Can uBlock Origin block WebRTC?

3 min read Original article ↗

Do you loathe online banking as much as I do? Does your bank make online banking more cumbersome each week in the name of "combating fraud" and "staying compliant" with anti-money laundering and counter terrorist financing laws?

Have you ever looked under online banking's hood? Here's an example from a bank that I use in Japan to pay for life necessities and to keep a roof over my head.

When accessing my online banking with SBI Shinsei Bank (SBI新生銀行) I noticed the following Little Snitch1 popup:

SBI Shinsei bank's log in screen connects to aa.online-metrix.net on 3478/UDP
SBI Shinsei bank's log in screen connects to aa.online-metrix.net on 3478/UDP Open in new tab (full image size 30 KiB)

Something in the background of the log in page tries to connect to aa.online-metrix.net on port 3478/TCP. IANA3 lists port 3478/TCP as follows:4

  • Session Traversal Utilities for NAT (STUN) port (RFC8489)
  • TURN over TCP (RFC8656)
  • STUN Behavior Discovery over TCP (RFC5780)

This is what the log in screen2 looks like:

Screenshot showing log in screen
Screenshot showing log in screen Open in new tab (full image size 120 KiB)

The connection attempt happens as soon as you enter your log in credentials and press the log in (ログイン) button.

Firefox on my computer uses uBlock Origin 1.72.2. uBlock Origin blocks the following domains when visiting the SBI Shinsei Bank log in page:

These are the domains uBlock Origin blocks on the log in page
These are the domains uBlock Origin blocks on the log in page

I can also confirm that the uBlock Origin connection logger blocks at least one connection attempt to a online-metrix.net domain:

uBlock Origin prevents SBI Shinsei from fetching a script from a online-metrix.net domain
uBlock Origin prevents SBI Shinsei from fetching a script from a online-metrix.net domain Open in new tab (full image size 84 KiB)

This same connection logger does not list the aa.online-metrix.net domain. It seems as though the STUN/TURN port connection attempt evades uBlock Origin.

The online-metrix.net domain somehow belongs to a company called LexisNexis.56

I notice similar behavior when I access websites "secured" by CloudFlare. I don't want to completely block STUN/TURN in my firewall as that will keep me, I assume, from doing video calls in my browser.

WebRTC Leak Test
WebRTC Leak Test Open in new tab (full image size 68 KiB)

Using the WebRTC Leak Test I found that allowing connections to random UDP ports reveals my local network IP address. The suits working for my bank are patting each other on their shoulders calling fraud a thing of the past, all thanks to knowing my local network IP address.

In the end, SBI Shinsei Bank is down for unknown reasons anyway:

SBI Shinsei feeling a bit down
SBI Shinsei feeling a bit down Open in new tab (full image size 11 KiB)

Update

A friendly commenter on Hacker News gave me the hint that you can block WebRTC connections per initiating site.7

Screenshot showing uBlock origin with a custom WebRTC connection blocking rule
Screenshot showing uBlock origin with a custom WebRTC connection blocking rule Open in new tab (full image size 28 KiB)

Here's what I use to block SBI Shinsei bank's log in from initiating WebRTC connections:

bk.web.sbishinseibank.co.jp##+js(nowebrtc)
uBlock Origin logs blocked WebRTC connection attempts
uBlock Origin logs blocked WebRTC connection attempts Open in new tab (full image size 60 KiB)

Helpfully, uBlock Origin also logs blocked connection attempts to your console:

Document tried to create an RTCPeerConnection:  
Object { iceServers: (2) […] }