#x27;s a tool I wrote that grabs your internal IP and scans your LAN using response timings and HTTP asset fingerprints:<p>Demo: <a href="http:&#x2F;&#x2F;joevennix.com&#x2F;lan-js&#x2F;examples&#x2F;dashboard.html" rel="nofollow">http:&#x2F;&#x2F;joevennix.com&#x2F;lan-js&#x2F;examples&#x2F;dashboard.html</a> Code: <a href="https:&#x2F;&#x2F;github.com&#x2F;joevennix&#x2F;lan-js" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;joevennix&#x2F;lan-js</a><p>If you are interested and have some time, find and contribute HTTP &quot;fingerprint&quot; assets from devices on your LAN to src&#x2F;db.js.

Ironic that loading up this site, webrtchacks.com, Tor Browser warns me: &quot;Should Tor browser allow this website to extract HTML5 canvas image data?&quot;<p>I&#x27;ve now given up on &quot;naked&quot; browsing of the web and only surf via the Tor Browser Bundle. I use a standard Firefox only for web development.

I said this when the vulnerability&#x2F;bug&#x2F;whatever you want to call it was posted here: I use the same method for fraud detection, and it works unreasonably well.<p>That said, I&#x27;d rather there be permissions surrounding WebRTC, but my clients are happy.

It&#x27;s easy to gather local IP addresses. WebRTC is just one of dozens of methods of doing this. Others include various DNS tricks, reverse TCP traceroute, &lt;img&gt; tag tricks, JavaScript&#x2F;XMLHttpRequest tricks, etc. Private IP addresses (10.x.x.x) are <i>not</i> all that private.

Can they grab local IPv6 addresses using this? While a huge number of computers are going to be on 192.168.0.1, their IPv6 address could actually be unique, making user fingerprinting easier.

there&#x27;s really no way in chrome to disable webrtc? That&#x27;s amazing.<p>edit: from the horse&#x27;s mouths <a href="https:&#x2F;&#x2F;code.google.com&#x2F;p&#x2F;chromium&#x2F;issues&#x2F;detail?id=457492" rel="nofollow">https:&#x2F;&#x2F;code.google.com&#x2F;p&#x2F;chromium&#x2F;issues&#x2F;detail?id=457492</a><p>edit2: you can install this<p><a href="https:&#x2F;&#x2F;chrome.google.com&#x2F;webstore&#x2F;detail&#x2F;webrtc-leak-prevent&#x2F;eiadekoaikejlgdbkbdfeijglgfdalml" rel="nofollow">https:&#x2F;&#x2F;chrome.google.com&#x2F;webstore&#x2F;detail&#x2F;webrtc-leak-preven...</a><p>and test here:<p><a href="https:&#x2F;&#x2F;diafygi.github.io&#x2F;webrtc-ips&#x2F;" rel="nofollow">https:&#x2F;&#x2F;diafygi.github.io&#x2F;webrtc-ips&#x2F;</a><p>though google sure seems to be dragging their feet on this so I&#x27;m sure they&#x27;ll break this workaround soon

I recently added tagsrvcs.com to my Privoxy blocklist. Source site? ycombinator.com.

On OS X, Little Snitch catches this in Chrome, as it would in any browser <a href="https:&#x2F;&#x2F;i.imgur.com&#x2F;hWmpc42.png" rel="nofollow">https:&#x2F;&#x2F;i.imgur.com&#x2F;hWmpc42.png</a>

WebRTC, a protocol proposed by Google to W3C has applications in user tracking and detection of bots. Cui bono.

www world really needs more www &quot;browsers&quot;, particularly some more that do not implement javascript. Would it hurt to give users more choice and see what they choose?<p>Only my opinion but there is much one can do without all the .js<p>I certainly do not need Javascript to fetch some newspaper articles via HTTP.

So wasn&#x27;t everyone up in arms about WHOIS recently but seemingly uses the service to identify who wrote this script?

The only possible reason I can fathom that this would be useful would be for tracking unique users behind a NAT (i.e. corporate or educational) who block all cookies. Seems like a pretty niche edge case in the U.S., but I&#x27;d imagine this could be useful in, say, the EU where cookies are opt-in by law?

Reasons to block javascript, #12395 in a series.

To be clear, its not a developer at the NYTimes that has implemented.<p>It looks like the script in question is hosted on a domain (&quot;tagsrvcs.com&quot;) that Adobe uses when loading JS assets for Omniture.<p>This is very likely a standard Adobe Omniture thing. So its not the NYT acting alone (or necessarily with awareness of this).

Why are they doing this?

i&#x27;ve had a bit to drink, can someone ELI5 this to me?

In other news: If you create a IP connection the other party knows your IP-Address. With WebRTC some parts of this ugly NAT madness are gone.<p>Nothing to see here.

Here&#x27;s another White Hat use case for local IP addresses.<p>You can use it to unobtrusively monitor license compliance for a SaaS biz. You charge each user. A user is constantly logging on from multiple browsers during the day (e.g. IE and Chrome). With local IP knowledge you can determine whether or not this is being done from the same machine (still abiding by license terms), or from multiple machines (most likely sharing with a colleague and breaking license terms).<p>Before this webRTC hack the only other way to do this that I am aware of, is via the dreaded Flash cookie.