RE: https://fosstodon.org/@fredposner/116138154658246911

Thanks for the good work you do @fredposner !

Two weeks ago we published our analysis of TURN security threats. Today: how to fix them.

New guides covering implementation-agnostic best practices (IP range blocking, protocol hardening, rate limiting, deployment patterns) and coturn-specific configuration with copy-paste templates at three security levels.

Best practices: https://www.enablesecurity.com/blog/turn-security-best-practices/
coturn guide: https://www.enablesecurity.com/blog/coturn-security-configuration-guide/
Config templates on GitHub: https://github.com/EnableSecurity/coturn-secure-config

coturn 4.9.0 dropped yesterday with fixes for CVE-2026-27624 (IPv4-mapped IPv6 bypass of deny rules) and an inverted web admin password check that had been broken since ~2019. The guides cover workarounds for older versions.

#infosec #webrtc #security #TURN #coturn #penetrationtesting #voip #serversecurity

TURN servers are meant to relay WebRTC media. To an attacker, they're just proxies.

We wrote up the threats we've been finding since 2017: relay abuse, DoS amplification, and software vulns.

https://www.enablesecurity.com/blog/turn-server-security-threats/

#infosec #webrtc #security #TURN #penetrationtesting #voip

RE: https://fosstodon.org/@fredposner/115984882790920134

What @fredposner said is 100% correct :D