Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have two computers, both of them locate at the same local WIFI network ( ie: connected to the same router).
I use VPN on a computer to visit a website, and don't use VPN on another to visit the same website. Can this website know that both computer are located within the same local WIFI network?
In theory, yes, the webrtc standard let's a website determine your local ip address, so it can create a direct connection for you to a another web-browser, allowing direct connections between browsers to set up video streaming for example.
This website has a proof of concept showing you your internal and external ip address: https://www.privacytools.io/webrtc.html
Once the website has both internal ip addresses, it can use javascript to try to set up a connection over the internal ip's from pc1 to pc2, if this succeeds, it knows these 2 pc's are in the same local network.
remark: Chrome on iOS, Internet Explorer and Safari do not implement WebRTC yet, see https://www.privacytools.io/#webrtc for more info.
Update 23/08/2018: Another possible attack vector has come to my attention lately:
DNS rebinding, from wikipedia:
In this attack, a malicious web page causes visitors to run a client-side script that attacks machines elsewhere on the network. In theory, the same-origin policy prevents this from happening: client-side scripts are only allowed to access content on the same host that served the script. Comparing domain names is an essential part of enforcing this policy, so DNS rebinding circumvents this protection by abusing the Domain Name System (DNS).
This attack can be used to breach a private network by causing the victim's web browser to access machines at private IP addresses and return the results to the attacker. It can also be employed to use the victim machine for spamming, distributed denial-of-service attacks or other malicious activities.
This works by having a malicious website/dns server setting a very low ttl for it's dns requests, and then having javascript running scripts on the original website's address. Half of the time the dns will respond with the correct external ip, so the website will load, but after a few minutes when the javascript kicks in and tries to access the website again the dns will respond with a local ip adres (e.g. 192.168.0.1, this can change every few minutes) and the browser will run the javascript and connect to devices on the local network!
If your system is setup properly (your VPN isn't leaking, you never contacted the web site except through your VPN, you're not allowing the web site to run anything on your machine with anything but default priority and the web site isn't exploiting something in your setup to run code by itself), then no: the web site can not find out that both of your machines are on the same local network.
That isn't to say it cannot find out that they are related indirectly: the obvious way is if you login with the same credentials but they are other, more subtle ones (cookies and related objects, usage pattern analysis, etc.)
O.K. After some research I found out that it could be possible using some malicious ActiveX control. For one, such a control is able to read files on your local disk. This could be used to determine the connection type, and possibly connection details, including ESSID, and potentially the SSID. I'm nowhere near producing a PoC code though. This of course applies only to browsers supporting ActiveX.
Other methods could involve Java, and generally injecting some malicious code to get control of your machine, but the latter is well beyond the scope of this question.
In general, a browser cannot detect your local IP or any information about your LAN. Thus any javascript code running in your browser cannot communicate to the web site any information about your computer or your LAN.
HOWEVER... most browser plug-ins and Flash or Active-X controls can access data that is normally restricted by the browser. For that reason, it is important to treat browser plug-ins and extensions VERY carefully. If possible, never use these, and if you have to, keep the plug-in settings to 'ask' (where the browser asks you before running a plug-in on any site).
No. The website only knows the public IP address from where you are connecting.
Obviously the public IP address is different when you go through your local router than going through a VPN.
If you use a VPN, the public IP address is the address of the router used to go outside in the site where the VPN tunnel ends. It could be even in another country. It's the trick that some people use to circumvent region restriction on YouTube, Netflix, Hulu,etc.
