10

I have two computers, both of them locate at the same local WIFI network ( ie: connected to the same router).

I use VPN on a computer to visit a website, and don't use VPN on another to visit the same website. Can this website know that both computer are located within the same local WIFI network?

  • Which browser are you using? – Konrad Gajewski Jul 9 '15 at 10:52
  • @KonradGajewski, standard browser like Firefox or Google Chrome – Graviton Jul 9 '15 at 11:31
  • The reason why I am asking is because potentially ActiveX is able to access your disk/other system resources on your computer. And this could potentially get you your ESSID. – Konrad Gajewski Jul 9 '15 at 11:43
  • As mentioned webrtc can expose your local IP, a good resource for detecting webrtc leaks is whoer.net – HamblePie Aug 23 '18 at 7:29
5

In theory, yes, the webrtc standard let's a website determine your local ip address, so it can create a direct connection for you to a another web-browser, allowing direct connections between browsers to set up video streaming for example.

This website has a proof of concept showing you your internal and external ip address: https://www.privacytools.io/webrtc.html

Once the website has both internal ip addresses, it can use javascript to try to set up a connection over the internal ip's from pc1 to pc2, if this succeeds, it knows these 2 pc's are in the same local network.

remark: Chrome on iOS, Internet Explorer and Safari do not implement WebRTC yet, see https://www.privacytools.io/#webrtc for more info.

Update 23/08/2018: Another possible attack vector has come to my attention lately:

DNS rebinding, from wikipedia:

In this attack, a malicious web page causes visitors to run a client-side script that attacks machines elsewhere on the network. In theory, the same-origin policy prevents this from happening: client-side scripts are only allowed to access content on the same host that served the script. Comparing domain names is an essential part of enforcing this policy, so DNS rebinding circumvents this protection by abusing the Domain Name System (DNS).

This attack can be used to breach a private network by causing the victim's web browser to access machines at private IP addresses and return the results to the attacker. It can also be employed to use the victim machine for spamming, distributed denial-of-service attacks or other malicious activities.

This works by having a malicious website/dns server setting a very low ttl for it's dns requests, and then having javascript running scripts on the original website's address. Half of the time the dns will respond with the correct external ip, so the website will load, but after a few minutes when the javascript kicks in and tries to access the website again the dns will respond with a local ip adres (e.g. 192.168.0.1, this can change every few minutes) and the browser will run the javascript and connect to devices on the local network!

  • Thanks for posting this! Tried this with Firefox and shows nothing (now 2018). Using Chrome however, shows the local IP address! Then it is easily to detect or find the routers it address by sniffing all kind of addresses inside this range with javascript. I don't know if it is possible (i think it is, with some tricks) it can be a real danger. – Codebeat Feb 7 '18 at 4:51
0

If your system is setup properly (your VPN isn't leaking, you never contacted the web site except through your VPN, you're not allowing the web site to run anything on your machine with anything but default priority and the web site isn't exploiting something in your setup to run code by itself), then no: the web site can not find out that both of your machines are on the same local network.

That isn't to say it cannot find out that they are related indirectly: the obvious way is if you login with the same credentials but they are other, more subtle ones (cookies and related objects, usage pattern analysis, etc.)

0

O.K. After some research I found out that it could be possible using some malicious ActiveX control. For one, such a control is able to read files on your local disk. This could be used to determine the connection type, and possibly connection details, including ESSID, and potentially the SSID. I'm nowhere near producing a PoC code though. This of course applies only to browsers supporting ActiveX.

Other methods could involve Java, and generally injecting some malicious code to get control of your machine, but the latter is well beyond the scope of this question.

  • 1
    If I remember correctly, ActiveX is not presented on Google Chrome or Firefox right? – Graviton Jul 10 '15 at 3:48
  • Not by default. There are plug-ins though. – Konrad Gajewski Jul 10 '15 at 9:05
0

In general, a browser cannot detect your local IP or any information about your LAN. Thus any javascript code running in your browser cannot communicate to the web site any information about your computer or your LAN.

HOWEVER... most browser plug-ins and Flash or Active-X controls can access data that is normally restricted by the browser. For that reason, it is important to treat browser plug-ins and extensions VERY carefully. If possible, never use these, and if you have to, keep the plug-in settings to 'ask' (where the browser asks you before running a plug-in on any site).

  • a browser can detect your local Ip ( like any program running on your computer) but shouldn't disclose it without your permission except that in fact WebRTC does. – grandchamp robin Aug 19 '15 at 14:17
  • yes of course a browser can detect everything on your computer and do all kinds of bad stuff. What I meant was that browsers create a sandbox for your web applications that cannot access local IP or filesystem etc. Caveat - plug-ins and extensions can be used by web applications to bypass the sandbox restrictions. Also see WebRTC vulnerability pointed out by @jens timmerman ... not sure if the leak was an oversight in the WebRTC design or by design. – Ruchir Godura Aug 20 '15 at 15:03
-2

No. The website only knows the public IP address from where you are connecting.

Obviously the public IP address is different when you go through your local router than going through a VPN.

If you use a VPN, the public IP address is the address of the router used to go outside in the site where the VPN tunnel ends. It could be even in another country. It's the trick that some people use to circumvent region restriction on YouTube, Netflix, Hulu,etc.

  • 1
    There are a few web browser technologies that could possibly do it, and a few cracking methods to do it as well. It is not that simple, so please don't give a false sense of security. – Konrad Gajewski Jul 9 '15 at 10:54
  • Can you explain it in a complete answer so everybody (including me) learn about it? – jcbermu Jul 9 '15 at 10:57
  • Well I'm working on it. Quite interesting question. – Konrad Gajewski Jul 9 '15 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.