Subject: Re: [rtcweb] I-D Action: draft-ietf-rtcweb-ip-handling-01.txt

From: Randell Jesup <[email-masked]>
Date: Mon, 2 May 2016 16:59:42 -0400

On 4/26/2016 4:11 AM, Philipp Hancke wrote:
> I stumbled upon a (now deleted) stackoverflow posting yesterday in 
> which obfuscated code "used webrtc" to hack the users router.
> Basically webrtc was used to get the local ip address from which the 
> routers ip is inferred. Then a default admin account is tried.
>
> It turns out the idea is not knew, I heard from some former coworkers 
> that they used this in penetration testing before. But it has now 
> reached stackoverflow which means there will soon be rumors and all 
> kinds of "webrtc allows hacking your router" stories.

Definitely not new, nor (as you state) requiring webrtc in any manner.

> The principal problem here is default passwords. WebRTC makes it 
> slightly easier by removing the need to run a series of http requests 
> to find out the routers ip. Should this be mentioned as an example in 
> #1 of the problem statement?

My only concern is not wanting to publish a blueprint for attacks (even 
if known to some).  Perhaps irrelevant.

-- 
Randell Jesup -- rjesup a t mozilla d o t com
Please please please don't email [email-masked]!  Way too much spam