Offensive VoIP/WebRTC security; mostly harmless Writes at https://xitter.cf/t.co/15yJ08eLrd Chief Mischief Officer @enablesecurity
Bavaria, Germany
Joined January 2008
- Tweets2.5K
- Following1.8K
- Followers3.9K
- Likes845
Missing reset key = "". No pending reset = NULL. In Perl those are equal, so the password changes. Tiny bug, full account takeover. Credit to Integrics for turning the fix around in days.
New advisory ES2026-06: password reset authentication bypass in Enswitch. If an account had no pending reset, anyone who knew the username could set a new password with no reset key. Abused in the wild before disclosure. Fixes are available.
enablesecurity.com/blog/ensw…
September RTCSec newsletter: Switchvox CVE-2026-9586 exploited in the wild, a zero-click WeChat call bug from @XorNinja's team at Calif, 16 OpenSIPS advisories, and why so many advisories now come without CVEs.
enablesecurity.com/newslette…
#VoIP #WebRTC #InfoSec
1/ April RTCSec newsletter is out. AI-assisted vulnerability research is accelerating fast across the RTC ecosystem.
enablesecurity.com/newslette…
1/ If you run FreeSWITCH or FusionPBX, upgrade to 1.11.3 now. Servers are being taken over in the wild through api-chat, and we saw it first hand on a compromised box.
August RTCSec newsletter 🧵
August RTCSec newsletter: FreeSWITCH RCE exploited in the wild via api-chat, upgrade to 1.11.3. Plus what we found reproducing coturn's August advisory batch, and the RTC and telecom research out of Hacker Summer Camp.
enablesecurity.com/newslette…
4/ Plus Hacker Summer Camp: @thel3l and @rithvikvibhut's GPON tap that reads a neighbour's SIP calls for about $100, the SMS gateway nobody had audited, and consumer IoT that mostly does not do WebRTC properly.
Read it:
enablesecurity.com/newslette…
#VoIP #WebRTC #InfoSec #RTCSec
Thanks to @HCornflower @eakraly @miconda @liviuchircu @thel3l @rithvikvibhut @kavasilo @nickvourd @fredheiding @dwizzzleMSFT @RhysDowning_ and many more for their contributions!
July RTCSec newsletter: we reproduced 0day Rubbish's AI-found RCEs in Brekeke SIP Server and Cisco CUCM (real, no vendor fix yet), plus why impact assessment is the real work, a Kamailio SBOM, and FreePBX unauth criticals.
enablesecurity.com/newslette…
We just published the June RTCSec newsletter: DragonForce is now hiding ransomware C2 inside Microsoft Teams TURN relays (a first), SySS drops the TURNado TURN attack toolkit, and coturn ships hardening + 3 new CVEs.
enablesecurity.com/newslette…
4/ Also this month: FRAFOS caught toll fraud through 231 misconfigured Cisco Expressways, a big FreeSWITCH advisory batch (pre-auth mod_verto heap overflow), and our CommCon talk on attacking WebRTC conferencing.
Full issue: enablesecurity.com/newslette…
this one covers work by many people including covering work by @moritz_abrell @HCornflower @tsahil @ktoya_me @stephenfewer @EQSTLab @fra__bert @kwancro @zzoru @KarolinaGorna_ @mcipekci @rpaleari @teozoia @TristanInSec .. Give it a read!
We just published the May 2026 RTCSec newsletter: SIPConfusion forges caller ID & spoofs SMS across VoIP/VoLTE/RCS, an unauth FreeSWITCH SIP PUBLISH DoS, an OpenSIPS CVE batch, and Cryptex landing in libWebRTC.
enablesecurity.com/newslette…
Thanks to contributions from so many, including: @whucjj @murillo @HCornflower @juberti @cfluffy @razvancrainea @eakraly @miconda @kwancro @TristanInSec @nickvnetworking @tsahil and many more
enablesecurity.com/newslette… is out and about. This is the April newsletter about VoIP and WebRTC security. Thanks to contributions from @dan_jenkins @bogdan_iancu @bhology @aphtrinh @_th3y and various others. Enjoy!
1/ April RTCSec newsletter is out. AI-assisted vulnerability research is accelerating fast across the RTC ecosystem.
enablesecurity.com/newslette…
Second DVRTC scenario is out. If you missed it, DVRTC is our vulnerable VoIP/WebRTC lab. pbx2 uses OpenSIPS and FreeSWITCH instead of Kamailio and Asterisk, so the same ideas carry over with a different shape. Plus a SIP Lua SQL injection path that deserves its own post. Soon.
DVRTC, our intentionally vulnerable VoIP/WebRTC lab, now has a second scenario.
v0.2.0 adds pbx2: OpenSIPS, FreeSWITCH, and rtpproxy. It joins pbx1 (Kamailio, Asterisk, rtpengine, coturn), so DVRTC now covers two different VoIP stacks to practice against.
enablesecurity.com/blog/dvrt…
Updated version of @0xInfection's 2020 SIPVicious tutorial. Now uses DVRTC instead of the old demo.sipvicious.pro server, which has been retired. Good starting point if you're new to VoIP security testing.
Not a short one this latest newsletter, but worth a read! Covering work by various people, including @alex_gaynor, @ArinSime , @miconda , @jpdega , @metromoxie , @keenlooks , @newton_cheng @CarliniNicolas @ic0nz1, @tqbf , @tsahil and @kunte_ctf subscribe: enablesecurity.com/subscribe…
March RTCSec newsletter: 19 of 33 WebRTC media servers fail DTLS-SRTP auth (Webex, Zoom, Discord affected), we launched DVRTC for VoIP security training, and a WebRTC skimmer bypasses CSP to steal payment data.
enablesecurity.com/newslette…
Something we've wanted to build for a long time. VoIP/WebRTC security is hard to practice without setting up infrastructure yourself. This changes that.
Thanks to @digininja for inspiration and tips!
Web app security has DVWA. VoIP/WebRTC hasn't had anything like it.
Introducing DVRTC: a hands-on vulnerable lab for RTC security, with 7 guided exercises and a live instance at pbx1.dvrtc.net.
enablesecurity.com/blog/intr…
So yes.. February RTCSec newsletter: libvpx VP9 encoder overflow hits Chrome & Firefox WebRTC, Grandstream GXP1600 RCE to call interception, coturn's 7-year reversed password bug, and our TURN security blog series.
enablesecurity.com/newslette…
Enjoy!
#VoIP #WebRTC #InfoSec
1/ February RTCSec newsletter is out. Coturn 4.9.0 fixed a reversed password check in the web admin: wrong passwords were accepted, correct ones rejected. First bug report was filed in 2019. Fixed in 2026. Seven years.
enablesecurity.com/newslette…
The "ok but how do I fix it" companion to the TURN threats post. Copy-paste configs included. Also discussing this on WebRTC Live today: webrtc.ventures/webrtc-live/
Two weeks ago we covered TURN security threats. Today: how to fix them.
New guides: implementation-agnostic best practices + coturn-specific configuration with copy-paste templates.
Best practices: enablesecurity.com/blog/turn…
coturn guide: enablesecurity.com/blog/cotu…
Sandro Gauci retweeted
Two weeks ago we covered TURN security threats. Today: how to fix them.
New guides: implementation-agnostic best practices + coturn-specific configuration with copy-paste templates.
Best practices: enablesecurity.com/blog/turn…
coturn guide: enablesecurity.com/blog/cotu…