Ensuring Endpoint Authenticity in WebRTC Peer-to-peer Communication
| Title | Ensuring Endpoint Authenticity in WebRTC Peer-to-peer Communication |
| Publication Type | Conference Paper |
| Year of Publication | 2016 |
| Authors | De Groef, Willem, Subramanian, Deepak, Johns, Martin, Piessens, Frank, Desmet, Lieven |
| Conference Name | Proceedings of the 31st Annual ACM Symposium on Applied Computing |
| Publisher | ACM |
| Conference Location | New York, NY, USA |
| ISBN Number | 978-1-4503-3739-7 |
| Keywords | Collaboration, composability, Human Behavior, Metrics, peer authentication, peer to peer security, peer-to-peer communication, pubcrawl, real-time communication, Resiliency, Scalability, Web Application Security, WebRTC |
| Abstract | WebRTC is one of the latest additions to the ever growing repository of Web browser technologies, which push the envelope of native Web application capabilities. WebRTC allows real-time peer-to-peer audio and video chat, that runs purely in the browser. Unlike existing video chat solutions, such as Skype, that operate in a closed identity ecosystem, WebRTC was designed to be highly flexible, especially in the domains of signaling and identity federation. This flexibility, however, opens avenues for identity fraud. In this paper, we explore the technical underpinnings of WebRTC's identity management architecture. Based on this analysis, we identify three novel attacks against endpoint authenticity. To answer the identified threats, we propose and discuss defensive strategies, including security improvements for the WebRTC specifications and mitigation techniques for the identity and service providers. |
| URL | http://doi.acm.org/10.1145/2851613.2851804 |
| DOI | 10.1145/2851613.2851804 |
| Citation Key | de_groef_ensuring_2016 |