Adventures in Video Conferencing Part 1: The Wild World of WebRTC

Minimalist · Dec 4, 2018

Over the past five years, video conferencing support in websites and applications has exploded. Facebook, WhatsApp, FaceTime and Signal are just a few of the many ways that users can make audio and video calls across networks. While a lot of research has been done into the cryptographic and privacy properties of video conferencing, there is limited information available about the attack surface of these platforms and their susceptibility to vulnerabilities. We reviewed the three most widely-used video conferencing implementations. In this series of blog posts, we describe what we found.

This part will discuss our analysis of WebRTC. Part 2 will cover our analysis of FaceTime. Part 3 will discuss how we fuzzed WhatsApp. Part 4 will describe some attacks against WhatsApp that didn’t work out. And finally, Part 5 will discuss the future of video conferencing and steps that developers can take to improve the security of their implementation.
Click to expand...

https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-1.html

Minimalist · Dec 5, 2018

Adventures in Video Conferencing Part 2: Fun with FaceTime

FaceTime is Apple’s video conferencing application for iOS and Mac. It is closed source, and does not appear to use any third-party libraries for its core functionality. I wondered whether fuzzing the contents of FaceTime’s audio and video streams would lead to similar results as WebRTC.
Click to expand...

https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-2.html

Minimalist · Dec 12, 2018

Adventures in Video Conferencing Part 3: The Even Wilder World of WhatsApp

WhatsApp is another application that supports video conferencing that does not use WebRTC as its core implementation. Instead, it uses PJSIP, which contains some WebRTC code, but also contains a substantial amount of other code, and predates the WebRTC project. I fuzzed this implementation to see if it had similar results to WebRTC and FaceTime.
Click to expand...

https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-3.html

Minimalist · Dec 12, 2018

Adventures in Video Conferencing Part 4: What Didn't Work Out with WhatsApp

Not every attempt to find bugs is successful. When looking at WhatsApp, we spent a lot of time reviewing call signalling hoping to find a remote, interaction-less vulnerability. No such bugs were found. We are sharing our work with the hopes of saving other researchers the time it took to go down this very long road. Or maybe it will give others ideas for vulnerabilities we didn’t find.
Click to expand...

https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-4.html

guest · Dec 13, 2018

Adventures in Video Conferencing Part 5: Where Do We Go from Here?
December 13, 2018
https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-5.html

Overall, our video conferencing research found a total of 11 bugs in WebRTC, FaceTime and WhatsApp. The majority of these were found through less than 15 minutes of mutation fuzzing RTP. We were surprised to find remote bugs so easily in code that is so widely distributed. There are several properties of video conferencing that likely led to the frequency and shallowness of these issues. [...]
Click to expand...

Log in or Sign up

Adventures in Video Conferencing Part 1: The Wild World of WebRTC

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Log in or Sign up

Adventures in Video Conferencing Part 1: The Wild World of WebRTC

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Useful Searches