---
title: "Watch WebRTC Live #76: WebRTC Exposed! Vulnerabilities and Attacks – WebRTC.ventures"
description: For our 76th episode of WebRTC Live, Arin was joined by Sandro Gauci to talk about the WebRTC attack surface. Sandro is the Chief Mischief Officer, Founder, and CEO at RTC security audit and penetration testing experts, Enable Security.
image: https://blog.webrtc.ventures/hubfs/Imported_Blog_Media/WebRTC-Live-_76_-WebRTC-Exposed-Vulnerabilities-and-Attacks.jpg
---

[Skip to content](https://blog.webrtc.ventures/2023/02/webrtclive-webrtc-exposed-vulnerabilities-and-attacks#main-content)

![WebRTC.ventures](https://blog.webrtc.ventures/hubfs/logo-main-light.svg)

- [WebRTC Services](https://webrtc.ventures/webrtc-development-services/)
  
  Show submenu for WebRTC Services 
  
    - [Assess](https://webrtc.ventures/services/assess/)
    - [Build](https://webrtc.ventures/services/build/)
    - [Integrate](https://webrtc.ventures/services/integrate/)
    - [Test](https://webrtc.ventures/services/test/)
    - [Manage](https://webrtc.ventures/services/manage/)
    - [Migrating From Twilio Video](https://webrtc.ventures/twilio-video/)
- Our Partners
  
  Show submenu for Our Partners 
  
    - [Amazon Chime SDK](https://webrtc.ventures/partners/amazon-chime-sdk/)
- Stories of Success
  
  Show submenu for Stories of Success 
  
    - [Remote Video Interpreting Platform with Agent Routing](https://webrtc.ventures/successes/remote-video-translation-platform/)
    - [WebRTC to SIP Gateway for ASL Interpreters](https://webrtc.ventures/successes/webrtc-to-sip-gateway-for-asl-interpreters/)
    - [Audio Listening Device to Improve Surgical Outcomes](https://webrtc.ventures/successes/audio-listening-device-to-improve-surgical-outcomes/)
    - [Albania’s First Telemedicine Platform](https://webrtc.ventures/successes/albanias-first-telemedicine-platform/)
    - [Automated Video Storytelling with the Amazon Chime SDK](https://webrtc.ventures/successes/automated-video-storytelling-with-the-amazon-chime-sdk/)
    - [Large Scale Video Conferencing](https://webrtc.ventures/successes/large-scale-video-conferencing/)
    - [Broadcasting and Webcast Control Room](https://webrtc.ventures/successes/live-video-broadcasting-and-webcast-control-room/)
- WebRTC Resources
  
  Show submenu for WebRTC Resources 
  
    - [WebRTC Live](https://webrtc.ventures/webrtc-live/)
    - [WebRTC Tips](https://www.youtube.com/playlist?list=PLayYqdnyegt3QvxX-Rt6wbFIK8727Z5Oz)
    - [WebRTC.ventures Blog](https://webrtc.ventures/blog/)
    - [Migrating From Twilio Video](https://webrtc.ventures/twilio-video/)
    - [WebRTC.ventures Training Program](https://webrtc.ventures/webrtc-ventures-training-program/)
- [About Us](https://webrtc.ventures/our-team/)
  
  Show submenu for About Us 
  
    - [Blog](https://webrtc.ventures/blog/)
    - [Our Team](https://webrtc.ventures/our-team/)
    - [Jobs](https://webrtc.ventures/jobs/)

Open main navigation

Close main navigation

- [WebRTC Services](https://webrtc.ventures/webrtc-development-services/)
  
  Show submenu for WebRTC Services 
  
    - [Assess](https://webrtc.ventures/services/assess/)
    - [Build](https://webrtc.ventures/services/build/)
    - [Integrate](https://webrtc.ventures/services/integrate/)
    - [Test](https://webrtc.ventures/services/test/)
    - [Manage](https://webrtc.ventures/services/manage/)
    - [Migrating From Twilio Video](https://webrtc.ventures/twilio-video/)
- Our Partners
  
  Show submenu for Our Partners 
  
    - [Amazon Chime SDK](https://webrtc.ventures/partners/amazon-chime-sdk/)
- Stories of Success
  
