WebRTC for the Security Conscious Enterprise

WebRTC is a rather new technology. It enables people to communicate directly from the browser with no download or installation needed - that includes both voice and video calls.

A client of mine was negotiating a deal with a large enterprise. They wanted to deploy a WebRTC based service. The challenge occurred when into the meeting storms an IT specialist on the enterprise side, saying something along the lines of “I’ve heard WebRTC isn’t secure”. My client wasn’t prepared for this and that part of the meeting turned out to become an issue that needed to be answered for.

Since then, we’ve brainstormed on ways to unravel this, making sure to work out the details of the signalling they use (that part is up for the developers using WebRTC to secure). What we’ve settled for is this list of reasons why WebRTC is a secure solution for enterprise deployments:

1. WebRTC is secure by design

[caption id="attachment_23516" align="alignright" width="200"] Tsahi Levent-Levi[/caption]

WebRTC is the only VoIP standard that I know that by default encrypts all communications.

In all standards that came before it, security as in authentication and encryption took second place. They were optional at best, and oftentimes disabled in production.

With WebRTC this just can’t happen, simply because all sessions start encrypted and stay that way for as long as your communication lasts.

This focus on privacy isn’t just a part of the specification, but also a process when it comes to WebRTC, which leads me to the next reason -

2. Security issues that get raised get solved

WebRTC is incorporated into browsers. Browsers are meant to be secure as a lot of our daily office lives occur in front of them. To that end, all browsers have short release schedules that span from several weeks to a few months, where in between security patches are deployed if and when needed. Browsers also automatically update unless configured otherwise. New browser releases are picked up and adopted in a matter of days.

There are two areas that shows this attention to security - the IP leak issue and fuzzing.

IP leak: For a few years now there have been complaints about WebRTC sharing local IP addresses in its negotiation, which is something all VoIP products do simply to get their sessions connected. With WebRTC this is somewhat tricky, as that information gets passed through the browser giving access to the application and any loaded extensions as part of the process. A solution to that is currently being experimented with where local IP addresses are replaced by mDNS addresses. The process itself is far from being perfect, but it is being addressed and taken care of at the specification and implementation level of WebRTC.

Fuzzing: Google has something called Project Zero, where they put developers to work on finding zero day vulnerabilities in different products. Their recent foray got them to publicise some iOS issues. For video conferencing, they went ahead and tried using a technique called fuzzing to crash and burn different apps. In the process, they found and filed several bugs against WebRTC (which were later fixed).

WebRTC is taking security issues seriously. Probably more so than most other vendors.