0

This applies to any country, but here's some context:

  • Website: BBC iPlayer (a major UK streaming website, registration mandatory)
  • Server: Linode, London data centre
  • VPN: SoftEther on HTTPS port 443
  • Country of stay: South Africa

This is a standard situation for residents of country X visiting country Y to try to gain access to a service geo-restricted to country X.

What APIs could be exposing the South African location? I say location as context broader than IP addresses should be considered. The following spring to mind:

  1. Cached HTML5 geolocation API
  2. Cookies on third party websites exposing the client once in South Africa when not using the VPN and a timeout realising the flight time to get from country Y's capital city back to country X's is too short
  3. Installation of the country X website's iOS/Android app revealing GPS location combined with the "flying time" methodology in point 2
  4. The website having knowledge that certain IP blocks are from "eyeball" networks (the major ISPs... i.e. ALLOW) and others are from "content" networks (the major cloud providers... i.e. VPN i.e. BLOCK)
  5. WebRTC revealing a private 10.10.0.2 IP which is a typical VPN IP allocation although I can easily change such a DHCP setting on the server
  6. Ping packets (or an HTML5 simulation of such) revealing 300ms latency to an IP claiming to be from city X, when the provider's streaming server is also in city X

Are there any approaches I may have missed?

  • What about HTTP request headers like preferred language? It may differ from the languages used in Country X. What about the IP address of the VPN tunnel exit? The Website may use a blacklist of VPN provider's IP pools. – nulldev Jul 3 '18 at 6:28
  • VPN tunnel exit is London (Country X). The language tag could be en-ZA which does not match en-GB, that's also a possibility. Very interesting discussion on essentially fingerprinting here, thanks for these extra ideas. – ABCTaylor Jul 3 '18 at 15:24
1

Your first three explanations, from the perspective of a webadmin, seem a bit too cumbersome to be worth the bother.

Have you tried looking into WebRTC leaks? They're a popular vector for deanonymizing VPN users. Either disable WebRTC in your browser's about:config (or equivalent), or setup a firewall to exclusively allow network access through the VPN tunnel. For example, CDNs are based on location, so leakage could give your true location away.

It's also possible to detect VPNs in general based on their reverse DNS. VPN providers usually have a set of hostnames that turn up upon an rDNS query that can be used to detect VPN usage (and even the exact provider).

  • WebRTC probably the giveaway. Stream still blocked (due to mandatory registration policy recording previously leaked attempt). I found a good plugin. rDNS is a good idea but server has a very non-generic rDNS (nothing with "vpn" in the name). Accepting answer. – ABCTaylor Jul 2 '18 at 20:17
1

Answering own question for other webadmins/privacy-conscious users:

jstz and other scripts can accurately detect timezone, in my case "Africa/Johannesburg" or UTC+0200, and it could be knowledge that the server should only welcome visitors from UTC+0100 for example.

As mentioned by the accepted answer, WebRTC leaks also give away DNS servers on all adapters and as such reveals a South African DNS server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.