Eavesdropping on WebRTC Communication with Funny Cat Pictures

on YouTube ↗39m

" summary

Shows a practical browser-side man‑in‑the‑middle attack on WebRTC where injected JavaScript (via a single XSS bug, a compromised signaling server, or a malicious CDN) reads and tampers with session descriptions and ICE candidates. The exploit manipulates browser connection objects and SDP to redirect audio/video and exfiltrate media and metadata without any attacker infrastructure, demonstrated as a working proof‑of‑concept that reliably captures both participants’ streams.

AI-written summary · about

" chapters (6)

1. 0:00WebRTC eavesdropping intro
2. 6:32WebRTC browser communication
3. 13:18WebRTC identity security
4. 20:54WebRTC JS and connections
5. 27:40WebRTC security risks
6. 34:17WebRTC security future

" related talks

• 46mWeb Security Experts: Are you overlooking WebRTC vulnerabilities?Sandro Gauci · OWASP Global AppSec San Francisco 2024
• 58mExploiting web messaging implementationsBarak Tawily · Global AppSec US 2021 Virtual
• 43mAttacking Modern Web TechnologiesFrans Rosén · OWASP AppSec Europe 2018
• 28mOffensive and Defensive Strategies for Client-Side JS SecurityAnand Vemuri · JSConf Budapest 2016
• 34m"The magic of XSS - not only in web applications"Michał Bentkowski · CONFidence 2019
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018