| Enable Security | https://infosec.exchange/@enablesecurity |
RE: https://infosec.exchange/@enablesecurity/116300709031150946
VoIP/WebRTC security has needed a DVWA equivalent for a long time. We built DVRTC: full dockerized VoIP stack, intentionally vulnerable, 7 guided exercises.
Live instance at pbx1.dvrtc.net — try it now.
https://www.enablesecurity.com/blog/introducing-dvrtc-damn-vulnerable-real-time-communications/
#infosec #webrtc #voipsecurity #penetrationtesting #training
RE: https://infosec.exchange/@enablesecurity/116130697375709804
Published the "how to fix it" companion to our TURN security threats post. Best practices guide + coturn config templates at three security levels.
Also discussing TURN security on WebRTC Live today: https://webrtc.ventures/webrtc-live/
https://www.enablesecurity.com/blog/turn-security-best-practices/
https://www.enablesecurity.com/blog/coturn-security-configuration-guide/
RE: https://infosec.exchange/@enablesecurity/116057294204565643
Wrote up our RTCon 2025 talk on TURN security threats. TURN servers are basically open proxies with extra steps. At DEF CON someone showed C2 over Zoom's TURN infra.
https://www.enablesecurity.com/blog/turn-server-security-threats/
#infosec #webrtc #security #TURN #penetrationtesting #voip
@fredposner @sandrogauci Thanks for the post! This one covers:
FreePBX troubles and fixes (CVE-2025-57819 + more)
Voice-AI meets toll fraud 📞💸
RTP Bleed clarifications for DTLS-SRTP
TURN security deep-dive
+ Qualcomm & Chrome WebRTC vulns
https://www.enablesecurity.com/newsletter/2025-09-rtcsec-news/
End of the month which means it's time for me to link the @enablesecurity newsletter and say...
"There are those who read what @sandrogauci writes... and those who wish they had."
https://www.enablesecurity.com/newsletter/2025-09-rtcsec-news/
Last time for 2024...
There are those who read what @sandrogauci / @enablesecurity write, and those who wish they had.
https://www.enablesecurity.com/newsletter/2024-12-rtcsec-news/
As I say every issue… there are those who read what @enablesecurity / @sandrogauci write and those who wish they had.
Very packed edition this month. As I love to say... you either read what @sandrogauci / Enable Security GmbH writes **or you wish you had**.
https://www.enablesecurity.com/newsletter/2024-10-rtcsec-news/
October 2024 RTCSec newsletter: 3 years of newsletter, a new white paper about a WebRTC implementation vulnerability, DEF CON 32 talks that mention WebRTC, a fake FBI-run phone company and SIP URI parsing vulnerabilities, various vulnerabilities fixed in Cisco ATA devices, Mitel, VICIDial, and more
@sandrogauci and the Enable Security GmbH posted the latest RTC Security Newsletter.
Required reading as far as I'm concerned.
@Kwancro is also featured with his amazing open relay tester.
Fred Posner
Enable Security