Virtual Private Networks, or VPNs, turn out to be less private than the name suggests, and not just because service providers may keep more records than they acknowledge.
Security researcher Paolo Stagno, also known as VoidSec, has found that 23 per cent (16 out of 70) of VPN providers tested leak users' IP address via WebRT.
Browsers that have WebRTC enabled by default:
- Edge (it does not leaks at the moment since it doesn’t support ‘createDataChannel’)
- Epiphany (Gnome)
- Mozilla Firefox
- Google Chrome
- Google Chrome on Android
- Internet (Samsung Browser)
Stagno suggests disabling WebRTC, among other measures to protect privacy. In Chrome, that requires an extension, such as uBlock Origin. In other browsers, the fixes vary.
17% of the tested VPNs and Proxies services disclosed the real IP address of the visitors making the users traceable.
The following big name providers leaks users’ IP:
- ChillGlobal (Chrome and Firefox Plugin)
- Glype (Depends on the configuration)
- Hola!VPN Chrome Extension
- HTTP PROXY in browser that support Web RTC
- IBVPN Browser Addon
- PHP Proxy
- psiphon3 (not leaking if using L2TP/IP)
- SOCKS Proxy on browsers with Web RTC enabled
- SumRando Web Proxy
- TOR as PROXY on browsers with Web RTC enabled
- Windscribe Addons (Browser Extension/Plugin)
Some tips to follow in order to protect your IP during the internet navigation:
- Disable WebRTC
- Disable Canvas Rendering (Web API)
- Always set a DNS fallback for every connection/adapter
- Always kill all your browsers istances before and after a VPN connection
- Clear browser cache, history and cookies
- Drop all outgoing connections except for VPN provider
Proof of Concept:
You can check if your VPN leaks through this POC: http://ip.voidsec.com
If your provider is vulnerable, it would leak your personal / home IP information and put your privacy at risk!