News for hackers. Stuff that matters.
Re:Abusing WebRTC to reveal coarse location data in Signal by verdverm on Wednesday May 20, 2020 @04:58PM (#23251713)
I recall seeing a paper where they showed how close you can geolocate with various numbers of peers to the target, by using network latency alone
Re:Abusing WebRTC to reveal coarse location data in Signal by stagas on Wednesday May 20, 2020 @05:18PM (#23251910)
That's funny, I was just working on a POC like this today[0] - it's accurate most of the time for my location but I haven't tested from other locations. You'd need to tweak the 'known' servers on and off to find the optimal arrangement because you'd need to be somehow inside the polygon. I was planning to find a way to discover these itself and other tweaks (like trying multiple times then averaging out)

Edit: the paper I found related to this is here[1]

[0]: https://github.com/stagas/http-geolocate

[1]: https://homes.cs.washington.edu/~tom/support/geoloc.pdf

Re:Abusing WebRTC to reveal coarse location data in Signal by RL_Quine on Wednesday May 20, 2020 @05:41PM (#23252176)
https://vercel.com/edge-network

This page contains websocket addresses of a CDN that returns ping pong from a huge number of locations. It works surprisingly well for working out very fine grain location in just playing with it.

Re:Abusing WebRTC to reveal coarse location data in Signal by stagas on Wednesday May 20, 2020 @05:57PM (#23252399)
Oh wow, they're actually doing the same thing, triangulating on latency. Hive mind, I guess. I used universities because I figured a)they won't mind, and b)they're more likely to have their servers on premises, then used a public reverse geoip to get their locations. I'll try to see if I can integrate with Vercel's edge network, seems more ideal.

Edit: no, I misunderstood, the location dot that's being displayed isn't the product of triangulation, they're just doing reverse geoip lookup. So, I wonder now if the edge network would perform better.

Update: it doesn't perform better. Either there is some kind of proxy redirecting their traffic or these servers aren't where they say they are, the center is skewed out completely. The universities win so far being correct and accurate most of the time.

Re:Abusing WebRTC to reveal coarse location data in Signal by LargoLasskhyfv on Wednesday May 20, 2020 @07:13PM (#23253110)
Unimpressed with yours. Why? Because my ISP got some IPv4 space recently, which was formerly allocated to .ua, .ru, .iq, & .ir. While being physically next to or in Hamburg, .de. That led to all sorts of inconveniences for some people, suddenly barred from logging on, or using the sites they frequent, because they used outdated geo-ip data. I didn't even notice, except for the outrage in their customer forum.

Now yours consistently puts me somewhere into, or onto the shores of the Black Sea, while Vercels doesn't. So that makes me suspicious of your claim by using latency alone.

Edit: There seems to be outdated geo-ip information factored in somewhere. Why else it would put me IN the Black Sea?

Re:Abusing WebRTC to reveal coarse location data in Signal by stagas on Wednesday May 20, 2020 @07:20PM (#23253170)
I mentioned I just started working on it. To try for yourself you'd need to clone and tweak the servers list to find an optimal arrangement for you. The problem as I see it is that jumping continents occurs really artificial delays which skews the result significantly, so it first needs to identify your relative whereabouts, then decide on an optimal set of servers. If you clone and tweak the servers to place yourself inside the polygon you'd see it does locate you. Vercel is doing a reverse geoip lookup, so your location is preconfigured in some database based on your ip.
Re:Abusing WebRTC to reveal coarse location data in Signal by LargoLasskhyfv on Wednesday May 20, 2020 @07:26PM (#23253229)
At least they are current ;-)
Re:Abusing WebRTC to reveal coarse location data in Signal by gregoryl on Wednesday May 20, 2020 @09:19PM (#23253931)
I hope you can come back in a day or so, and re-read this conversation. You're not being very nice, or fair, and it doesn't portray you in a good light.
Re:Abusing WebRTC to reveal coarse location data in Signal by LargoLasskhyfv on Wednesday May 20, 2020 @09:25PM (#23253966)
I probably will. It may have come across harsh, but wasn't intended as such. IMO i outlined the reasons why sufficiently in my post and edit.
Re:Abusing WebRTC to reveal coarse location data in Signal by stagas on Thursday May 21, 2020 @02:19AM (#23255385)
Maybe you misunderstood what the tool is doing. It is not doing geoip, it is using the latency of pings between your client and some selected servers with known locations, then calculates the center based on those timings and these known locations. Very simple, you can look at the code and see what it's doing. It's not factoring in any kind of real latency, such as the speed of light, hop delays, etc. Unfortunately, as others pointed out, this method works poorly, especially in such long distances. In my tests you can only find a certain window that performs well for your location, still within a radius of hundreds or thousands of kms, which makes it pretty unusable as you point out. Knowing what _doesn't_ work is also valuable information.
Re:Abusing WebRTC to reveal coarse location data in Signal by LargoLasskhyfv on Thursday May 21, 2020 @02:46AM (#23255514)
I understood that. Let me replay it from my mind, how i percieved it. There is the dark map with white contours. And yellow points on it, which represent the triangualiton servers, i guess? Even clickable, at least the RED point which represents my assumed location sometimes moved. Most notably when i clicked on London, then it hopped to Odessa. Otherwise, it was mostly in the northeast region of the Black Sea. In the light of the recent IPv4-space acquisition of my ISP, which i wrote about containing addresses formerly used in the Ukraine, Russia, Irak and Iran, causing "funny" issues...what would you have thought?
Re:Abusing WebRTC to reveal coarse location data in Signal by LargoLasskhyfv on Thursday May 21, 2020 @03:09AM (#23255626)
edit: btw. tested in latest Firefox with uBlock Origin on/off. and Iridium Browser (Chromium derivative), retested in Iridium only after 24h dyn-ip renewal. Same results.

