0

If I connect to a VPN, go to some websites, post something or browse something, is it possible for my OS (Windows 10) in this case to:

  1. Store my IP before I connected to the VPN, say "old IP".
  2. Get my new IP after I connect.
  3. Send both to some servers which log all internet traffic so it could match me up thus destroying any kind of anonymity.

Does this kind of simple leak have a name? Should I assume it happens? How would I prevent against it?

1 Answers1

0
  • Is it possible?

Yes. From context, I can tell you mean the public IP address(es) of your network (vs. RFC 1918 LAN IP). Since that isn't actually stored anywhere on your computer, determining this requires an active approach: the OS/app would connect to a peer on the Internet (could be microsoft.com in the case of Windows) in order to ask: "What address do you see me coming from?" STUN uses this approach. A less accurate method (pinpoint you to a region instead of a particular IP) that doesn't require coordination with some Internet server could be an early-aborted traceroute to obtain the IP of your ISP's last-mile hop.

  • Does this have a name?

Probably not. I'd call it some sort of "leak" like you did. It certainly hurts privacy.

  • Should I assume it happens?

Probably not for Windows. There's no reasonable way to do this without generating obvious network packets that draw attention. Even encrypted packets draw suspicion if they're headed somewhere you didn't authorize. Windows 10 does send a lot of data to the mother ship, but server-side client fingerprinting across ad networks for the sites you browse are more robust attacks against your privacy; note that a VPN is no use against browser/OS/user-agent/behavior fingerprinting.

You are also probably safe from this behavior if you use an open-source app/OS, as you (or the community at large) can review the code for anything nefarious. You can't do this for closed source code, so anything could theoretically be there.

  • How would I prevent against it?

The attack isn't very commonplace because it's fragile and risky compared to alternatives. If you pinpoint the servers or protocols used in the exfiltration, you could block the traffic using a host firewall (or your network firewall, if you can't trust your OS).

armani
  • 2,658
  • 19
  • 20