Masking your IP address, including WebRTC
Your internet protocol, or IP address, is your virtual address on the internet. If you’re on the internet, you have an IP. When you visit a website, your web browser tells the web server which IP address to send the content of their website to. When you email someone, your originating IP address can be found in the message headers.
If you’ve received an email, or run a website, you can easily determine the IP address of all of your visitors, as well as a lot of other information about them.
Why would you want to mask, or hide your IP address? If you’re looking up the information of your business’ competition, or an opposing political party, you might not want them knowing who, or where, you are. If you’re emailing a stalker to leave you alone, you likely don’t want to inadvertently tell them exactly where you are. If you aren’t masking your IP, your entire web traffic history is being sold and brokered in the background amongst advertisers and anyone else willing to pay.
There are many services that map your geo-location to your IP. For example, see how accurate infosniper.net, iplocation.net, or ipfingerprints.com. are in knowing your location, and they are a few of the free, often less accurate options. Every website you visit, and everyone you email gets this information about you.
One popular way to mask your IP, is to go through a proxy, such as a Virtual Private Network or VPN. If you’re connecting through a VPN, the other party will likely only see the IP address of the VPN provider. The VPN provider then forwards all the information received to your computer privately in the background. However, just because you’re using a VPN, you should always test to make sure your IP is not being leaked through the VPN before trusting it.
One popular way for web site administrators, attackers, and ad providers to find out if you’re using a VPN, is through WebRTC. This year it was reported on Hackernews that WebRTC leaks the originating IP.
So how can you tell if your IP address is being leaked via WebRTC? Look up your IP on ipleak.net. Under Your IP address - WebRTC detection you should hope it says No leak, RTCPeerConnection not available. otherwise if you’re not so lucky it will tell you the private address you’re on, which no one should know.
How do you block this leakage? Mullvad documents the process for various browsers. Perhaps the easiest, and best way to mask your IP, including WebRTC, is to use the tor browser when surfing the web. It not only goes through several nodes or proxies, it encrypts the traffic between each one.
Once you’ve disabled WebRTC, or installed tor browser, give http://ipleak.net/ another try and make sure it shows a different IP than your real one.
Need this translated for your organization? PrivaSecTech offers confidential briefings, policy reviews, workshops, and privacy/security advisory for teams that need to decide what to do next.
