Update: Please note that this not a WebRTC leak. This involves DNS prefetching which is activated by default on all Chrome browsers. We’ve already informed some of the VPN providers about this issue and they’re in the middle of fixing this. If your VPN provider is on the list or it leaks your DNS through browser extensions (take test here), please be sure to inform us or them so they could patch this.

Affected VPNs: Last test on 12th of July

VPNs That Don’t Leak

Intro

Google Chrome has a feature called DNS Prefetching (https://www.chromium.org/deve lopers/design-documents/dns-pr efetching) which is an attempt to resolve domain names before a user tries to follow a link.

It’s a solution to reduce latency delays of DNS resolution time by predicting what websites a user will most likely visit next by pre-resolving the domains of those websites.

The Problem

When using a VPN browser extensions, Chrome provides two modes to configure the proxy connections, fixed_servers and pac_script.

In fixed_servers mode, an extension specifies the host of a HTTPS/SOCKS proxy server and later all connections will then go through the proxy server.

In pac_script mode on the other hand, an extension provides a PAC script which allows dynamically changing the HTTPS/SOCKS proxy server’s host by various conditions. For example, a VPN extension can use a PAC script that determines if a user is visiting Netflix by having a rule that compares the URL and assigns a proxy server that is optimized for streaming. The highly dynamic nature of PAC scripts means the majority of VPN extensions use the mode pac_script over fixed_servers.

Now, the issue is that DNS Prefetching continues to function when pac_script mode is used. Since HTTPS proxy does not support proxying DNS requests and Chrome does not support DNS over SOCKS protocol, all prefetched DNS requests will go through the system DNS. This essentially introduces DNS leak.

There are 3 scenarios that trigger DNS Prefetching: Manual Prefetch

DNS Prefetch Control

Omnibox The first two allow a malicious adversary to use a specifically crafted web page to force visitors to leak DNS requests. The last one means when a user is typing something in the URL address bar (i.e. the Omnibox), the suggested URLs made by Chrome will be DNS prefetched. This allows ISPs to use a technology called “Transparent DNS proxy” to collect websites the user frequently visits even when using browser VPN extension. Test Your VPN For DNS Leaks To test if your VPN is vulnerable, do the following test: Activate the Chrome plugin of your VPN Go to chrome://net-internals/#dns Click on “clear host cache” Go to any website to confirm this vulnerability

If you find a VPN that is not listed, but leaks – please send us a screenshot ( If you find a VPN that is not listed, but leaks – please send us a screenshot ( [email protected] ) and we’ll update the list.