Internal IP Address
Internal IP address - NAT addresses and Private IP explained and why you should have a natted addy.
Your external IP address (38.107.191.117) is always exposed to the internet, if it wasn't, you wouldn't be able to visit sites. On the other hand, your internal IP address should be protected and not be obtainable by websites.
Internal IP
This does not necessarily mean your firewall is malfunctioning or improperly configured. The method we used will sneak past most firewalls. Why? Because we use Java to grab the information and then pass it on to the server (Notice how everything ran without prompting you?)
Private IP - Why you're Vulnerable
When we use the term 'vulnerable' we refer to your computer executing a program hosted on another server without any interaction from you. We used your internal IP for this demonstration because it's harmless (for the most part). Java passes this information to the server were it can be collected. Many claim this is not possible and that only you can see this information, so to prove the point, we included the last 20 internal IP addresses that this server has seen.
To verify this information, simply tell a friend your Private IP and have them visit this page shortly after you do - they'll see your IP included in the list. If they don't, then you're good to go!
What in the world is a Private or Natted IP?
A natted IP address (network address translation, network masquerading, IP masquerading) is a simply a method in which the source and/or destination addresses of IP packets are rewritten as they pass through a router or firewall. A private IP addresses is usually what is rewritting and range from:
10.0.0.0 - 10.255.255.255
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
IP Privacy
A hypothetical example of using your internal IP address to track your activities is an internet service provider. Some cable companies charge you for each computer connected to your cable modem. By tracking your internal IP address, the cable company could see that you're running multiple computers on one router and bill you accordingly.
The whole point of this demonstration is to make you aware that there is more to security than just a firewall. A malicious website owner could use a similar method to grab a lot more than your internal IP address, and you wouldn't even know it!
Last 20 Internal IP addresses are listed below.
The last one listed is the most recent.
192.168.1.65
10.0.0.2
192.168.1.2
10.0.1.2
192.168.0.193
10.184.68.72
192.168.1.104
192.168.0.3
10.2.11.97
192.168.1.3
192.168.1.101
192.168.1.244
192.168.0.101
10.0.1.7
192.168.0.100
192.168.2.101
192.168.2.13
10.6.146.133
192.168.1.133
192.168.0.103
I see my Private IP - What can I do?
Don't panic, even if someone has this information, there is not much that can be done with it. I provided an exaple above of what can be done with this knowledge, but another example would be an employee hiding behind a company firewall, or a person using a proxy server, trying to use a stolen credit card.
The 'deviant' thinks she is safe behind the company firewall becuase the technology department is not tracking her internet activities. She makes the pruchase from a online store; the store soon discovers the fraud and using the same method we used to find your internal IP, they discover the real IP address behind the company firewall. The store simply contacts the company's technology department and provides them with the real IP address (which may or may not be a non-routable addy) which in turn discovers the employee that made the purchase.
The point is, you should be concerned that a Java applet ran without your knowledge, found some information and passed it back to the server.
It was cross site leaking of java that gathered this information made possible by passing variables back from the applet and constructing a url in java to a web page using an iframe that contains the data to be collected. The server can then read this information, store and process the internal ip address as needed.
The only way to prevent this that we are aware of, is to disable active scripting in the browser.
Have you tried our test on Anonymous Surfing? If not, you should just to be safe.