  Show submenu for Stories of Success 
  
    - [Remote Video Interpreting Platform with Agent Routing](https://webrtc.ventures/successes/remote-video-translation-platform/)
    - [WebRTC to SIP Gateway for ASL Interpreters](https://webrtc.ventures/successes/webrtc-to-sip-gateway-for-asl-interpreters/)
    - [Audio Listening Device to Improve Surgical Outcomes](https://webrtc.ventures/successes/audio-listening-device-to-improve-surgical-outcomes/)
    - [Albania’s First Telemedicine Platform](https://webrtc.ventures/successes/albanias-first-telemedicine-platform/)
    - [Automated Video Storytelling with the Amazon Chime SDK](https://webrtc.ventures/successes/automated-video-storytelling-with-the-amazon-chime-sdk/)
    - [Large Scale Video Conferencing](https://webrtc.ventures/successes/large-scale-video-conferencing/)
    - [Broadcasting and Webcast Control Room](https://webrtc.ventures/successes/live-video-broadcasting-and-webcast-control-room/)
- WebRTC Resources
  
  Show submenu for WebRTC Resources 
  
    - [WebRTC Live](https://webrtc.ventures/webrtc-live/)
    - [WebRTC Tips](https://www.youtube.com/playlist?list=PLayYqdnyegt3QvxX-Rt6wbFIK8727Z5Oz)
    - [WebRTC.ventures Blog](https://webrtc.ventures/blog/)
    - [Migrating From Twilio Video](https://webrtc.ventures/twilio-video/)
    - [WebRTC.ventures Training Program](https://webrtc.ventures/webrtc-ventures-training-program/)
- [About Us](https://webrtc.ventures/our-team/)
  
  Show submenu for About Us 
  
    - [Blog](https://webrtc.ventures/blog/)
    - [Our Team](https://webrtc.ventures/our-team/)
    - [Jobs](https://webrtc.ventures/jobs/)
- [Contact us](https://webrtc.ventures/contact/)

[Contact us](https://webrtc.ventures/contact/)

 Feb 24, 2023 12:00:00 AM

# Watch WebRTC Live #76: WebRTC Exposed! Vulnerabilities and Attacks

![Picture of Jen Oppenheimer](https://blog.webrtc.ventures/hs-fs/hubfs/Our-Team-Jen.jpg?width=50&name=Our-Team-Jen.jpg) [Jen Oppenheimer](https://blog.webrtc.ventures/author/jen-oppenheimer)

Share: [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://blog.webrtc.ventures/2023/02/webrtclive-webrtc-exposed-vulnerabilities-and-attacks) [X Twitter icon](https://twitter.com/intent/tweet?url=https://blog.webrtc.ventures/2023/02/webrtclive-webrtc-exposed-vulnerabilities-and-attacks) [envelope icon](mailto:?body=https://blog.webrtc.ventures/2023/02/webrtclive-webrtc-exposed-vulnerabilities-and-attacks)

On February 15, 2023, Arin welcomed [Sandro Gauci](https://twitter.com/sandrogauci) to WebRTC Live to talk about the WebRTC attack surface. Sandro is the Chief Mischief Officer, Founder, and CEO at RTC security audit and penetration testing experts, [Enable Security](http://enablesecurity.com/). To the real-time communications community, he is also known as the original developer of [SIPVicious OSS](https://www.enablesecurity.com/sipvicious/oss/), the open-source security suite for auditing SIP-based VoIP systems.

[WebRTC](https://webrtc.ventures/2021/01/what-is-webrtc/) uses encryption in the video, audio and data channels, and so it has some aspects of secure design built in. But there are still things that can go wrong. Sandro advises to design your applications and infrastructure with security in mind. Security gets more and more expensive the later you do it! 

## [Watch Episode #76!](https://youtu.be/qlQJuyp7nS8)

  

## Mindmap: WebRTC infrastructure attack surface

Sandro shared a mind map detailing the WebRTC infrastructure attack surface and discussed the areas that they’ve tested. 

1. **Signaling** (Authentication, authorization, quality of service, transport security, message processing, intrusion detection/prevention services) 
     1. SIP
     2. XMPP
     3. Custom Protocols
2. **Media** (Message processing, confidentiality & integrity, recording systems, transcoding) 
     1. RTP
     2. SRTP
     3. DTLS
3. **NAT Transversal** 
     1. TURN
     2. STUN
     3. ICE
4. **Gateway** (Protocol conversion, message processing) 
     1. PSTN
     2. VoIP

Sandro focused on one particular feature that can be a major choke point in your signaling services and their dependencies if attacked: quality of service and specifically, resource exhaustion. He gave a demo using the SIPVicious PRO Demo Server. 

