# Neither Denied nor Exposed: Fixing WebRTC Privacy Leaks
## 4 IP Disclosure
### Problem Statement
Bear in mind that the JavaScript code becomes knowledgeable of all ICE candidates of the peer, and as each one of them is associated with a peer's private interface, the mapping of the user's connection topology is feasible. The script injection mentioned above can be performed using a Cross-Site Scripting (XSS) attack. This is feasible on a web application where user input is directly included in the webpage without previous validation or encoding. If the XSS attack is successful and the script executes any STUN requests, then those requests will not be blocked by extensions such as Adblock [15], given that STUN requests are made outside of the normal XMLHttpRequest procedure. While the main role of a STUN server is informing the peer of their public IP address and port as seen from its viewpoint, there are no completely safe ways for a user to hide their public or private IP address, even if a VPN or an anonymity network like Tor is employed. Bear in mind that, when a user connects to a VPN, a virtual network interface is created to handle all the network traffic, redirecting any data inside the VPN tunnel. Linux systems use the network tunnel (TUN) or network tap (TAP) [16] to provide packet reception and transmission when VPN is enabled. When a new virtual network interface is created, two or more adapters will be present and the operating system has to decide which one to use for sending traffic. The selection is based on the properties of each adapter, which, for example, in the MS Windows operating system are determined by a feature called _Automatic Metric_. After this process, the VPN adapter will be selected as the default in order to achieve secure and confidential communication. However, the previous main network interface that is the Ethernet or WiFi adapter is still active. In every operating system, the software is able to choose any active network interface for communication, but usually the default one selected by the operating system is used. Therefore, in the context of this adapter selection process, a STUN request may also reveal the end-user's public IP as allocated by the ISP to the JavaScript running on the webpage. Current trials over well-known VPN services, including _TunnelBear_[17] and _Hotspot Shield_[18], verify this situation. Although the MS Windows OS is the main victim of such a flaw, Mac and Linux systems may be vulnerable as well, depending on the user's VPN client and how it is configured [19]. In a similar research [20], the authors claimed that both Firefox and Chrome were vulnerable regardless of the underlying operating system, with iOS being the only exception. They also mentioned that the only browsers that support WebRTC, but were immune to this vulnerability, were Safari on Mac and Microsoft Edge on Windows. A straightforward solution for protecting the users' IP addresses would be the use of a VPN firewall, but still without ensuring full anonymity. Generally, if a VPN connection fails, any data will be sent unsecured. A VPN firewall will ensure that any outgoing traffic will be sent through the established VPN tunnel, forbidding any connection in case the tunnel breaks down for any reason. In addition, a VPN firewall offers more benefits, including tight firewall rules and defeating the shared VPN/Tor server leak bug [21]. However, even this approach does not ensure full anonymity. This is because some browsers can store data from past user activities, like previously opened tabs. In that case, if a tab is opened before the user connects to the VPN, the public IP of the user will be cached in memory. In addition, even if the public IP address is not leaked, the end-user's private IP is still left unprotected, since JavaScript is able to identify it. As a result, the server will retrieve and log all the available information that could be used to identify the user. Based on the WebRTC API [22], apart from public and private IP addresses, media information can also be retrieved by the \"MediaDeviceInfo\" interface.