Real-Time Compromise: Investigating RTC Security in Consumer IoT
summary
Built an RTCInspect open-source framework that processes Wireshark captures and applies heuristics now being upstreamed into Wireshark to flag protocol and crypto flaws. Researchers analyze 21 applications, 11 IoT devices, 10 web platforms and find web apps mostly follow WebRTC but six use SFUs that break E2E crypto, while IoT devices show unencrypted signaling, leaked TURN credentials and reused device certificates enabling practical MITM and video interception.
AI-written summary · about
chapters (9)
- 0:00RTC security research intro
- 1:16Research question and setup
- 2:20Four RTC implementation phases
- 4:53WebRTC framework overview
- 5:34Security weaknesses in RTC
- 7:45RTC Inspect tool features
- 8:48Web platform results
- 9:30Consumer IoT results
- 10:13Key contributions and risks
related talks
46mWeb Security Experts: Are you overlooking WebRTC vulnerabilities?
31mAn IoT security solution based on 10 years of experience in VoIP technology
26mThreat Modeling for IoT
30mDemystifying IoT/OT Hacks With SDR
29mSecuring IoT/OT Against Modern Threats
50mOverTime: Remote Timing Attacks Against IoT Devices
48mSecuring The Internet Of Things
40mSecurity/Privacy in the IoT generation