## Links!

- [The Awesome Real-time Communications hacking & pentesting resources](https://github.com/EnableSecurity/awesome-rtc-hacking/) (Covers VoIP, WebRTC and VoLTE security related topics: 
- [RTC Security Newsletter](https://www.rtcsec.com/newsletter/)
- TURN relay abuse references: 
    - [https://www.rtcsec.com/article/slack-webrtc-turn-compromise-and-bug-bounty/](https://www.rtcsec.com/article/slack-webrtc-turn-compromise-and-bug-bounty/)
    - [https://hackerone.com/reports/333419](https://hackerone.com/reports/333419)
    - [https://www.rtcsec.com/post/2020/06/03-bug-bounty-bout-0x01-webrtc-edition/](https://www.rtcsec.com/post/2020/06/03-bug-bounty-bout-0x01-webrtc-edition/)
    - [https://www.rtcsec.com/article/cve-2020-26262-bypass-of-coturns-access-control-protection/](https://www.rtcsec.com/article/cve-2020-26262-bypass-of-coturns-access-control-protection/)
    - [https://firefart.at/post/multiple\_vulnerabilities\_cisco\_expressway/](https://firefart.at/post/multiple_vulnerabilities_cisco_expressway/)
- [Bug bounty report for Slack DTLS Certificate](https://hackerone.com/reports/531032) with well-known private key
- And of course, [enablesecurity.com](http://enablesecurity.com/) 

## [Watch Episode #76!](https://youtu.be/qlQJuyp7nS8)

---

### UP NEXT! WebRTC Live #77 with Vonage Developer Advocate, Diana Pham

***Wednesday, March 15 at 12:30 pm Eastern.*** [***Register today!***](https://webrtc.ventures/webrtclive_registration/)

---

**Do you have a topic that you would like to see discussed on WebRTC Live? Let us know by emailing [news@webrtc.ventures](mailto:news@webrtc.ventures).**

---

***Never miss an episode of WebRTC Live, ****our webinar series hosted by WebRTC.ventures Founder and CEO, *[*Arin Sime*](https://www.linkedin.com/in/arinsime/)*. We feature the latest use cases and technical updates to this increasingly popular coding standard for live video. Watch past episodes on our *[*WebRTC Live page*](https://webrtc.ventures/webrtc-live/)*, our *[*YouTube channel*](https://www.youtube.com/channel/UC7ty8nH5cBP0mqiZFl9bb9g)*, and on *[*our blog*](https://webrtc.ventures/blog/)*. Better yet, use the form in the sidebar to join our mailing list and be among the first to hear about upcoming episodes and the latest news in WebRTC!*

[CPaaS](https://blog.webrtc.ventures/tag/cpaas), [Managed Services](https://blog.webrtc.ventures/tag/managed-services), [Events](https://blog.webrtc.ventures/tag/events), [Video Conferencing](https://blog.webrtc.ventures/tag/video-conferencing), [Real Time Weekly](https://blog.webrtc.ventures/tag/real-time-weekly), [WebRTC Architecture](https://blog.webrtc.ventures/tag/webrtc-architecture), [Broadcasting](https://blog.webrtc.ventures/tag/broadcasting), [Medical](https://blog.webrtc.ventures/tag/medical), [WebRTC Live](https://blog.webrtc.ventures/tag/webrtc-live), [Showcase](https://blog.webrtc.ventures/tag/showcase), [Thoughts](https://blog.webrtc.ventures/tag/thoughts), [Vonage](https://blog.webrtc.ventures/tag/vonage), [Daily](https://blog.webrtc.ventures/tag/daily), [Jobs](https://blog.webrtc.ventures/tag/jobs), [Contact Centers](https://blog.webrtc.ventures/tag/contact-centers), [Telehealth](https://blog.webrtc.ventures/tag/telehealth), [Education](https://blog.webrtc.ventures/tag/education), [Technical](https://blog.webrtc.ventures/tag/technical), [General](https://blog.webrtc.ventures/tag/general), [Story of success](https://blog.webrtc.ventures/tag/story-of-success), [The WebRTC.ventures Blog](https://blog.webrtc.ventures/tag/the-webrtc-ventures-blog), [Testing](https://blog.webrtc.ventures/tag/testing), [Gaming](https://blog.webrtc.ventures/tag/gaming), [DevOps](https://blog.webrtc.ventures/tag/devops), [Symbl.ai](https://blog.webrtc.ventures/tag/symbl-ai)

## Related posts

[![](https://blog.webrtc.ventures/hs-fs/hubfs/Imported_Blog_Media/WebRTC-and-Security-1.png?height=200&name=WebRTC-and-Security-1.png)](https://blog.webrtc.ventures/2020/11/webrtclive-webrtc-and-security)

## [Watch WebRTC Live #48: WebRTC and Security with Google's Natalie Silvanovich](https://blog.webrtc.ventures/2020/11/webrtclive-webrtc-and-security)

![Picture of Jen Oppenheimer](https://blog.webrtc.ventures/hs-fs/hubfs/Our-Team-Jen.jpg?width=50&name=Our-Team-Jen.jpg) [Jen Oppenheimer](https://blog.webrtc.ventures/author/jen-oppenheimer) 

 Nov 17, 2020 12:00:00 AM

On November 11, 2020, WebRTC.ventures produced our 48th episode of WebRTC Live. Arin’s guest was...

