7 ms·
So Slack's VoIP uses WebRTC, which connects via UDP/TCP to always send SRTP packets through a TURN proxy (which extends STUN via ICE) to work around usual NAT p
by russellbeattie 7y ago
So Slack's VoIP uses WebRTC, which connects via UDP/TCP to always send SRTP packets through a TURN proxy (which extends STUN via ICE) to work around usual NAT problems. These guys scanned the TURN and found an SSRF which allowed them to connect to Slack's VPC on AWS using IAM temporary credentials. Interesting.
For fun, read that last paragraph out loud to a non-techy near by and watch their eyes...
- lwb 7y agoEven a techy who isn't familiar with networking protocols would start to glaze over!
- ct520 7y agoNot so much networking protocols but WebRTC maybe? I did a hello world type of implementation of WEBRTC awhile back and it made perfect sense to me.
- dep_b 7y agoYeah there's the WebRTC you can hack in an afternoon and there's the WebRTC that covers the most common edge cases. The problem that the solution to one problem (for example your websocket going disconnecting mid call while WebRTC still soldiers on) can create three new problems when a different edge case arises.
- tandr 7y agoThis is a nice summary actually. (btw, you can read it to techy-but-not-in-the-field and still get the same look. I am not sure if I should be sad or proud from the fact that I understood 90% of what you have said without google-fu...)
- pottertheotter 7y agoDo you mean this paragraph? "Our recommendation here is to make use of the latest coturn which by default, no longer allows peering with 127.0.0.1 or ::1. In some older versions, you might also want to use the no-loopback-peers."
- jedberg 7y agoOP means they paragraph they just wrote.
- pottertheotter 7y agoThanks! I don't know where my head was.
- topher200 7y agoI believe GP means this paragraph: > So Slack's VoIP uses WebRTC, which connects via UDP/TCP to always send SRTP packets through a TURN proxy (which extends STUN via ICE) to work around usual NAT problems. These guys scanned the TURN and found an SSRF which allowed them to connect to Slack's VPC on AWS using IAM temporary credentials. Interesting.
- pottertheotter 7y agoThanks! I don't know where my head was.
- keanebean86 7y agoSounds like you're STUNned. Try not to TURN you head and maybe put some ICE on it.
- bigdict 7y agoHey I thought he was referring to the last paragraph in the article too…
- jedberg 7y agoI understood every word of that and my eyes still glazed over. :)
- weavie 7y agoRead it to myself and my eyes glaze over, and I've spent the past couple of weeks trying to decipher all the acronyms involved in WebRTC!
- bitwize 7y agoCould be a line on CSI: Los Angeles.
- userbinator 7y agoI've worked with SIP and H323 but not WebRTC so I knew about STUN/TURN/ICE, but you're right about the acronym-soup, even to those who have networking experience --- VoIP is its own little niche. (Along the same lines, I've been a bystander to a group of GSM developers' meetings and it's just as incomprehensible.)
- kalium_xyz 7y agoHeh, reminds me of neuromancer
- ddrt 7y agoAcronym city right here.
- saagarjha 7y agoI read your paragraph and almost didn’t read the actual article :(
- m463 7y agoI recall Elon Musk's Acronyms Seriously Suck memo