Enable Security

We talk about Offensive Real-Time Communications / VoIP and WebRTC Security
Blog:

[Enable Security @enablesecurity]

4/ Also this month: FRAFOS caught toll fraud through 231 misconfigured Cisco Expressways, a big FreeSWITCH advisory batch (pre-auth mod_verto heap overflow), and our CommCon talk on attacking WebRTC conferencing.

Full issue: https://t.co/nYxY4OntT7

[Enable Security @enablesecurity]

1/ DragonForce ransomware now tunnels its C2 through Microsoft Teams TURN relays. Symantec calls it the first publicly documented case of a threat actor abusing TURN for C2. On the wire it looks like a normal Teams call, slipping past perimeters that safelist Microsoft.

[Enable Security @enablesecurity]

3/ coturn shipped new hardening defaults (4.13.1/4.14.0, including a native amplification rate limit) plus three more CVEs, including a default loopback bypass (CVE-2026-53450). We refreshed our coturn security configuration guide to match.

[Enable Security @enablesecurity]

5/ Plus our Damn Vulnerable RTC talks and workshop from OpenSIPS Summit and Kamailio World. Full edition: https://t.co/aVfABGxsmK
#VoIP #WebRTC #InfoSec

[Enable Security @enablesecurity]

1/ The May RTCSec newsletter is out. The standout: SIPConfusion (NDSS 2026), where Tsinghua researchers forge caller ID and spoof SMS across VoIP, VoLTE and RCS by exploiting how SIP implementations disagree on parsing identity headers. 🧵

[Enable Security @enablesecurity]

4/ Good news for a change: Cryptex (RFC 9335) negotiation landed in libWebRTC, so RTP header extensions and CSRCs can finally be encrypted, closing a long-standing metadata-leak gap in SRTP.

[OpenSIPS project @opensips]

#OpenSIPSSummit, Day #3
Sandro Gauci @ @enablesecurity
Securing Damn Vulnerable #RTC
#sip #voip #telecom #security #opensource

[OpenSIPS project @opensips]

#OpenSIPSSummit 2026, Day 1
Sandro Gauci @ @enablesecurity
talking about #Vulnerable Real-Time #Communications
#sip #voip #rtc #telecom #opensource

[Enable Security @enablesecurity]

5/ Plus short news: Chrome WebRTC UAF, FreePBX GraphQL command injection (no vendor advisory yet), Mitel MiCollab CVSS 9.8 SQLi, Neko privilege escalation, ZLMediaKit VP9 heap overflow, and Grandstream mandatory MFA.

Read it all: https://t.co/LAmIab0GDy

#VoIP #WebRTC #InfoSec

[Enable Security @enablesecurity]

1/ April RTCSec newsletter is out. AI-assisted vulnerability research is accelerating fast across the RTC ecosystem.

https://t.co/LAmIab0GDy

[Enable Security @enablesecurity]

4/ I'll be presenting DVRTC at @opensips Summit (Bucharest, Apr 28), Kamailio World (Berlin, May 8), and CommCon (Dusseldorf, June 9-11). Three conferences, three different VoIP/WebRTC attack scenarios.

[Enable Security @enablesecurity]

Live instance: https://t.co/6OHhPoposS
Self-host: https://t.co/dUHUvmNHRS

[Enable Security @enablesecurity]

DVRTC, our intentionally vulnerable VoIP/WebRTC lab, now has a second scenario.
v0.2.0 adds pbx2: OpenSIPS, FreeSWITCH, and rtpproxy. It joins pbx1 (Kamailio, Asterisk, rtpengine, coturn), so DVRTC now covers two different VoIP stacks to practice against.
https://t.co/s8GcI09wIi

[Enable Security @enablesecurity]

That last one is especially fun: the injection point is the called SIP URI itself. We'll cover it in a dedicated post with a video demo soon.