Anyways, time to sleep. Sun's getting too bright.

Re:Abusing WebRTC to reveal coarse location data in Signal by mike_d on Wednesday May 20, 2020 @07:36PM (#23253299)
This is commonly referred to as "ping triangulation" and seems to be reinvented every few years. It sounds good in theory but in practice performs poorly unless ran consistently for days, which is why few researchers end up writing it up or publishing POCs for the next person to find. :)

You should take a look at network path convergence for geolocation instead. You can see a demo of the tool I wrote at https://traceroute.guru/tr/209.216.230.240

Re:Abusing WebRTC to reveal coarse location data in Signal by toast0 on Wednesday May 20, 2020 @10:22PM (#23254248)
I think the key thing to keep in mind with this approach is that physical distance and network distance are only loosely related.

You can easily be next door to someone, and your packets go all the way across the country to get there.

I've definitely seen cases where my latency to two servers in the same building were wildly different, depending on the paths my ISP and their ISP(s) routed the traffic.

I'm about 22 ms roundtrip away from ISPs facility at the local internet exchange in Seattle. If a server is connected to that exchange, and traffic flows through the exchange both ways, I see ping times of about 22 ms. Sometimes, my ISP will send traffic through San Jose instead, but the server returns the traffic in Seattle, and that adds about 26ms, so I get a 48 ms ping. If both sides route through San Jose for whatever reason, I'll get 74 ms, which is close to what I'd get if the routing was sensible and the server was in the Washington, DC area. (You normally can't see the routing back from the server, but sometimes you control the server, too).

If I were building something like this, I'd want to try to determine how much of the latency was the user getting to where their ISP interconnects with other networks (or with multiple routes within their own network), and then where that interconnection location is. I'd guess you can get a pretty good idea of the interconnection location, based on reasonable network paths from there, but distance from the interconnection point is going to be tricky, most residential networking technologies add much more latency than the speed of light, so your upper bound of distance is going to be pretty far off. Of the roughly 22 ms I see to Seattle, about 20 ms is just coming from the DSL termination; when I had AT&T GPON, it added about 4 ms to my pings; that's a lot of distance.

Re:Abusing WebRTC to reveal coarse location data in Signal by ummonk on Wednesday May 20, 2020 @07:28PM (#23253240)
Weird. Your POC seems to be placing me almost directly opposite in the caucasus.
Re:Abusing WebRTC to reveal coarse location data in Signal by stagas on Wednesday May 20, 2020 @07:56PM (#23253428)
Yeah, it doesn't work really well :) Work in progress
Re:Abusing WebRTC to reveal coarse location data in Signal by cjbprime on Wednesday May 20, 2020 @05:19PM (#23251922)
Would be interesting to see a link! That doesn't sound like it would get an accurate guess to me, given facts like "light travels slower in copper than fiber" and "your packets have to enter a country through specific large hubs" etc etc.
Re:Abusing WebRTC to reveal coarse location data in Signal by Avamander on Wednesday May 20, 2020 @05:44PM (#23252227)
If you have enough machines you can just use machines after those large hubs. The copper/glass light speed difference doesn't matter much because the speed differences added by hops in the middle are usually orders of magnitudes higher.

In the end, unless you've got machines next door pinging your target you won't be able to differentiate between houses or city blocks.

Re:Abusing WebRTC to reveal coarse location data in Signal by ravenstine on Wednesday May 20, 2020 @05:10PM (#23251836)
That's pretty interesting. So, effectively, a triangulation based on latency times?
Re:Abusing WebRTC to reveal coarse location data in Signal by Disposition on Wednesday May 20, 2020 @07:07PM (#23253063)
Hate to be a pedant, but it's technically trilateration.
Re:Abusing WebRTC to reveal coarse location data in Signal by stagas on Thursday May 21, 2020 @02:27AM (#23255427)
I didn't know this term, thank you for being such a pedant :) knowing the right term makes it easier to find information on the subject.
Re:Abusing WebRTC to reveal coarse location data in Signal by Avamander on Wednesday May 20, 2020 @05:39PM (#23252140)
> So, effectively, a triangulation based on latency times?

Yes.