[Read more](https://blog.webrtc.ventures/2020/11/webrtclive-webrtc-and-security)

[![](https://blog.webrtc.ventures/hs-fs/hubfs/Imported_Blog_Media/WebRTC-For-The-Curious-with-Sean-DuBois-1.png?height=200&name=WebRTC-For-The-Curious-with-Sean-DuBois-1.png)](https://blog.webrtc.ventures/2020/11/webrtclive-webrtc-for-the-curious)

## [Watch WebRTC Live #47: “WebRTC For The Curious with Sean DuBois"](https://blog.webrtc.ventures/2020/11/webrtclive-webrtc-for-the-curious)

![Picture of Jen Oppenheimer](https://blog.webrtc.ventures/hs-fs/hubfs/Our-Team-Jen.jpg?width=50&name=Our-Team-Jen.jpg) [Jen Oppenheimer](https://blog.webrtc.ventures/author/jen-oppenheimer) 

 Nov 2, 2020 12:00:00 AM

On October 28, 2020, WebRTC.ventures produced our 47th episode of WebRTC Live. Arin’s guest was...

[Read more](https://blog.webrtc.ventures/2020/11/webrtclive-webrtc-for-the-curious)

[![](https://blog.webrtc.ventures/hs-fs/hubfs/Imported_Blog_Media/Things-I-Wish-I-Knew-Before-Building-My-First-WebRTC-App.png?height=200&name=Things-I-Wish-I-Knew-Before-Building-My-First-WebRTC-App.png)](https://blog.webrtc.ventures/2021/01/things-i-wish-i-knew-before-building-my-first-webrtc-app)

## [Things I Wish I Knew Before Building My First WebRTC App](https://blog.webrtc.ventures/2021/01/things-i-wish-i-knew-before-building-my-first-webrtc-app)

[Alberto Gonzalez](https://blog.webrtc.ventures/author/alberto-gonzalez) 

 Jan 22, 2021 12:00:00 AM

Naive me in 2015: Thinking WebRTC is just another browser API.

[Read more](https://blog.webrtc.ventures/2021/01/things-i-wish-i-knew-before-building-my-first-webrtc-app)

### WebRTC.Ventures Services

...

- Assess
- Build
- Integrate
- Test
- Deploy & Manage

### Contact Us

...

**Video should be an opportunity, not a headache.**   
 We’re here to build, integrate, assess and optimize, test, and even deploy and manage your live video application. 

[Contact us](https://blog.webrtc.ventures/2023/02/webrtclive-webrtc-exposed-vulnerabilities-and-attacks#contact)

### WebRTC Live

...

 View [past episodes](https://blog.webrtc.ventures/webrtc-live/) of our webinar interview series about the latest webRTC use cases and technical updates. Join our mailing list to learn about upcoming episodes! 

![WebRTC Live](https://blog.webrtc.ventures/hs-fs/hubfs/Template%20Images/widged-bannet.webp?height=90&name=widged-bannet.webp)

![logo-main-light](https://blog.webrtc.ventures/hubfs/logo-main-light.svg "logo-main-light")

We’re one of the few agencies in the world dedicated to WebRTC development. This dedication and experience is why so many people trust us to help bring live video application dreams to life.

 

### Let's get started!

###### **[Contact us today](https://webrtc.ventures/contact/)**

**[info@webrtc.ventures](mailto:info@webrtc.ventures)**

<https://www.linkedin.com/company/webrtc-ventures> <https://www.youtube.com/@WebrtcVentures>

### Join our mailing list

We don't e-mail often (a few times a month max), and it will be worth it when we do! Of course, we respect your privacy and will not share your contact information.

© 2023 WebRTC.ventures, an [AgilityFeat](https://agilityfeat.com/) company / [Privacy Policy](https://webrtc.ventures/privacy-policy//)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Jen Oppenheimer",
    "url" : "https://blog.webrtc.ventures/author/jen-oppenheimer"
  },
  "dateModified" : "2024-04-03T19:02:02.652Z",
  "datePublished" : "2023-02-24T05:00:00.000Z",
  "headline" : "Watch WebRTC Live #76: WebRTC Exposed! Vulnerabilities and Attacks – WebRTC.ventures",
  "image" : [ "https://blog.webrtc.ventures/hubfs/Imported_Blog_Media/WebRTC-Live-_76_-WebRTC-Exposed-Vulnerabilities-and-Attacks.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.webrtc.ventures/2023/02/webrtclive-webrtc-exposed-vulnerabilities-and-attacks",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.webrtc.ventures/hubfs/logo-main-light.svg"
    }
  }
}
```